Privacy Policy for XYO Enrichment Platform

This Privacy Policy and Data Processing Specification describes how Syniol Limited ("Syniol", "we", "us", or "our") collects, uses, stores, and protects personal data when you access the XYO developer portal (xyo.financial), utilize the XYO Enrichment API, integrate our Native Systems SDKs, deploy the Sovereign Appliance, or engage with related services. By registering for an account, provisioning API credentials, or submitting requests to our endpoints, you acknowledge the data processing practices described in this policy.

Our data processing architecture is engineered around the principles of privacy-by-design, data minimization, and stateless stream processing. For any questions regarding the processing of your data or our data privacy standards, please contact our compliance team at hello@syniol.com.

ROLES UNDER DATA PROTECTION LAW & DPA

In accordance with the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the European Union General Data Protection Regulation (Regulation (EU) 2016/679, EU GDPR):

  • Syniol as Data Controller: We act as an independent Data Controller for Customer Account Data, including developer registration records, administrative credentials, billing contacts, tax metadata, and direct commercial communications.
  • Syniol as Data Processor: Where our institutional customers (such as retail banks, card issuers, payment switches, and payment service providers) submit raw transaction descriptors or financial metadata to the XYO Enrichment API, our customer acts as the Data Controller, and Syniol acts strictly as a Data Processor executing real-time enrichment pursuant to Customer instructions.
  • Data Processing Addendum (DPA): Where required under Article 28 of the UK GDPR or EU GDPR, our standard institutional Data Processing Addendum governs our processing of transaction payloads on Customer's behalf and is incorporated by reference into Customer commercial agreements.

STATELESS ZERO-RETENTION INGRESS ARCHITECTURE

The core technological commitment of the XYO platform is stateless, ephemeral execution:

  • Encrypted Ingress: Financial transaction payloads submitted to our cloud enrichment pipeline are transmitted exclusively over Transport Layer Security (TLS 1.3) with perfect forward secrecy.
  • In-Memory Transformation: Payloads are decoded and processed strictly in volatile system memory (RAM). Our neural transformer models disambiguate the merchant entity, normalize the brand mark, assign precise MCC categories, and calculate carbon metrics in real time.
  • Immediate Volatile Eviction: Once the structured JSON response is generated and returned to the calling application within sub-15ms latency, the volatile memory buffers are immediately deallocated and cleared.
  • Zero Data-at-Rest Persistence: Transaction strings, merchant descriptors, amounts, timestamps, and account identifiers are never written to disk, stored in persistent databases, cached, or logged.
  • Strict Model Isolation: We affirm categorically that customer financial transaction payloads submitted to the API are never mined, stored, or utilized to train general machine learning models or foundation weights. Our models are trained exclusively on public corporate registries, open merchant databases, and synthetic benchmark datasets.
  • Data-Sovereign Deployment Option: For Tier-1 financial institutions requiring complete infrastructure isolation, XYO deploys directly within Customer private VPC or on-premises core banking perimeter. Local L1 deterministic matching executes in-perimeter with optional private in-region L2 contextual model execution, guaranteeing strict regional sovereignty and zero cross-border egress.

WHAT WE COLLECT

We strictly restrict our data collection to the minimum information required to deliver and secure the Service:

  • Account & Identity Records: When you register for an account or enterprise tier, we collect your business email address, full name, corporate legal entity name, billing address, and VAT/tax registration number to administer your account, provision API credentials, and manage invoicing.
  • Billing Data: Subscription payments and automated credit card transactions are processed by our authorized payment gateway (Stripe). We retain only the invoicing metadata, subscription tier identifiers, and payment receipts necessary for statutory accounting and HMRC tax compliance. We never handle or store complete payment card numbers.
  • Authentication & Operational Telemetry: To secure our endpoints, enforce rate limits, and mitigate distributed denial of service attacks, we collect operational telemetry including API key hashes, source IP addresses, HTTP user agents, request timestamps, HTTP status codes, and execution latency. Telemetry contains no banking payload content.
  • Transaction Ingress Payloads (Ephemeral): Data submitted by Customer for real-time enrichment, such as raw merchant descriptor strings, transaction timestamps, ISO currency codes, transaction amounts, and postal identifiers. We enforce a strict prohibition against the submission of Primary Account Numbers (PANs), CVVs, or cardholder PIN blocks.
  • Consent-Gated Analytics: On our marketing website and developer portal, we collect aggregated usage analytics via Google Analytics governed by Google Consent Mode v2. Analytics trackers remain strictly inactive until you provide affirmative consent via our cookie banner.
  • No Special Category Data: We do not solicit, collect, or process special category personal data (such as health, biometric, or religious data under Article 9 UK GDPR) or criminal conviction records.

HOW WE USE YOUR DATA & LAWFUL BASES

In accordance with Article 6 of the UK GDPR and EU GDPR, we process personal data only where a recognized lawful basis exists:

  • Performance of Contract (Article 6(1)(b)): To authenticate your API requests, issue and rotate credentials, provide SDK downloads, meter usage against tier allowances, and return real-time enriched outputs in accordance with our Terms of Service.
  • Legitimate Interests (Article 6(1)(f)): To safeguard our infrastructure against malicious traffic, prevent credential compromise, mitigate denial of service attacks, enforce fair rate limits, and optimize network routing and latency.
  • Legal Obligations (Article 6(1)(c)): To maintain statutory accounting ledgers, issue compliant VAT invoices, and satisfy mandatory corporate, financial, and tax reporting requirements under United Kingdom law.
  • Consent (Article 6(1)(a)): For optional marketing communications or website analytics cookies, which you may grant or withdraw at any time.

DATA RETENTION SCHEDULES

We apply strict data minimization principles to ensure data is retained only for as long as legally and operationally necessary:

  • Transaction Ingress Payloads: Zero retention. Discarded immediately from volatile RAM upon generation of the enrichment response.
  • Customer Account Records: Retained for the active duration of Customer commercial agreement, plus up to six (6) years following account termination to satisfy statutory tax, audit, and corporate governance requirements under English law.
  • Operational Access & Security Logs: Retained on a rolling thirty (30) day operational window for security audits, DDoS mitigation, and anomaly detection, after which logs are permanently purged or irreversibly aggregated.

TECHNICAL & ORGANIZATIONAL SECURITY MEASURES

Syniol maintains robust technical and organizational security measures designed to protect data against unauthorized access, accidental loss, destruction, or alteration:

  • Cryptographic Protection: All external API communications enforce modern Transport Layer Security (TLS 1.3) with perfect forward secrecy. Account records, credential hashes, and portal databases are encrypted at rest using AES-256 standards.
  • Isolated Execution Environments: Cloud enrichment engines operate in isolated, read-only micro-containers with ephemeral memory paths and zero persistent disk write permissions.
  • Access Governance: Administrative access to production systems is restricted to authorized personnel via role-based access controls (RBAC), hardware multi-factor authentication (MFA), and zero-trust network auditing.
  • Automated Vulnerability Scanning: Container images and systems libraries undergo continuous automated security scanning for known common vulnerabilities and exposures (CVEs).

ACCOUNT DEACTIVATION AND KEY REVOCATION

  • Developers may revoke API keys at any time through the client portal interface. Key revocation propagates across all edge routing nodes immediately, terminating endpoint access for that token.
  • To request complete account deactivation and deletion of corporate registration records, please submit a request to hello@syniol.com from your authorized registered email address. Account closure is executed subject to statutory tax and financial record-keeping obligations.

THIRD PARTIES & SUBPROCESSORS

Syniol engages trusted enterprise infrastructure providers to deliver the platform. We enter into robust Data Processing Addenda (DPAs) with each subprocessor imposing data protection duties no less protective than those in this policy:

  • Cloud Infrastructure Hosts: Amazon Web Services (AWS) and Google Cloud Platform (GCP), utilizing sovereign data center facilities located in the United Kingdom and European Union.
  • Payment Gateway: Stripe Payments Europe Limited, certified to PCI-DSS Level 1 standards, for processing subscription payments and invoicing.
  • Consent-Gated Analytics: Google Analytics (Google Ireland Limited), deployed strictly under Google Consent Mode v2.
  • We never sell, rent, or trade personal data to third parties.
  • For additional terms governing the platform relationship, please review our Terms and Conditions.

INTERNATIONAL DATA TRANSFERS

Our primary data storage and processing infrastructure for European and United Kingdom customers is located within the United Kingdom and the European Economic Area (EEA).

Where operational requirements necessitate transferring personal data outside the UK or EEA, Syniol ensures appropriate safeguards are maintained in accordance with Chapter V of the UK GDPR and EU GDPR, including reliance on adequacy regulations, the UK International Data Transfer Addendum, or European Commission Standard Contractual Clauses.

YOUR RIGHTS UNDER UK & EU GDPR

Individuals located in the United Kingdom and European Union possess statutory rights under data protection law:

  • Right of Access: You may request confirmation of whether we process your personal data and obtain a copy of such data.
  • Right to Rectification: You may request correction of inaccurate or incomplete personal information we maintain about your account.
  • Right to Erasure ("Right to be Forgotten"): You may request deletion of your account personal data where it is no longer necessary for statutory compliance or legal dispute defense.
  • Right to Restriction: You may request restriction of processing under specific statutory conditions.
  • Right to Data Portability: You may request a structured, machine-readable copy of account information you provided to us.
  • Right to Object: You have the right to object to processing based on legitimate interests at any time.

Notice Regarding End Cardholders: If you are a consumer or retail banking customer whose payment card transactions are enriched by XYO on behalf of your bank or card issuer, please note that your issuing bank acts as the Data Controller. Because XYO operates on a stateless zero-retention architecture and does not store or retain identifiable cardholder profiles or transaction records, we cannot identify individual cardholder records. You must exercise your data protection rights directly with your card-issuing bank.

For direct account holders, rights requests should be submitted to hello@syniol.com. We will respond within one (1) calendar month.

SUPERVISORY AUTHORITY

If you believe our processing of your personal data infringes data protection legislation, you have the statutory right to lodge a formal complaint with the competent supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, England
Helpline: +44 (0)303 123 1113
Website: ico.org.uk

CONTACT INFORMATION & CORPORATE DISCLOSURES

Syniol Limited (Trading as XYO Financial)
Apollo House, Hallam Way, Whitehills Business Park, Blackpool, Lancashire, FY4 5FS, England, United Kingdom
Registered in England and Wales: Company No. 09651629
VAT Registration: GB346164695
Data Protection & Compliance Email: hello@syniol.com
Corporate Website: www.syniol.com

This document edited on: September 2026