Privacy Policy
Effective October 2026 · Updated 17 October 2026 · Wild Synapse Private Limited
This policy explains what we collect, what we do not collect, and what control you have. It covers AURA and every other Wild Synapse product and service.
Contents
1. Who we are
Wild Synapse Private Limited is a private company limited by shares, incorporated in India under the Companies Act, 2013, and based in Bengaluru, Karnataka. We build software and instruments for wildlife research and conservation.
| Corporate Identity Number | U62099KA2025PTC200030 |
| Udyam (MSME) registration | UDYAM-KR-03-0554416 |
| DPIIT Startup India recognition | DIPP207417 |
| Registered office | Bengaluru, Karnataka, India |
For the purposes of India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here. Where the EU General Data Protection Regulation applies, we are the Controller. Our registered particulars can be verified against the Ministry of Corporate Affairs register at mca.gov.in using the Corporate Identity Number above.
2. Our operating principle
We collect the minimum needed to run an account and keep your work safe. Analysis happens on your own machine wherever it technically can, so your recordings do not have to leave your control in order to be useful to you.
We do not sell, rent or trade personal data or recordings. We do not share them with advertisers, data brokers or aggregators. We do not use your recordings to train machine-learning models without your explicit, separate, opt-in consent.
3. What we collect
| Category | What it is | Why |
|---|---|---|
| Account data | Name, email address, institution or organisation, account type, and a securely hashed password | To create and operate your account, verify your email, and provide support |
| Project metadata | Project names, survey settings, annotations, species determinations, and the measurements you generate | To save your work and let you return to it |
| Deployment records | Site names, dates, and location coordinates you enter | To associate recordings with where and when they were made |
| Support correspondence | Tickets, replies, feedback and feature requests you send us | To answer you and improve the product |
| Technical logs | Error reports, IP address, browser and operating system version, timestamps | Security, abuse prevention and diagnosing faults |
We do not ask for, and have no use for, government identifiers, financial account numbers, health data or biometric data.
4. Your recordings
You own your recordings and everything derived from them. Audio you open in AURA is decoded and analysed in your browser, on your own device. Spectrograms, measurements and detections are computed locally.
We store a recording on our servers only when you explicitly upload or sync it. Where you connect a cloud storage account, files move between your device and your own storage; they do not pass through us.
No member of our staff listens to your recordings or reads your project data as a matter of routine. We access a project only when you ask us to, in writing, in the course of a support request, and only for as long as that request requires.
5. Google API disclosure
AURA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
- We request the narrowest scope that works — access is limited to files you explicitly select, and to files AURA itself created in its own workspace folder.
- OAuth access tokens are held in volatile browser memory for the duration of your session. They are not written to our database.
- Google user data is never used to train generalised AI models or commercial classifiers.
- You can revoke access at any time from your Google Account's third-party permissions page, or by disconnecting from within AURA.
The same principles apply to our Microsoft OneDrive and Dropbox integrations.
6. Cookies and local storage
We keep this deliberately small. We do not run advertising trackers, cross-site profiling, or third-party analytics that follow you around the web.
| What | Purpose | Lifetime |
|---|---|---|
| Session token | Strictly necessary. Keeps you signed in. Without it the application cannot work | Expires after 7 days or when you sign out |
| Cookie consent flag | Strictly necessary. Records that you answered the cookie notice, so we stop asking | Until you clear your browser storage |
| Workspace preferences | Functional. Remembers window layout, chosen taxon, units and language | Until you clear your browser storage |
| Draft work | Functional. Holds unsaved annotations locally so a closed tab does not lose your work | Until saved or cleared |
Most of these are browser local storage rather than cookies in the strict sense. They stay on your device and are not transmitted to us for profiling. You can clear them at any time through your browser settings; doing so signs you out and resets your preferences.
If we ever add analytics, we will ask for your consent first and list it in this table before switching it on.
Third-party content embedded on our website
Our home page displays the D-U-N-S® Registered™ seal, which verifies our business identity. The seal is served directly by Dun & Bradstreet from dunsregistered.dnb.com and is loaded inside an isolated frame, so it cannot read this site’s pages or your storage on it.
Because your browser fetches the seal from Dun & Bradstreet, that request necessarily discloses to them your IP address, browser user agent, the fact that you loaded our home page and the time of the request. We set a referrer policy that sends them only our site’s address, never the particular page or anything you typed. Dun & Bradstreet may set their own cookies in that frame. We do not control their processing and we receive no data back from them.
- Why we include it. To let visitors independently verify that Wild Synapse Private Limited is a real, registered business. We rely on our legitimate interest in establishing that trust, and on your consent where consent is required in your jurisdiction.
- What it is not. It is not advertising, not analytics, and not cross-site profiling by us. We do not use it to identify or track you.
- Their policy. Dun & Bradstreet’s own privacy notice governs what they do with that request — see dnb.com privacy policy.
- Avoiding it. The seal appears only on the home page. Blocking third-party frames in your browser, or an extension that does so, prevents the request entirely; nothing else on this site depends on it.
This is currently the only third-party embed on our website. If we add another, we will list it here before it goes live.
7. Sensitive locations and people
Two kinds of sensitive data arise in this field, and we treat both as defaults rather than options.
Species locations
Precise coordinates for threatened species can enable poaching and disturbance. AURA lets you suppress coordinates from exports, figures, tables and filenames. Where coordinates are generalised for publication, we use grid-based rounding in line with GBIF guidance rather than random displacement, because randomisation introduces false locations into the scientific record.
Incidentally recorded people
Acoustic recorders left in the field capture human conversation. That is personal data, and in some settings it carries real risk for the communities recorded. AURA provides a redaction action that clears a recording's metadata, measurements, location and its link to the audio together. We recommend applying it as soon as such a recording is identified, and we are extending this capability in the next version of the platform.
8. Retention and deletion
- Account data is kept while your account is open, and for up to 90 days after you close it, so that an accidental deletion can be reversed.
- Project data is kept until you delete it or close your account.
- Support correspondence is kept for up to 24 months.
- Technical logs are kept for up to 12 months.
Ask us to delete your account and we will do so within 30 days, except where we are required to keep a record by law. Backups age out on their own cycle, within 90 days.
9. Your rights
Wherever you are, you may ask us to:
- confirm what personal data we hold about you, and give you a copy;
- correct anything inaccurate or incomplete;
- delete your personal data;
- export your projects in open formats, so you can take your work elsewhere;
- withdraw consent you previously gave, including for cloud integrations;
- raise a concern or a grievance with us, and have it reviewed.
Write to support@wildsynapse.com. We will respond within 30 days and we do not charge for this. Section 12 sets out how we handle concerns and what to include so we can act on them quickly.
10. Security
Passwords are stored as salted bcrypt hashes and are never recoverable in readable form, by us or anyone else. Sessions use random tokens with enforced expiry. Personal fields such as names and institutional details are encrypted at rest. Access to production systems is limited to those who need it.
No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the relevant authority without undue delay, and tell you plainly what happened and what to do.
11. Changes
If we make a material change we will update the date at the top of this page and notify account holders by email before it takes effect. We will not reduce your rights retroactively.
12. Contact and raising a concern
For privacy questions, data requests, or to raise a grievance under the Digital Personal Data Protection Act:
support@wildsynapse.com
General enquiries: contact@wildsynapse.com
Wild Synapse Private Limited, Bengaluru, Karnataka, India. CIN U62099KA2025PTC200030.
Please tell us first
If anything about how we handle your data concerns you, the fastest way to get it put right is to tell us. We are a small team and we read everything that arrives.
To help us act on it, please include:
- what happened, and roughly when;
- the email address on the account, and the project or recording involved if relevant;
- what outcome you are looking for.
We will acknowledge within 2 working days and give you a substantive answer within 30 days. If our first answer does not settle it, reply and ask for it to be escalated: someone else will review the matter, and we will tell you what we found and what we are changing as a result.
Under India's Digital Personal Data Protection Act, 2023, a Data Principal is required to exhaust this grievance mechanism before approaching the Data Protection Board. Raising it with us is therefore the correct first step, not an optional one.
We would far rather hear about a problem directly and fix it. Most concerns turn out to be something we can correct quickly once we know the specifics, and a message to us costs you nothing.
If, after that process, you remain unsatisfied, the law preserves your right to complain to a regulator — the Data Protection Board of India, or your national supervisory authority if you are in the EU or UK. We are required to tell you that this right exists, and we would ask only that you give us the chance to resolve it first.