1. Welcome
1.1 Syrena Ltd (“Syrena”, “we”, “us”, “our”) operates a platform available at www.syrena.ai, Ren (our AI worker), and invitation-only communities (including WhatsApp), plus physical and online events (together, the “Syrena Services”). Members join the Syrena network and give Ren Objectives, professional outcomes such as winning customers, finding partners, finding advisors or meeting investors, which Ren pursues by understanding those Objectives, searching, qualifying opportunities, requesting information, coordinating introductions, and maintaining relationship history on the Member’s behalf. A Member may pursue more than one Objective, and may be on either side of an introduction, depending on the Objective in question. Qualification and other calls with our team may be recorded and transcribed, see paragraph 4.12.
1.2 This policy explains what personal data we collect, how we use it, who we share it with, and your rights. Please read paragraph 1.5 first: it summarises the parts of what we do that Members most often do not expect.
1.3 Questions? Contact support@syrena.ai (see section 3).
1.4 This policy should be read with our Terms of Service at syrena.ai/terms-and-conditions.
1.5 Ren. Ren draws inferences about your needs and may suggest relevant objectives or individuals to support you. Ren reads and keeps a record of what you tell it, including the content of your conversations with it, where you opt in, the notes and transcripts of calls you have with our team, and, where you choose to connect them, content and metadata from your email, calendar, and messaging accounts. From that material Ren builds and continually updates your profile. Ren also has access to any tools you grant it access to with your opt-in and may use them to improve the quality of its suggestions. For example, if you mention that you are about to raise a round, Ren may record that you are likely to need advice on that and may later prompt you to ask whether you would like a relevant introduction. Sections 4, 5, and 7 set this out in full. You can turn this sharing off, object to the profiling, or ask us to delete your account.
2. Who is responsible for your personal data
2.1 Syrena Ltd is the controller of personal data processed through the Syrena Services, including data processed by Ren.
2.2 When we introduce you to another Member and you choose to engage, that Member becomes an independent controller of any data you share with them. Their use of your data is governed by their own privacy notices.
2.3 We are registered with the Information Commissioner’s Office under registration number ZC213089. We have not appointed a Data Protection Officer. You can raise any data protection question with us at support@syrena.ai
2.4 We do not currently offer the Syrena Services to, or monitor the behaviour of, individuals located in the European Union, and we have not appointed a representative under Article 27 EU GDPR. We keep this under review and will appoint a representative established in the European Union, and update this policy, before we begin to do so. Where the EU GDPR nonetheless applies to any of our processing, you may complain to the supervisory authority in the EU country where you live or work.
3. How to contact us
Email: support@syrena.ai
Post: Syrena Ltd, Suite 6 Beaufort Court, Admirals Way, Canary Wharf, London E14 9XL, United Kingdom
4. What we collect and how we use it
Where we rely on legitimate interests below, those interests are operating, securing and improving the Syrena Services and Ren; making introductions between Members and improving their quality; understanding how Members use the Syrena Services; preventing fraud, abuse and misuse; and establishing, exercising or defending legal claims. We have carried out a balancing assessment in each case.
You are not obliged to give us the personal data described below. If you do not provide the data identified as necessary at the point we ask for it, we may be unable to provide the Syrena Services.
We do not set out to collect special category personal data (such as data revealing health, religious or philosophical beliefs, racial or ethnic origin, political opinions, trade union membership, sex life, or sexual orientation), and we ask you not to give it to us. Because you can say anything to Ren and because we record calls, special category data may reach us incidentally, in a message to Ren or in a call transcript. We do not seek to infer or use special category data for matching, profiling or any other purpose. Where it reaches us incidentally we limit our processing of it, and we do not process it for any additional purpose unless an appropriate Article 9 condition applies, including your explicit consent where that is the condition we rely on. We retain it only as part of the underlying record for as long as that record is kept under section 9, and you can ask us to delete it at any time by contacting support@syrena.ai
4.1 When you contact us
| Data | Use | Legal basis |
|---|---|---|
| name, email, role, LinkedIn, company, message content | respond, support, improve service | Legitimate interests |
4.2 When you register for events
| Data | Use | Legal basis |
|---|---|---|
| name, email, job title, LinkedIn, founder/investor type, stage, location | manage registration and capacity | Contract |
| attendance / check-in, survey / feedback | personalise experience; report anonymised insights to partners | Legitimate interests |
| photos / video where recorded | publish event media | Consent where required for specific uses |
4.3 When you join our WhatsApp/community groups
If you join a WhatsApp or similar community group, your telephone number and name are visible to every other member of that group. We cannot prevent this, and the operator of the messaging platform is a separate controller of the data you share on it. Please do not post anything in a group that you are not content for other members to see and keep.
| Data | Use | Legal basis |
|---|---|---|
| name, phone number, LinkedIn, role, startup/fund | assign relevant groups | Contract |
| messages/polls you post | moderate and improve community quality | Legitimate interests |
| weekly check-ins | accountability check-ins | Legitimate interests |
4.4 When you use the Syrena platform (accounts & activity)
| Data | Use | Legal basis |
|---|---|---|
| account details, profile data, preferences, activity logs (page views, clicks, ratings, votes, intros sent/accepted, outcomes), device/IP, cookie IDs (see section 6) | run the platform, prevent abuse, measure and improve performance, personalise content | Contract; Legitimate interests; Consent for non-essential cookies/analytics |
4.5 When you interact with Ren
| Data | Use | Legal basis |
|---|---|---|
| messages, prompts, feedback, preferences, and instructions you give Ren; Ren’s responses and generated outputs | generate and personalise introductions on your behalf; improve how Ren matches for you; operate, secure and improve the Syrena Services. We do not use the content of your conversations with Ren to train our own models. Where a model provider processes that content, its use of it, including any use to improve or train its models, is described in paragraph 7.2, and you can object to that use there. | Contract (providing Ren to you); Legitimate interests (improving the quality and safety of Ren for all Members). You may object at any time to our use of your conversations with Ren for the improvement purposes described (see section 10). If you do, we will stop unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms. Objecting does not affect our use of your conversations to provide Ren to you under our contract with you. |
4.6 Data about your Objectives (Member Brief)
Your Member Brief is not limited to what you tell us directly. Ren also infers information about you and your Objectives from the way you use the Syrena Services, from what you ask it, from what you say on recorded calls, from what you engage with, and from the outcomes of introductions you have already had. We treat those inferences as your personal data.
| Data collected during and after calls, forms, and Ren conversations | Use | Legal basis |
|---|---|---|
| Professional objectives, which may include fundraising, commercial partnerships, strategic support and meeting clients. | Identify and suggest relationship work to be performed by Ren relevant to your Objectives. | Contract (to deliver the Syrena Services); Legitimate interests (improving matchmaking and prioritisation); Consent where we share identifiable information with other Members for commercial introductions (see section 7.1) unless you directly requested that introduction |
4.7 Data about what you offer
| Data | Use | Legal basis |
|---|---|---|
| profile and capability data relevant to what you’re offering, for example, investor type; service-provider or growth-partner firm details, practice areas, fees, and coverage. | Matching to other Members’ Objectives, | Contract; Legitimate interests; Consent where you’ve opted in to share candidacy data for hiring-related introductions |
4.8 Payments & subscriptions
| Data | Use | Legal basis |
|---|---|---|
| name, email, plan, billing details (processed by our payment processor), invoices, refunds | take payments, manage billing, prevent fraud | Contract; compliance with legal obligations (tax/accounting) |
4.9 Marketing communications
| Data | Use | Legal basis |
|---|---|---|
| name, email, role, preferences, engagement metrics | send updates about events, platform features, Ren, communities and offers similar to what you already use; or broader newsletters where you opt in; and, separately, to identify you as a Member of the network in our own marketing materials, including our website, case studies and testimonials | Consent (non-customers); Legitimate interests/soft opt-in (existing customers). Opt out anytime. For our own marketing materials: legitimate interests (your name and logo, which you may object to at any time); consent (your User Content, and any case study or testimonial identifying you), see clause 7.3 of our Terms of Service |
4.10 Website/analytics & cookies
| Data | Use | Legal basis |
|---|---|---|
| IP, device/browser, pages, referrers, session duration, cookie IDs and similar | operate the site, security, analytics, product improvement, advertising (if used) | Contract (essential cookies); Consent (non-essential/analytics/advertising). See section 6 |
4.11 Sourcing from third parties
We may receive personal data from event partners, referrers, public sources (e.g., LinkedIn), sponsors, and processors (e.g., email, CRM, analytics). The categories we obtain this way include, but are not limited to name, job title, employer, professional profile, and business contact details.
| Data | Use | Legal basis |
|---|---|---|
| Name, job title, employer, professional profile, and business contact details | Operate the site, provide the Syrena Services | Legitimate interests; Contract (where applicable). |
4.12 Calls and meetings
Qualification calls and other calls with our team may be recorded and transcribed. The recording or transcript may be summarised by Ren and stored against your profile, and the resulting notes are used as described in paragraphs 4.6 and 4.7. We will tell you at the start of any call if it is being recorded, and you may ask us not to record the call, or to stop recording it, at any time. Ren will give you the same notice at the start of any call it joins. You can ask us to delete your personal data or close your account at any time, as described in section 10. Where anyone other than you is on the call, you are responsible for making them aware that it is being recorded.
| Data | Use | Legal basis |
|---|---|---|
| Any personal data contained in a call transcript | Operate the site, provide the Syrena Services | Legitimate interests (keeping accurate records and improving the quality of introductions) for the notes and outcomes we derive from it |
4.13 Connected accounts, communications and third party data
If you choose to connect, integrate or otherwise authorise Syrena to access a third party account, application or service, including email, calendar, communications or messaging services, we may collect, access, receive, store and otherwise process personal data and other information made available through that service in accordance with the permissions and authorisations granted by you.
This information may include communications and correspondence, contact information, calendar and meeting information, invitations, relationship and interaction history, account information, metadata and other information associated with your use of the relevant third party service. We may use this information to provide, operate, personalise, develop and improve the Syrena Services and Ren, understand and support your Objectives, identify and evaluate relevant people, organisations, relationships and opportunities, maintain relationship context and history, facilitate introductions and communications, and otherwise perform relationship work on your behalf.
Where you authorise Ren to act on your behalf, we may use information available through your connected accounts to identify relevant relationships and routes to third parties and to facilitate, prepare, coordinate or send communications through you, your connected accounts, or other persons or channels within the Syrena network, in each case subject to the permissions you have granted and applicable law. This may include enabling you or other authorised Members to facilitate introductions or act as intermediaries or matchmakers between relevant parties.
Information obtained through connected accounts may include personal data relating to third parties with whom you communicate, meet, interact or otherwise have a relationship. We may process such information where reasonably necessary for the purposes described in this Privacy Policy, including to understand relationship context, identify and assess potential matches and opportunities, facilitate relevant communications and introductions, improve the relevance and effectiveness of the Syrena Services, and support the Objectives of Members.
The presence of a third party’s information within a connected account does not, by itself, make that person a Syrena Member or create a Member account on their behalf. Where we use personal data relating to third parties for other purposes, including direct marketing by or on behalf of Syrena, we will do so only where we have an appropriate lawful basis and otherwise in accordance with applicable data protection and electronic communications laws.
Connecting a third party account is optional and subject to the permissions and authorisations presented to you at the time of connection. You may revoke Syrena’s access to a connected account at any time through the Syrena Services or, where applicable, through the relevant third party service. Revoking access will prevent further collection of information from that account but will not necessarily result in the deletion of information previously collected or otherwise processed by us. Our retention and deletion practices and your applicable data protection rights are described elsewhere in this Privacy Policy, including section 10.
By connecting or authorising access to a third party account, you acknowledge that information made available to Syrena may include information relating to other individuals and organisations. You are responsible for ensuring that your connection and use of the relevant account with the Syrena Services is permitted and does not breach any applicable law, contractual restriction, duty of confidentiality, employer or organisational policy, or other obligation applicable to you.
Where we hold personal data about a person who is not a Member and we are required to provide them with privacy information, we do so within the period the law allows unless an exception applies. Those individuals have the same rights over their personal data as anyone else, as set out in section 10.
| Data | Use | Legal basis |
|---|---|---|
| Message and meeting content and metadata from accounts you connect, including sender and recipient details, subject lines, timing, and the personal data of third parties contained in them | Understand your Objectives, identify and prioritise opportunities, maintain relationship history, and prepare and deliver Relationship Work for you | Contract, for the processing necessary to deliver the Relationship Work you have asked Ren to perform. Your authorisation, which you give when you connect the account and can revoke at any time by disconnecting it, governs our access to the account itself. Where we rely on your consent for a specific further use, we will tell you and you can withdraw it at any time. For the personal data of third parties contained in that content, our legitimate interests and yours in operating the Syrena Services and delivering the Relationship Work you have asked for |
5. Profiling and automated decision making
5.1 We use Ren and other automated systems to analyse information, preferences, activity, relationship context and other relevant signals in order to provide and personalise the Syrena Services. This may include identifying and prioritising opportunities, recommending matches and introductions, determining when Members are notified, and assessing Standing within the network. Standing is defined in clause 4.5 of our Terms of Service and governed by the Network Standing Rules.
5.2 These systems may make or support decisions using automated means, including decisions that affect the opportunities, introductions or features made available to you. Where a decision is made solely by automated means and produces legal or similarly significant effects, we will only do so where permitted by applicable data protection law, including where necessary for entering into or performing our contract with you. We do not use special category personal data to make such decisions.
5.3 A decision about matching or Standing can affect which introductions you are offered, how often, and which features of the Syrena Services are available to you. Where a decision is made solely by automated means and has a legal or similarly significant effect on you, you may request human intervention, express your point of view and contest the decision by contacting support@syrena.ai. You can also object to profiling at any time (see section 10).
8. International data transfers
We host and process personal data primarily in the United Kingdom. Some of our processors and partners are located outside the United Kingdom, or process personal data from outside it, so some of your personal data is transferred outside the United Kingdom. The countries involved depend on the providers we use at the time, and our current providers and the regions they operate in are listed at syrena.ai/subprocessors.
Where a country is not the subject of UK adequacy regulations, we make restricted transfers under appropriate safeguards. Depending on the recipient, those safeguards are the UK International Data Transfer Agreement, the International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it. Before we begin a restricted transfer in reliance on the IDTA or the Addendum we carry out and record a transfer risk assessment, and we keep those assessments under review. You can ask us for a copy of the safeguards that apply to a particular transfer by emailing support@syrena.ai.
9. How long we keep your information (retention)
| Category | Typical retention |
|---|---|
| Accounts & platform activity data | 24 months from closure of your account, then deleted or anonymised. |
| Ren conversations & outcome data | 24 months from closure of your account, then deleted or anonymised |
| Marketing data | Until you opt out, or 24 months after your last engagement with us, whichever is earlier. We keep a minimal suppression record indefinitely so that we can continue to honour your opt-out |
| Legal & compliance data | 6 years from the end of the relevant relationship or transaction (7 years for accounting and tax records), or longer where the law requires it or where the data is needed for a live or anticipated claim |
| Event registration and attendance data | 24 months from the event, then deleted or anonymised |
| Community group data (including WhatsApp) | While you remain in the group and for 12 months afterwards |
| Payment and billing records | 7 years from the end of the accounting period to which they relate |
| Call recordings and transcripts | 24 months from closure of your account, then deleted or anonymised |
| Connected account data (email, calendar, messaging) | Deleted within 30 days of you disconnecting the account or closing your account, whichever is earlier, except for relationship history and outcomes derived from it, which are kept with your other platform data |
| Inferences and Member Brief data | Kept for as long as your account is open and for 24 months from closure, then deleted or anonymised. Deleted sooner if you ask us to delete your Member Brief |
10. Your rights
Under the UK GDPR, and the EU GDPR where it applies to our processing, you have the following rights:
- Right of Access (Article 15): You can request information about what personal data we process and obtain a copy of your personal data.
- Right of Rectification (Article 16): You can request correction of inaccurate personal data.
- Right of Erasure (Article 17): You can request deletion of your personal data in certain circumstances.
- Right to Restrict Processing (Article 18): You can request that we limit how we use your personal data in certain situations.
- Right to Data Portability (Article 20): You can request your personal data in a structured, machine-readable format.
- Right to Object (Article 21): You can object to processing based on legitimate interests or for direct marketing purposes.
- Rights Related to Automated Decision-Making (Article 22): You have rights regarding automated decision-making, including AI-powered matching.
- Right to Withdraw Consent (Article 7(3)): Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew it.
Contact support@syrena.ai to exercise your rights. We may ask you to verify your identity. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, and we will tell you if we need to do so. There is no charge unless a request is manifestly unfounded or excessive. You also have the right to complain to the ICO: https://ico.org.uk/make-a-complaint/.
Closing your account and deleting your Member Brief: You can ask us at any time, by emailing support@syrena.ai, to close your account and delete your Member Brief and the data associated with it, including your conversations with Ren, your call recordings and transcripts, and anything collected from an account you connected. We will do so within 30 days and confirm when it is done. We may keep a minimal record that you have asked us to delete your data, and any data we are required to keep by law or need in order to establish, exercise, or defend a legal claim, as described in section 9. Where information you gave us has already been shared with another Member, we cannot recall it from them, and that Member is an independent controller of it as explained in paragraph 2.2.
11. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, least-privilege, logging, staff training, and vendor due-diligence. If a personal data breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will notify you without undue delay where the risk to you is high.
12. Children’s privacy
The Syrena Services are for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe we hold data about a child, contact support@syrena.ai and we will delete it.
13. Changes to this policy
We will update this policy when our services or the law change. The current version is always at syrena.ai/privacy-policy, showing the date it took effect, and we keep previous versions available on request. Where a change is material we will notify you by email or in-app at least 30 days before it takes effect.
14. Additional information for residents of the United States
14.1 Who this section is for: This section applies in addition to the rest of this policy if you are a resident of California or of another US state with a comprehensive consumer privacy law, including Colorado, Connecticut, Texas, and Virginia. Where this section conflicts with the rest of the policy, this section applies to you. Terms such as “personal information”, “sensitive personal information”, “sell”, and “share” have the meanings given to them in the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”).
14.2 What we collect about you: In the last 12 months we have collected the following categories of personal information: identifiers (such as your name, email address, postal address, telephone number, IP address, and account identifiers); commercial information (such as the plans and credits you have bought and your billing records); internet or other electronic network activity (such as your activity on the Syrena Services, the pages you view, and cookie identifiers); approximate geolocation derived from your IP address; audio information (recordings and transcripts of calls with our team); professional or employment-related information (such as your role, employer, sector, and what you are looking for); and inferences drawn from the above to create a profile of your preferences and needs. We do not collect biometric information, education records, or precise geolocation.
14.3 Sensitive personal information: If you connect an email, calendar, or messaging account under paragraph 4.13, we collect the contents of your messages, which is sensitive personal information under the CCPA. We use and disclose it only to perform the Syrena Services you have asked for, to maintain their quality and security, and for the other purposes permitted by section 7027(m) of the CCPA regulations. Providing those services involves deriving professional and relationship context from that content, including your Objectives and who may be relevant to them, and Ren may draw inferences of that kind. We do not use or disclose sensitive personal information for any purpose outside those permitted by section 7027(m), and we do not sell or share it or use it for cross-context behavioural advertising. We therefore do not offer a separate “limit the use of my sensitive personal information” option, but you can disconnect the account at any time and ask us to delete what we collected from it.
14.4 Where we get it and why: We collect personal information from you directly, from your use of the Syrena Services, from accounts you connect, from event partners and referrers, and from public sources such as LinkedIn. We use it for the business purposes described in section 4: providing and securing the Syrena Services, making introductions, billing, marketing to you, complying with the law, and defending legal claims. We disclose it for those business purposes to the categories of recipients listed in section 7. We retain each category for the periods set out in section 9, or for as long as reasonably necessary for the purpose it was collected for where no period is stated.
14.5 We do not sell or share your personal information: We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the CCPA. We have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16 years of age; the Syrena Services are not available to anyone under 18.
14.6 Your rights: Subject to the exceptions in the applicable law, you have the right to know what personal information we have collected about you and how we have used and disclosed it; to obtain a copy of it in a portable form; to have it corrected if it is inaccurate; to have it deleted; to opt out of any sale or sharing of it, and of profiling in furtherance of decisions that produce legal or similarly significant effects; and not to be discriminated against for exercising any of these rights. We will not deny you the Syrena Services, charge you a different price, or give you a lower quality of service because you have exercised a right. If you are a resident of a state whose law provides for it, you may also appeal a decision we make on a request by replying to our response, and if we deny your appeal you may complain to your state Attorney General.
14.7 How to exercise them: Email support@syrena.ai, or write to us at the address in section 3. We will acknowledge a request within 10 business days and respond within 45 days, which we may extend once by a further 45 days where the request is complex, telling you if we need to do so. We will ask you to verify your identity by confirming information we already hold about you, and we will not use that information for any other purpose. An authorised agent may make a request on your behalf if they give us written permission signed by you, and we may ask you to confirm directly that you gave it.
14.8 California “Shine the Light”: California residents may ask us once a year for a list of the third parties to whom we have disclosed personal information for their own direct marketing purposes in the preceding calendar year. We do not make disclosures of that kind, but you may make the request at support@syrena.ai.