Privacy

Last updated October 5, 2026

Sydbar is an agentic CRM for agencies: it reads the mail of the businesses you connect, keeps each business separate, and helps you finish the work that arrives there, with agents that act only under rules you set. This page says what we store, why, who processes it on our behalf, and how to remove it. We don’t sell your data and we don’t show ads.

What we store

• Your account: your email address and a hashed password, or your Google account’s name and email if you sign in with Google.
• Your businesses: names, settings, signatures, business context you add or confirm, clients, deal stages, scopes of work, invoices and their PDFs, booking pages and bookings.
• Mail from connected mailboxes: the conversations Sydbar brings in (mail from people, anything involving your clients, and your replies in those conversations) and the replies you or your agents send through it. Newsletters, marketing and notifications are left in your mailbox and not stored.
• Agent email: the rules you set for each business, how Jev read each email it scored (the situation it matched and how sure it was), and a record of every email an agent wrote, sent, held or had cancelled, with the checks it passed.
• Connection secrets: Google, GitHub, Linear and Notion tokens, mailbox app passwords and AI keys. They stay on the server and are never shown again after you connect. Agent keys are stored as a one-way hash.
• Preferences on your device: a session cookie to keep you signed in, cookies for your theme and time zone, and local browser storage for layout choices. No analytics or advertising cookies.

Google user data

When you connect a Google account to a business, Sydbar uses the access you grant only to provide the features you use in Sydbar:

• Gmail: read the headers and labels of new mail to decide what comes in, bring in the conversations that matter, send the replies you send and, when you turn on agent email, the replies agents send under your rules, archive or trash conversations you choose, apply labels for tags, and read your Gmail signature when you import it.
• Google Calendar: show your events, find free times for your booking pages, and create events when someone books or when you add one.
• Google Meet: read the transcripts of calls you import onto a client.

Sydbar’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don’t use Google user data for advertising, we don’t sell it, and people don’t read it except to keep the service secure, to comply with the law, or when you ask us to help with something specific.

How AI is used

When you ask Sydbar to draft an invoice or a scope of work, or run the business interview, and when an agent writes an email, the text needed for that task (the conversation, the client’s details and your confirmed context) is sent to an AI model provider, through Vercel AI Gateway, using your own Anthropic or OpenAI key where you’ve added one. Jev, the model that sorts mail, decides what agents may do and checks their drafts, is run by TypeSafe: it reads the text of the emails and drafts it scores. Mail is treated as information, never as instructions. Email goes to other people only when you send it, or when an agent sends it under rules you turned on.

Who processes data for us

• Convex: the database and server functions where your data is stored.
• Vercel: hosting for the website and app, and the AI gateway.
• Anthropic or OpenAI: AI drafting, when you use it.
• TypeSafe: Jev, which scores mail for triage and agent email and checks agent drafts.
• Resend: booking confirmation emails, when booking emails are turned on.
• Google, GitHub, Linear and Notion: only when you connect them, to provide those connections.

Keeping businesses apart

Every request is checked against the business it belongs to. Members of one business can’t see another business’s mail, clients or connections, and connected AI agents follow the same rule. See Security and privacy.

Removing your data

• Disconnecting a mailbox, GitHub, Linear or Notion in Settings → Connections deletes the stored token or password; for Google, Sydbar also asks Google to revoke its access. Your conversations stay until you delete the business.
• You can revoke Sydbar’s access to your Google account at any time at myaccount.google.com/permissions.
• Settings → Business → Delete removes a business and everything in it: conversations, clients, invoices, booking pages, client portal links, context and connections. It starts at once and finishes within minutes.
• Settings → Account → Delete account removes your account with every business only you belong to. You can also email hello@sydbar.app from the address you sign in with, and we delete it within 30 days. Deleting in Sydbar never deletes mail in your mailbox.

Contact

Questions about privacy: hello@sydbar.app. If we change this policy in a way that matters, we’ll say so in the app before it takes effect.