Privacy Policy

Controller: Synaptic Four (sole proprietorship / Einzelunternehmen) (“we,” “us,” or “our”), operating Synaptic Products. Registered office: Königstraße 5, 70173 Stuttgart, Germany. VAT ID: DE461612004. The natural-person provider details required under German Impressum law (§ 5 DDG) are published only on the Legal notice (Impressum) page.

Effective date: August 6, 2026

This policy covers US business customers and visitors, and summarizes GDPR topics for an EU/EEA controller operating a US-targeted storefront. It is not legal advice. Have counsel review it before relying on it in production.

A Data Protection Officer is currently not required for our business. For data protection requests, please contact us directly using the email address provided in the Impressum.

German Impressum / company entity details

Requirement note: Under § 5 of the German Digital Services Act (DDG / Digitale-Dienste-Gesetz), the service provider must publish identifying company entity details (Impressum), including legal name / form, authorized representative (Inhaber), registered office address in Germany, VAT ID where applicable, and contact. Those facts for Synaptic Four are maintained on our Legal notice (Impressum) page and summarized here for privacy transparency.

• Legal entity / trading name: Synaptic Four (sole proprietorship / Einzelunternehmen)
• Registered office: Königstraße 5, 70173 Stuttgart, Germany
• VAT ID (USt-IdNr.): DE461612004
• Email: contact@synapticfour.com
• Owner / Inhaber (natural person): published only in the Impressum (and German Impressum section) as required by § 5 DDG for this business form — not repeated on other storefront pages.

Not applicable. Synaptic Four is operated as a German sole proprietorship (Einzelunternehmen) and is not entered in the commercial register (Handelsregister).

CAN-SPAM physical mailing address (US commercial email)

Under the US CAN-SPAM Act, commercial email must include a valid physical postal address. We use our German headquarters as that address in outreach and marketing footers:

Opt out of future commercial email via Unsubscribe, the unsubscribe link in each message, or by emailing contact@synapticfour.com with subject STOP. Transactional order/delivery messages may still be sent when needed to fulfill a purchase.

1. Information we collect

• Contact details you provide (name, email, company, message).
• Order metadata from Stripe Checkout (email, product, payment status). We do not store full payment card numbers.
• Technical data such as IP address, browser, device, referrer, and pages viewed (hosting / security logs and, where applicable, anonymized traffic metrics).
• Webfonts — Syne and DM Sans are self-hosted on this site (first-party). Browsers do not load fonts from Google Fonts or other third-party font CDNs.
• Vercel Web Analytics — cookieless, aggregate page-view and performance metrics (see Vercel Web Analytics). This does not store personally identifiable information (PII) for marketing profiles.
• Optional marketing analytics events (only if you accept optional analytics cookies) via PostHog and Google Analytics.
• Suppression preferences when you unsubscribe from commercial email.

2. How we use information

• Fulfill digital product orders and send access instructions.
• Respond to support, licensing, and enterprise purchasing requests.
• Prevent fraud, abuse, and security incidents.
• Send commercial email only when allowed, with a working unsubscribe.
• Understand aggregate traffic and site performance (Vercel Web Analytics).
• Improve the catalog and checkout if optional marketing analytics consent is granted (PostHog / Google Analytics).

3. Sharing

We share data with processors who help us operate the storefront, including:

• Stripe (payments)
• Supabase (order/lead data storage)
• Resend (transactional and permitted commercial email)
• Vercel Inc. (hosting and Vercel Web Analytics)
• PostHog / Google Analytics (only with optional analytics consent)

We do not sell personal information for money.

3a. Analytics / data processing — Vercel Web Analytics

We use Vercel Web Analytics to analyze aggregate web traffic and performance (for example page views and basic navigation metrics) so we can operate and improve the storefront.

Vercel Web Analytics is designed to be cookieless: it does not rely on advertising cookies, does not collect or store personally identifiable information (PII) for visitor profiling, and automatically anonymizes visitor IP addresses. It is treated as a privacy-first site-operations tool and is not gated behind the optional “Accept analytics” cookie banner (that banner applies to PostHog and Google Analytics only).

Processor: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes analytics and hosting-related data on our behalf under their data processing terms. See Vercel’s Privacy Policy for details on how Vercel handles information.

Where GDPR applies, our use of cookieless aggregate traffic measurement for operating the site is based primarily on legitimate interests (Art. 6(1)(f)), balanced against your rights. Optional cookie-based marketing analytics remain consent-based (Art. 6(1)(a)).

4. Legal bases (GDPR / EU visitors)

Where the GDPR applies, we process personal data on these bases (Art. 6):

• Contract (Art. 6(1)(b)) — checkout, delivery, and support for purchased kits.
• Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, basic site operations, and cookieless aggregate traffic / performance measurement via Vercel Web Analytics (balanced against your rights).
• Consent (Art. 6(1)(a)) — optional marketing analytics cookies (PostHog / Google Analytics) and newsletter / commercial email where consent is required.
• Legal obligation (Art. 6(1)(c)) — tax, accounting, and regulatory record-keeping.

5. Your rights

US (CalOPPA / CPRA topics)

Depending on your state, you may have rights to know, access, correct, or delete personal information we hold, and to opt out of certain sharing for cross-context behavioral advertising. Email contact@synapticfour.com with subject “Privacy request”. We respond within a commercially reasonable time.

EU / EEA / UK (GDPR-style rights)

Where applicable, you may request access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests, and you may withdraw consent at any time (without affecting prior lawful processing). You may lodge a complaint with a supervisory authority — for our German establishment, that is typically the Landesbeauftragte für Datenschutz in Baden- Württemberg, without prejudice to other competent authorities.

We honor browser “Do Not Track” and Global Privacy Control signals where practical by defaulting optional marketing analytics (PostHog / Google Analytics) to off until you accept cookies. Cookieless Vercel Web Analytics for aggregate traffic is described above and is not a marketing pixel.

6. International transfers

We use processors that may process data in the United States and the EU (for example Stripe, Supabase, Resend, Vercel Inc. for hosting and Web Analytics, and—if consented—PostHog / Google Analytics). Where GDPR transfer rules apply, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) or an adequacy decision offered by the processor. Ask us for current subprocessors if you need them for a vendor review.

7. Cookies

See our Cookie notice for categories and how to change preferences. Essential cookies support security and basic site function. Vercel Web Analytics is cookieless and is not controlled by the optional analytics toggle.

Optional marketing analytics cookies and scripts (PostHog, Google Analytics) load only after you explicitly click Accept on the cookie banner (consent under ePrivacy / TTDSG topics for EU visitors). Choosing “Essential only” keeps those vendors off; we may then use a first-party, cookieless aggregate beacon that does not set analytics cookies or store a marketing identifier in your browser.

Optional-analytics consent is stored in localStorage as granted or denied under the key used by our consent module. You can reopen Cookie preferences from the site footer at any time.

8. Your privacy choices (US)

Depending on your state (including California CPRA topics), you may have rights to know, access, correct, delete, and opt out of certain “sharing” of personal information for cross-context behavioral advertising.

We do not sell personal information for money. Optional marketing analytics (PostHog / Google Analytics) load only after you accept cookies. You can switch to essential-only anytime via Cookie preferences on this site, or clear site data in your browser. For access, deletion, or other privacy requests, email contact@synapticfour.com with subject “Privacy request”.

Marketing email: use Unsubscribe or reply STOP. Global Privacy Control (GPC) signals are treated as a request to keep optional marketing analytics off until you explicitly accept cookies.

9. Retention & security

We retain order and support records as needed for accounting, fraud prevention, and legal obligations (typically up to the applicable commercial limitation / tax retention periods, then delete or anonymize). Technical safeguards include HTTPS, access-controlled admin tooling, and Stripe-hosted card entry. See also Security & trust.

10. Children

The storefront is for business customers. We do not knowingly collect personal information from children under 16. Checkout requires buyers to confirm they are 18+ and purchasing for business / professional use.

11. Contact

Privacy questions: contact@synapticfour.com
Postal address: Königstraße 5, 70173 Stuttgart, Germany

Related: Terms of Service · Unsubscribe