Privacy Policy

Allync Digital Signage is a business-to-business (B2B) platform intended for use by authorized business administrators aged 18 years or older. This service is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at info@allyncai.com and we will promptly delete it. This policy complies with the Children's Online Privacy Protection Act (COPPA).

• Device Management: Registering, identifying, and monitoring screen devices across your signage network.
• Content Delivery: Ensuring the correct playlists and layouts are displayed on the right screens.
• Health Monitoring: Detecting offline screens, performance issues, and proactively alerting administrators.
• Analytics & Audit: Providing proof-of-play reports showing what content was displayed and when.
• Version Control: Ensuring all devices run supported and up-to-date software versions.
• Remote Commands: Processing admin-initiated commands such as screenshots, cache clearing, kiosk mode, and device reboot.
• Attention Analytics: Anonymous viewer counting to help administrators understand audience engagement (optional, admin-enabled).
• AI Assistance: Generating content text using third-party AI providers when requested by administrators (optional, plan-dependent).

We use the following third-party services to operate our platform. Each service processes only the minimum data necessary for its specific function:

• Supabase (Database & Auth): Stores device data, media files, and handles authentication. SOC 2 Type II compliant. Data hosted in AWS (EU/US regions).
• Vercel (Hosting): Hosts the web application and API. No device data is stored on Vercel — it only proxies requests.
• Open-Meteo (Weather Widget): Provides weather data for the weather widget. Only latitude/longitude coordinates are sent — no device or user identifiers.
• CoinGecko (Crypto Widget): Provides cryptocurrency price data. Only coin identifiers are sent — no device or user data.
• Exchange Rate APIs (Currency Widget): Provides currency exchange rates. Only currency codes are sent — no device or user data.
• Email (SMTP): Account notifications (moderation results, license updates, invitations) are sent via SMTP. Only administrator email addresses are processed. No email data is shared with third-party email marketing platforms.
• Anthropic (AI Provider): Processes content generation prompts when AI assistant is enabled. Only administrator-provided text prompts are sent — no device or viewer data. See anthropic.com/privacy.
• Google Gemini (AI Provider): Alternative AI provider for content generation. Same data handling as Anthropic. See ai.google/privacy.
• Aladhan API (Prayer Times Widget): Provides Islamic prayer time calculations. Only city name and country code are sent — no device identifiers.

We do not sell, rent, or trade your data with any third party. Data shared with the services above is limited to what is strictly necessary for platform functionality.

• All data is transmitted over encrypted HTTPS/TLS connections.
• Data is stored in secure, SOC 2 Type II compliant cloud infrastructure (Supabase/AWS).
• Row Level Security (RLS) ensures tenant data isolation — each organization can only access its own data.
• API endpoints are protected with authentication, rate limiting, and tenant-scoped access controls.
• Media files are stored in private storage buckets with signed URLs for secure access.
• Administrator passwords are hashed and never stored in plain text.
• Windows application stores license tokens encrypted with DPAPI (Windows Data Protection API), bound to the local machine.
• Windows application communicates exclusively over WSS (WebSocket Secure) and HTTPS — no unencrypted connections.
• Attention analytics camera processing runs entirely on-device — no images or video data leaves the device.
• AI API keys are stored server-side in encrypted database fields and never transmitted to client devices.
• Custom widget HTML bundles run in sandboxed WebViews with Content Security Policy (CSP) restrictions.

We retain collected data for as long as your account and devices are active on our platform. When a screen device is removed or a tenant account is closed:

• Device data, health metrics, and error logs are deleted upon screen removal.
• Playback logs are retained for up to 90 days for audit purposes, then automatically purged.
• Screenshots are deleted when the associated screen is removed.
• Media files are deleted when removed by the administrator or when the tenant account is closed.
• Account data (email, name) is retained for 30 days after account closure, then permanently deleted.
• Attention analytics data is retained for 90 days, then automatically purged.
• Content analytics aggregations are retained for the duration of the tenant account.
• Trigger execution logs are retained for 30 days, then automatically purged.

You have the right to request deletion of your data at any time. We provide the following data deletion options:

• Self-Service (Dashboard): Administrators can delete individual screens, media files, playlists, and schedules directly from the dashboard at any time. All self-service deletions are processed immediately — data is permanently removed as soon as the delete action is confirmed. Deleting a screen removes all associated data (commands, logs, screenshots).
• Full Account Deletion: To request complete deletion of your tenant account and all associated data, email info@allyncai.com with the subject line "Data Deletion Request".
• Response Time: We will acknowledge your deletion request within 3 business days and complete the deletion within 30 calendar days.
• What Gets Deleted: All device data, health metrics, playback logs, error logs, screenshots, media files, playlists, schedules, layouts, and account information. Anonymized aggregate statistics may be retained.

Allync Digital Signage is a B2B platform designed for managing commercial display screens. The data collected from screen devices does not include personal information of end viewers. No GPS location, microphone data, or biometric information is collected. When Attention Analytics is enabled, the camera performs on-device face detection solely to count viewers. No facial features, images, or biometric data are stored, transmitted, or used for identification. This anonymous count data cannot be linked to any individual. Administrator accounts are protected with email-based authentication and session management. We collect administrator email addresses solely for authentication and platform notifications.

Your data may be transferred to and processed in countries other than your country of residence. Our infrastructure is hosted on Supabase (AWS) with servers in the EU and US regions. When data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required. All transfers comply with applicable data protection laws, including GDPR requirements for data transfers outside the European Economic Area (EEA).

Depending on your location, you may have the following rights regarding your data:

• Right to Access: Request a copy of the data we hold about you and your devices.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure: Request deletion of your data (see Data Deletion section above).
• Right to Data Portability: Request your data in a machine-readable format (JSON/CSV).
• Right to Object: Object to the processing of your data for specific purposes.
• Right to Restrict Processing: Request temporary restriction of data processing while a dispute is resolved.
• California Residents (CCPA): You have the right to know what data we collect, request deletion, and opt out of data selling (we do not sell any data).

To exercise any of these rights, email info@allyncai.com or call +90 536 247 7824 (Turkey) / +974 5107 9565 (Worldwide). We will respond within 30 calendar days.

We may update this privacy policy from time to time. When we make significant changes, we will notify registered administrators via email and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our platform after changes constitutes acceptance of the updated policy.

If you have questions about this privacy policy, our data practices, or wish to exercise your data rights, please contact us: