Skip to content

Synology Services Data Collection Disclosure

The diff shows the entire Synology Services Data Collection Disclosure as newly added — there is no previous text to compare against, so this looks like a first capture (baseline) or a full re-publication rather than an edit to specific clauses. Because of that, nothing below can be confirmed as a newly lost right; the notes describe what this document says about how Synology handles your data. The main points for consumers: chat conversations with Synology AI Advisor are sent to OpenAI and Microsoft Azure and may be used to improve Synology's models; purchase and shipping records can be kept indefinitely; deleting your Synology Account forfeits all purchased licenses; and several services pass data to outside companies (Bitdefender for mail scanning, Stripe/Cherri Tech for payments, UPS for shipping, Baidu in mainland China, Let's Encrypt for certificates).

Your AI chat text is sent to OpenAI and Microsoft and used to train modelsAnything you type into the AI Advisor is stored word-for-word and passed to two outside…

Anything you type into the AI Advisor is stored word-for-word and passed to two outside companies, and Synology may use it to improve its AI models. Synology says it is not linked to your account, but it also tells you not to type personal details — which means the content itself isn't filtered.

“Conversations are stored exactly as entered. We strongly recommend that users do not share any personal information during their interaction with the AI Advisor.”

What you can do — Don't put names, serial numbers, or account details into the AI Advisor chat. To erase a past chat, note its session ID and ask Synology to delete the data for that session.

DATA SHARING
Billing and shipping records can be kept foreverPurchase history sticks around at least four years, and indefinitely if your order…

Purchase history sticks around at least four years, and indefinitely if your order included a perpetual license, a renewal, a physical product, or extended support. Shipping records have no end date at all. Deleting your account does not clear these.

“Synology will keep all shipping records for internal auditing and inventory control purposes indefinitely.”
DATA RETENTION
Deleting your account wipes out the licenses you paid forThe only way the policy offers to remove your personal data is deleting your Synology…

The only way the policy offers to remove your personal data is deleting your Synology Account — and doing that forfeits every license you bought, with no refund mentioned. So exercising your privacy rights costs you your purchases.

“By deleting your Synology Account, you will be forfeiting all purchased licenses.”

What you can do — Before deleting your Synology Account, ask support whether your licenses can be transferred, and save copies of your receipts from the account payment page.

TERMINATION
Email sender, recipient, subject, and attachment data goes to BitdefenderIf your mail server uses Bitdefender for spam and virus scanning, details about who emails…

If your mail server uses Bitdefender for spam and virus scanning, details about who emails you and what the messages are about leave Synology and go to Bitdefender's cloud, under Bitdefender's own privacy policy rather than Synology's.

“The information collected from your devices will be uploaded to Bitdefender's cloud center for spam detection.”

What you can do — If you'd rather not share this, turn off or switch the antispam/antivirus engine in MailPlus Server.

DATA SHARING
Photo GPS coordinates sent to Synology if you turn on location searchTurning on Photo Location Search in Deep Search sends the exact latitude and longitude…

Turning on Photo Location Search in Deep Search sends the exact latitude and longitude stored in your photos to Synology. Photos themselves stay on your computer, and Synology says it doesn't keep the coordinates. The feature is off unless you switch it on.

“If you enable this feature, Synology receives the GPS coordinates (latitude and longitude) embedded in photos to retrieve corresponding place names for location-based search.”

What you can do — Leave Photo Location Search off, or turn it off in Deep Search settings, if you don't want photo locations leaving your computer.

DATA COLLECTION
Device MAC address collected by Baidu for users in mainland ChinaIn mainland China, Synology Photos and Moments use Baidu's mapping tool, and Baidu…

In mainland China, Synology Photos and Moments use Baidu's mapping tool, and Baidu collects your device's MAC address — a permanent hardware identifier — to make maps work. A third party also handles phone verification codes for new accounts there.

“Your device's MAC address will be collected by Baidu, Inc. to perform the mapping functionality.”
DATA SHARING
Support agents may log directly into your deviceFor some support tickets you can be asked to hand over login credentials, and both support…

For some support tickets you can be asked to hand over login credentials, and both support agents and engineers may use them to access your device directly. The credentials are kept until the ticket closes, and any log files you upload for up to 90 days after that.

“Synology technical support agents together in some cases with Synology software engineers may utilize the credentials provided to directly access your device.”

What you can do — If you give remote access for a support ticket, create a temporary account for it and change or delete the credentials once the ticket is resolved.

OTHER
Event registration details may be passed to sponsorsSign up for a Synology webinar or workshop and the host may give your details to event…

Sign up for a Synology webinar or workshop and the host may give your details to event sponsors, though only with your consent. Records are kept for at least four years, and longer for business-partner activities.

“With your consent, event hosts may share event attendees' information to their sponsors.”

What you can do — When registering for a Synology event, decline any consent box about sharing your details with sponsors if you don't want marketing follow-ups.

DATA SHARING
20260811_rev01COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED
1This Services Data Collection Disclosure applies to Synology-provided services offered on Synology websites, Synology-branded applications, services provided from physical Synology products ("**Synology Devices**"), and digital or physical services directly offered by Synology unless stated otherwise. A list below details the data collection of Services provided.
+ ADDEDWhole document appears as new — no earlier version to compare

The diff adds all 498 lines of the disclosure with nothing removed, which means the previous snapshot was empty. Treat this as a baseline record of Synology's data practices, not proof that any of these terms were just introduced.

2
3- [Synology Account](https://www.synology.com/)
4- [Package Center](https://www.synology.com/)
5- [Package Activation](https://www.synology.com/)
6- [Payment](https://www.synology.com/)
7- [ActiveProtect Manager](https://www.synology.com/)
8- [DSM Enterprise](https://www.synology.com/)
9- [Device Analytics](https://www.synology.com/)
10- [Device Network Mapping](https://www.synology.com/)
11- [Marketing Events and Promotional Events](https://www.synology.com/)
12- [QuickConnect and Synology DDNS](https://www.synology.com/)
13- [Technical Support](https://www.synology.com/)
14- [Synology Application Service](https://www.synology.com/)
15- [Push Notifications](https://www.synology.com/)
16- [Mobile Applications](https://www.synology.com/)
17- [Alexa Services](https://www.synology.com/)
18- [DSM Configuration Backup](https://www.synology.com/)
19- [Active Insight](https://www.synology.com/)
20- [MailPlus](https://www.synology.com/)
21- [Synology Store](https://www.synology.com/)
22- [C2](https://www.synology.com/)
23- [Synology AI Advisor](https://www.synology.com/)
24- [Synology Deep Search](https://www.synology.com/)
25
26## Synology Account
27
28A Synology Account is the personal account you use to access Synology services, such as QuickConnect, Synology DDNS, Technical Support, Package Activation, Active Insight, and DiskStation Manager ("**DSM**") configuration. You will need to associate your Synology Account with your Synology device to enable those Synology services. Data collected by corresponding Synology services can also be found on this Service Data Processing Policy. Please read the relevant sections for more information.
29
30By creating a Synology Account, you will automatically receive our eNews from time to time. You may choose to opt-out from our eNews Service by changing the settings on your Synology Account newsletter page or by clicking on the "unsubscribe" link in the corresponding newsletters. However, if you are an EU resident other than a business user, you will only receive our eNews when your consent is validly provided and you may withdraw your consent at any time by using the methods described above.
31
32When you create a Synology Account, we may collect a variety of information, including your name, mailing address, phone number, email address, device identifiers, IP address, and location information to help facilitate communications and provide services to you. If you purchase our package license, we will collect your payment information, and you can find your purchase history on your Synology Account payment page. For more information, please read our payment section.
33
34Please note that if you reside in the Chinese Mainland, your phone number will be used to verify your identity. We will use a third-party to send you a verification code when you create your Synology Account.
35
36Synology Account websites may use "cookies" to help us better understand user behavior and to improve user experiences when you revisit our websites. For more information, please read our [Cookie Policy](https://www.synology.com/company/legal/cookie_policy).
37
38Synology does not use your information for any other purpose.
39
40Synology does not share your information unless otherwise specified for the particular service.
41
42You may delete your Synology Account at any time. However, we may be unable to provide you certain services afterward. Account deletions, including all the associated data with the specified account, are irreversible. Synology may retain payment data for financial purposes, including but not limited to tax reporting, auditing, and inventory purposes.
43
44## Package Center
45
46Synology collects package download information from your Synology Device in order to help us understand how we can better improve our devices and software. When a Synology Device issues a download request to Package Center, Synology's database will record the action with a unique ID. This ID is used only to identify download activity in Package Center. None of this information contains any of your personal information or metadata pertaining to your files. Package Center does not track or record your device's serial number, MAC address, or IP addresses for uses that do not require additional licenses.
47
48### Licensing
49
50Purchasing package licenses, whether a single, subscription-based, or in-app purchase, requires a Synology Account\*. We will collect certain information from your Synology Device for licensing purposes, including product serial number, IP address, MAC address, and registered Synology Account. We store this information to verify your license when it is applied to a Synology Device.
51
52Activating and updating packages will usually require an Internet connection to our servers. We identify your Synology Device with a unique device ID.
53
54For record-keeping and future troubleshooting, we may keep track of information such as whether the update was successful or not. We may use the information collected through activation or updates to validate your license status.
55
56Synology only shares aggregated statistics that do not contain personal information to our partners, licensors, and licensees.
57
58#### Applicable to:
59
60##### Synology-published
61
62- exFAT Access
63- McAfee Antivirus
64- MailPlus Server
65- Presto File Server
66- Virtual DSM
67- Virtual Machine Manager Pro
68- VPN Plus
69
70**Note:** Surveillance Station licensing does not require a Synology Account
71
72##### Third-party
73
74- sMedio DTCP Move
75- DiXiM Media Server
76
77### Third-Party Packages
78
79Synology Package Center is a platform that enables other developers to publish their applications for use on Synology Devices. Packages distributed or published by third-party developers may collect additional information regarding you or your device. Synology requires third-party developers to be transparent about all practices. However, Synology does not control or have the capability to completely verify claims, nor is Synology responsible for any practices performed by third-party packages. When you install third-party packages, you should read and understand the end-user license agreements (EULA), privacy statements/policies/notices, and terms of use/service that may be presented to you.
80
81Users should contact the third party directly for any questions or problems you have in using third-party packages.
82
83Certain third-party packages may utilize Synology's Package Center for payment services. Synology will collect the same information as listed in the "Payment" section. Synology does not disclose your personal information to third parties and only presents the information as an aggregated figure.
84
85Third-party packages may include their own subscription or payment services that are not controlled by Synology.
86
87Synology only shares aggregated statistics that do not contain personal information to third-party developers.
88
89## Package Activation
90
91### Data we collect
92
93To activate certain Synology-published packages, your Synology Account is required to complete the activation. Synology collects device-specific information and information from your Synology Account such as hardware model name, user's type (business or home), data storage location, and company name.
94
95#### Applicable to:
96
97##### Synology-published
98
99- Active Backup Series
100 - Active Backup for Business
101 - Active Backup for Google Workspace
102 - Active Backup for Microsoft 365
103
104### How we use your data
105
106Synology encrypts the raw data received and then analyzes it to produce human-readable results, to help us provide better service/software for you in the future. The raw data is never shared with any third parties. Package activation does not track your device's serial number, MAC, or IP addresses.
107
108### How we store your data
109
110Synology employs industry-standard encryption practices to safely protect your raw data. Even in the event of a breach, the data collected cannot be used to identify you. Synology restricts access to both the raw and aggregated data by specific employee roles. Data collected is deleted when the relevant Synology Account is deleted.
111
112## Payment
113
114### Data we collect
115
116To make a purchase, Synology will collect the information you provide, including your name, billing address, phone number, IP address, client user-agent, VAT, and payment method to process the transaction. Synology does not directly handle your payment methods, such as your credit card number and CVC.
117
118### How we use your data
119
120Synology uses the third-party processors, _Cherri Tech, Inc._ (hereinafter "**Cherri Tech**") and _Stripe, Inc._ (hereinafter "**Stripe**"), to securely handle your payment method and to calculate and report taxes. If you pay in New Taiwan Dollars (TWD), Cherri Tech will be the payment processor of your billing information. If you pay in any other currency than TWD, Stripe will be the payment processor. Cherri Tech and Stripe will use and process your complete payment information in accordance with [Cherri Tech's privacy policy](https://www.tappaysdk.com/taiwan-zhtw/privacy) and [Stripe's privacy policy](https://stripe.com/privacy) respectively.
121
122If you sign up for paid services as in-app purchases via Apple's App Store, all the payments will be processed by _Apple_. Please see [Apple's privacy policy](https://www.apple.com/legal/privacy/en-ww/) for the information on how they use and process your payment information.
123
124Synology only uses the information we collect from the payment process to complete transactions, generate receipts, report taxes, and for financial and legal auditing purposes. We do not share or use this information for any other purpose.
125
126### How we store your data
127
128Your purchase history, even if refunded or canceled, will be stored for a minimum of four years per legal requirements imposed on Synology and its subsidiaries. Synology will retain this history, including your billing information, for an indefinite period in the following situations; If the order contains a perpetual license, a license renewal, a physical item, extended support, or is needed for financial or legal purposes. Our payment processors and tax reporting providers may additionally be subjected to other legal obligations.
+ ADDEDPurchase, billing, and shipping records can be kept indefinitely

Purchase history is kept at least four years, and can be kept forever if the order includes a perpetual license, a renewal, a physical item, or extended support. Shipping records are kept indefinitely.

129
130Synology generates a receipt that is made available on your Synology Account for each transaction.
131
132By deleting your Synology Account, you will be forfeiting all purchased licenses. Synology will remove your transaction history after the minimum storage period based on our legal obligations.
+ ADDEDDeleting your account forfeits your purchased licenses

If you delete your Synology Account to remove your personal data, you also lose every license you bought. There is no stated way to keep your licenses while deleting the account.

133
134## ActiveProtect Manager
135
136### Data we collect
137
138Synology collects device information and Synology account-related information to determine eligibility and compliance with the use of ActiveProtect Manager ("**APM**"). The device information collected includes the site UUID, license quota, and serial number, etc. The Synology account-related information collected includes your account ID. The legal bases for this collection are:
139
140- Performance of a contract: These data are necessary for providing the APM service.
141- Legitimate interests: Synology has a legitimate interest in verifying the proper use of its products and ensuring compliance with its licensing terms.
142
143### How we use your data
144
145Synology analyzes the collected data to identify potential unauthorized uses of the APM. This includes identifying incompatibilities or non-compliant uses of the APM to ensure the proper functioning and security of the service.
146
147### How we store your data
148
149Synology retains the collected information only as long as necessary to fulfill the purposes outlined above. The collected information is securely stored on Synology-managed devices to protect its confidentiality and integrity.
150
151## DSM Enterprise
152
153### Data we collect
154
155Synology collects device information and Synology account-related information to determine eligibility and compliance with the use of DSM Enterprise. The device information collected includes the chassis serial number, controllers serial numbers and license activation/expiration date. The Synology account-related information collected includes your account ID. The legal bases for this collection are:
156
157- Performance of a contract: These data are necessary for providing the DSM Enterprise service.
158- Legitimate interests: Synology has a legitimate interest in verifying the proper use of its products and ensuring compliance with its licensing terms.
159
160### How we use your data
161
162Synology uses the collected information to verify whether your device is covered by PAS Software Maintenance Service, and to provide the related software features, updates.
163
164### How we store your data
165
166Synology retains the collected information only as long as necessary to fulfill the purposes outlined above. The collected information is securely stored on Synology-managed devices to protect its confidentiality and integrity.
167
168## Device Analytics
169
170Device analytics, or usage information sharing, is an opt-in[\*](https://www.synology.com/) option that you may enable in Synology Device's operating system. In DSM, DSM Enterprise, and APM, we develop our own tool to understand the usage trends of DSM, DSM Enterprise, and APM. In Synology Router Manager ("**SRM**"), we use Google Analytics, a web analytics service provided by Google, Inc. ("**Google**"), to understand the usage trends of SRM. You can opt-out any time by disabling the device analytic function in the control panel of the operating systems mentioned herein.
+ ADDEDDevice analytics is opt-in and shared only in aggregate

Usage data collection on your NAS or router is off unless you turn it on, and can be turned off in the Control Panel. Raw data is not shared; only anonymous, aggregated statistics may go to selected partners. This data is kept up to three years.

171
172\* _As of May 22, 2018, Synology no longer collects data from DSM 6.1.6 and earlier versions, 6.2 Beta, and Preview versions, or any SRM 1.1.x versions even if the option is enabled._
173
174### Data we collect
175
176Synology collects usage information from your Synology Device in order to help us understand how we can better improve our devices and software. The data we collect does not contain information that can directly identify you, the user. Your Synology Device will send to us, for example, information on the settings of the Internet environment, the operating system, and packages. Additionally, we may collect information on how you interact with certain functionality or user interface elements.
177
178### How we use your data
179
180The raw data will be encrypted and then analyzed to produce human-readable results. The raw data is never shared with any third parties. Synology engineers and product management teams may utilize aggregated information to analyze usage trends to make informed decisions on our future products, applications, and services. In very select cases, Synology may elect to share a very small subset of these aggregated statistics with select partners. The information we share with partners is strictly aggregated results and anonymous.
181
182### How we store your data
183
184Your raw data is protected with industry-standard encryption practices. Even in the event of a breach, the data collected cannot be used to identify you or your device. Synology retains device analytics data for up to three years in order to generate statistics. Synology restricts access to both the raw and aggregated data by specific employee roles.
185
186## Device Network Mapping
187
188### Data we collect
189
190Synology collects server name, IP address, Mac address, serial number, operation system version, model name, and status of devices that do not have operating system installed when you visit "find.synology.com" or "router.synology.com" so that you can identify and install the operation system on those devices. The collected data will be deleted after the system installation is completed. By enabling this service, you can easily find Synology Devices on your network in order to connect to them. Synology will use devices where the Share Network Location service is enabled to scan your local network when you access "find.synology.com" or "router.synology.com" to list devices on your network. You can opt out of this service anytime. If you opt out of this service, you will need to remember the IP addresses of your Synology Devices or have already set up your own domain and/or QuickConnect or Synology DDNS service to get access to your Synology Devices. Synology will delete the collected data after you opt out of this service.
191
192### How we use your data
193
194Synology only stores information to help you easily identify devices on your network when you access "find.synology.com" and "router.synology.com". Synology does not use this information for any other purpose. We do not share this information.
195
196### How we store your data
197
198Unless there is a technical issue with the system or a technical support request, Synology employees do not have access to the database. Data collected by this method are automatically deleted after 90 days of inactivity.
199
200### Data we collect
201
202Synology hosts events such as webinars, workshops, and product launches. You can sign up to join one of these from Synology's website. Registration may require a Synology Account, as well as may require additional survey information depending on the event. Synology collects, and stores information related to you that is available from your registration and from the survey.
203
204Some events may be hosted by a third party. With your consent, event hosts may share event attendees' information to their sponsors. In events where Synology is a co-host or sponsor, we may receive participants' information from event hosts.
+ ADDEDEvent sign-ups may be shared with sponsors

If you register for a Synology webinar or workshop, the host may pass attendee information to sponsors with your consent, and event records are kept at least four years — longer for ongoing business relationships.

205
206Some events may have registration fees, payment methods and personal information processed by Synology will be handled by the Payment section.
207
208### How we use your data
209
210Synology may contact you through email or other communication protocols with information regarding the registered event and/or about service-related issues.
211
212### How we store your data
213
214Your information is securely stored and only available to event organizers. Synology retains event participation information for at least four years due to legal obligations that are imposed on Synology and our subsidiaries. The actual storage period may differ depending on the host(s), venue, location, and type of event.
215
216Personal data collected by Synology is stored in Synology's server room at its headquarters in Taiwan. Synology implements appropriate technical and organizational measures, in accordance with applicable data protection regulations, to protect personal data and to ensure its confidentiality, integrity, and availability. These measures are supported by Synology's information security management framework, including relevant infrastructure, supporting systems, network services, and server room operations. Synology's information security management activities are certified under ISO/IEC 27001:2022.
217
218For certain activities that involve long-term cooperation or ongoing business relationships (such as partner-related or cooperation-based activities), personal data may be retained for as long as necessary to fulfill the purposes of such activities or to maintain the relevant cooperation relationship . Once such purposes have been fulfilled, or the relevant cooperation relationship has ended, the data will be reviewed periodically and deleted within a reasonable period in accordance with Synology's internal data governance procedures, unless retention is required by applicable laws and regulations.
219
220If you would like to remove your information after the event, you may choose to delete your Synology Account. As some information is required for certain events, this may limit our ability to provide services or allow you attendance. You may also elect to unregister from the event if you no longer wish to attend.
221
222For events hosted that do not require a Synology Account, please contact Synology. Synology may request additional information to confirm your identity.
223
224## QuickConnect and Synology DDNS
225
226### Data we collect
227
228QuickConnect and Synology DDNS are free connection services provided by Synology. Users who wish to utilize these services must have a Synology Account. Synology collects certain information from your Synology Device, including product serial number, IP address, and routing ports in order to provide the services to you.
229
230### How we use your data
231
232Synology uses the collected data to identify, authenticate, and provide Synology Devices with QuickConnect and Synology DDNS services. In addition, to secure the connection to your DSM with HTTPS, your QuickConnect and/or Synology DDNS domain will be passed to Let's Encrypt, a third-party certificate authority, to generate an SSL certificate. For details on how Let's Encrypt uses your data, please refer to [Let's Encrypt Privacy Policy](https://letsencrypt.org/privacy).
233
234Synology may be required to share your information to the extent necessary to comply with ICANN or any ccTLD rules, regulations, and policies when you register a domain name with us.
235
236### How we store your data
237
238Unless there is a technical issue with the system or per a technical support request, Synology employees do not have access to the database. Users who signed up for the services may end the service at any time. Data collected is deleted when the relevant Synology Account is deleted.
239
240## Technical Support
241
242### Data we collect
243
244You may request Synology Technical Support assistance through our website, live chat, or by phone. Submitting a Technical Support form requires a Synology Account. Synology collects and stores the information therein that is necessary for investigation of and providing response and resolution to your technical support request.
245
246When you make a phone request to Synology's Technical Support hotline, our technical support agent will ask for your consent on phone recording at the beginning of the conversation. Your personal information, including name, email, telephone number, and detail on your Synology product will be recorded in our systems. You may view, track, respond to your Technical Support ticket via your Synology Account. If you don't have a Synology Account, Synology's technical representative will create a temporary account. You must enable it to track ticket status and to receive follow up information.
247
248You may be requested to upload log files of your devices to Synology. The log files are only for the use of Synology to investigate and resolve your technical support request. If you use Synology Device, the information within the log files may include the system and operating data such as serial numbers, MAC addresses, IP addresses, system configuration, and storage configuration. If you use Synology C2 services, the information within the log files is collected from the client device using C2 services, and may include device information, crash logs, and application error report.
249
250In some cases, you may be requested to provide remote access information. Synology technical support agents together in some cases with Synology software engineers may utilize the credentials provided to directly access your device.
+ ADDEDSupport staff may get remote access to your device

For hard support cases you may be asked for login credentials, and Synology staff and engineers may use them to get into your device directly. Those credentials are kept until the ticket is closed, and uploaded log files for up to 90 days after.

251
252When a device replacement or spare part is requested, you will be required to provide a valid shipping address. In certain cases, you may be asked to provide payment for support services, shipping charges, or spare parts.
253
254### How we use your data
255
256When you submit a Technical Support form in your Synology Account, you are required to provide the essential product information that is needed to investigate, respond to, and resolve your technical support request. During the investigation, Synology may request additional information that is required to resolve the matter. Depending on the complexity and the severity of the request, the support ticket may be escalated to parties within Synology to investigate, respond to, and resolve your request. The information revealed to involved parties is strictly limited. Synology restricts access to both the raw and aggregated data by specific employee roles.
257
258Synology utilizes the information gathered through technical support requests exclusively for issue resolution purposes. Following the removal of personal data, certain technical details may be utilized for generating bug reports, especially for previously unidentified problems, aimed at implementing solutions for our product line. Additionally, Synology may transmit anonymized technical information to Microsoft Azure and leverage its OpenAI services to enhance the overall technical support experience. Synology will ensure that personally identifiable information, such as names, phone numbers, addresses, email addresses, IP addresses and product serial numbers, is excluded from this process.
259
260If shipping is required, your shipping address and contact information may be passed to third-party logistics partners.
261
262### How we store your data
263
264Synology restricts access to both the raw and aggregated data by specific employee roles.
265
266When you upload files for your support ticket, Synology will retain them for up to 90 days after the ticket has been resolved.
267
268When you provide remote access information, Synology will retain it until the ticket has been resolved.
269
270Synology keeps communication and survey records for a minimum of three years for internal auditing and statistical purposes. If you wish to remove your personal information from our systems, you may choose to delete your Synology Account. We may choose to retain technical details of the problem, such as steps to reproduce it, the technical details of the environment, and what steps were taken to resolve it.
271
272Synology will keep all shipping records for internal auditing and inventory control purposes indefinitely.
273
274## Synology Application Service
275
276### Data we collect
277
278Synology Application Service collects the message contents you create in MailPlus, Synology Chat, and other supported applications and transmits them to Synology SNS server and push services of Apple, Google, or Mozilla, in order to notify the recipients about new messages on browsers or mobile apps. Additionally, the browser and device information of client devices will be collected and transmitted to the Synology SNS server and third-party push servers. This is done to pair the message content with the correct device. None of this data contains any of your personal information, and Synology does not track your device's serial number, MAC addresses, or IP addresses.
279
280### How we use your data
281
282All the message contents transmitted to Synology SNS server and third parties are encrypted by Synology Application Service, ensuring your personal data is not accessible to others. The browser and device information of client devices is only used for pairing.
283
284### How we store your data
285
286All the data collected by Synology Application Service will be removed immediately on Synology SNS server after they are transmitted to the third-party push services, so no data will be stored by Synology.
287
288## Push Notifications
289
290### Data we collect
291
292Synology collects device-pairing information or email addresses in order to provide push notifications to your browsers, devices, or emails. The device-pairing information we collect includes but is not limited to your model name, serial number, device token, browser version, OS version, DSM version, and DSM Enterprise version. None of device-pairing information can be used to directly identify you. You can turn off the notification services anytime by configuring settings at Control Panel in DSM and DSM Enterprise.
293
294### How we use your data
295
296Synology uses the information collected from your devices in order to complete the push notification process from source to destination. For mobile and browser push services, the collected information will be sent to Synology's notification server, and the notification server will pair your DSM and DSM Enterprise (source) with the target device (destination). For email push services, the collected information will be sent to email service providers to complete email push notifications.
297
298### How we store your data
299
300Synology retains the collected information as long as needed for providing the services. Once the notification functionality is deactivated, Synology will delete the collected information immediately.
301
302## Mobile Applications
303
304### Data we collect
305
306Synology collects operating system information from your mobile device in order to help us customize content for particular Synology Devices if you enable usage data sharing or device analytics on your Synology Device. The data we collect does not contain information that may identify you, the user.
307
308Synology uses Google Analytics for Firebase to collect Synology mobile applications ("**Apps**") usage data and generates a usage statistics report. For example, the Apps usage data includes, but is not limited to, the type of mobile device you use, and the way you use the Apps. The statistics report is generated by aggregating App usage data. The statistics report does not contain information that may identify you, the user.
309
310If the Apps crash when you are using, Firebase also generates a crash report for us including system information, software versions, and crash logs. The crash report does not contain information that may identify you, the user.
311
312In Synology Drive Mobile App, we may collect device's latitude and longitude if you enable certain functions.
313
314Synology collects device information from the Apps that support push notifications (app name, app version, and the push notification message). Please refer to the Push Notification and/or Synology Application Service sections for more information.
315
316In the mainland of China, Synology Photos and Synology Moments use Baidu Maps SDK, a mapping service provided by Baidu, Inc., for the purposes of displaying the geographic information of photos on your device. Your device's MAC address will be collected by Baidu, Inc. to perform the mapping functionality. For details on how Baidu Inc. uses your data, please refer to [Baidu's Privacy Policy](https://ir.baidu.com/baidu-statement-privacy-protection).
+ ADDEDExtra data handling for users in mainland China

In mainland China, a third party sends your account verification code by phone, and Synology Photos/Moments use Baidu's mapping tool, which collects your device's MAC address.

317
318### How we use your data
319
320Synology leverages aggregated application statistics from Firebase tool, Apple, or Android store platforms to better understand our user distribution. You can opt-out any time by updating your preferences in the settings of iOS or Android devices.
321
322Synology collects crash reports from Firebase to only improve quality and to further develop our products and services. Crash information helps us to investigate problems and better understand what triggers them. You can opt-out any time by disabling the analytic feature in the setting of the iOS or Android devices.
323
324For the device's latitude and longitude, we use this data to accelerate QuickConnect login. You can opt out of this feature at any time through the admin settings.
325
326### How we store your data
327
328Synology retains statistics reports and crash reports for up to 14 months in order to generate useful information. Synology restricts access to both statistics reports and crash reports by specific employee roles. Synology does not collect or store your device's latitude and longitude; this data is erased from your device immediately after use.
329
330## Alexa Services
331
332### Data we collect
333
334Synology collects the address and OAuth information of your Synology Device, in order to authorize your NAS to complete the account linking process required for the Amazon Alexa service.
335
336### How we use your data
337
338Synology only stores information to authorize the Amazon Alexa service to access your NAS content, such as by enabling the Audio Station Skill to allow Amazon Alexa to access your music in Audio Station. Synology does not use this information for any other purpose. We do not share this information.
339
340### How we store your data
341
342Data collected by this method are automatically deleted after six months of inactivity.
343
344## DSM and DSM Enterprise Configuration Backup
345
346### Data we collect
347
348DSM configuration backup is a service that backs up the configuration settings of your storage system, ensuring that the settings can be imported in events of restoration or upgrade. You can opt-in DSM configuration backup in the initial installation process of DSM or later on in DSM Control Panel. The configuration data we collect may include your shared folder settings, user and admin group settings, security settings, network settings, login portal settings, regional options settings, application privileges settings, email addresses, and notification settings.
349
350### How we use your data
351
352Synology periodically collects configuration data of your storage systems in order to provide the DSM / DSM Enterprise configuration backup and recovery services. You can opt-out anytime in the Control Panel.
353
354### How we store your data
355
356Synology employs industry-standard encryption practices to safely protect your configuration data. Even in the event of a breach, the data collected cannot be used to identify you or your device.
357
358Your data is stored as long as you enable the DSM configuration backup service. If you choose to disable your DSM configuration backup service, we will keep your configuration data for up to 180 days.
359
360## Active Insight
361
362### Data we collect
363
364Synology collects operation data of your Synology Devices in order to offer resource analytic, issue-tracking, Technical Support, and also to improve our devices and software (collectively "**Active Insight Service**"). The operation data we collect includes device analytic data, serial numbers, IP addresses, and QuickConnect ID. We also collect email addresses to send you notifications and event reports. After you enable Active Insight, you can access the Active Insight web portal to review the performance of Synology Devices in real-time. The Active Insight web portal will retain your login activities for up to one year for security purposes. The login activities include user names, hostnames, and IP addresses.
365
366Please note that Active Insight Service works by only collecting device operation data. The files you stored in your Synology Devices will not be collected or accessed by Synology.
367
368Active Insight web portal may use "cookies" to help us better understand user behavior and to improve user experiences when you revisit our websites. For more information, please read our [Cookie Policy](https://www.synology.com/company/legal/cookie_policy).
369
370### How we use your data
371
372Synology uses the data collected from your devices to offer Active Insight Service. We will periodically remove the correlations between the device analytic data and other identifiable data such as serial number, IP address, e-mail address, and QuickConnect ID. The device analytic data cannot be traced back to you without the correlations with other identifiable data and will be integrated with peers' device analytic data to generate an aggregated report to provide device abnormality notification and improve our services.
373
374You can opt-out anytime by deactivating the Active Insight feature or by removing your Synology Devices from the Active Insight web portal. If you choose to deactivate your Active Insight feature, we will keep your identifiable data for up to 30 days. If you choose to disable your Active Insight feature from the Active Insight web portal, your identifiable data will be deleted immediately. After the removal of your identifiable data, the remaining device analytic data will be used to generate the aggregated report to help us to improve our services.
375
376### How we store your data
377
378Your data on Active Insight are stored in our _Europe - Frankfurt_ data center. Synology periodically deletes the identifiable data in order that the device analytic data collected cannot be used to identify you or your device. Synology restricts access to raw and aggregated data to only specific employee roles. Identifiable data collected are deleted along with the deletion of the relevant Synology Account.
379
380## MailPlus
381
382### Data we collect
383
384If you use Bitdefender as the antispam/antivirus engine, some technical data will be shared with Bitdefender in order to provide you with the services, such as data for identifying the device (UUID), IP addresses, senders, recipients, subjects, or attachments. If a threat is detected, additional information will be sent to Bitdefender for the threat prevention and network security purposes, such as file names, file hashes, source URLs, and other anonymized data.
+ ADDEDEmail details shared with Bitdefender when its scanning engine is on

If you run MailPlus with Bitdefender as the spam/virus engine, sender and recipient addresses, subject lines, and attachments are sent to Bitdefender's cloud. You can stop it by switching engines.

385
386You can stop data collection anytime by turning off the antispam/antivirus engine or switching to another engine in MailPlus Server.
387
388### How we use your data
389
390The information collected from your devices will be uploaded to Bitdefender's cloud center for spam detection. Please refer to Bitdefender's [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-business-solutions.html) for more information.
391
392### How we store your data
393
394Synology does not store your data. The collected data will be sent to the Bitdefender server for antispam scanning. For more information on how long the data will be stored by Bitdefender, please refer to Bitdefender's [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-business-solutions.html).
395
396## Synology Store
397
398### Data we collect
399
400Synology Store is an e-commerce platform operated by Synology. To make a purchase, Synology Store requires a Synology Account. Synology collects certain types of information from you to clear the transaction and provide the service to you. The types may include:
401
402- **Payment information**: Your billing address, VAT number, and payment method. Please refer to the "[Payment](https://www.synology.com/)" section for more information.
403- **Shipping information**: Your name, email, phone number, product serial number, and shipping address.
404- **Invoice** and **credit memo**: Your name, email, shipping address, billing address, and product's serial number.
405
406Additionally, we may collect your personal information, including your name, email, address, phone number, and product's serial number, for the purpose of processing your return request.
407
408### How we use your data
409
410Synology does not directly handle your payment information, such as your credit card number and verification code (CVC). We use the third-party processor, _Stripe, Inc._, to securely handle your payment method and to calculate and report taxes. Stripe will use and process your complete payment information in accordance with [Stripe's privacy policy](https://stripe.com/privacy) respectively.
411
412Also, to deliver your order, we will collect the shipping address that you provide to process the logistics, and your contact information may be passed to our third-party logistics partner, _United Parcel Service of America, Inc._ (hereinafter "**UPS**"). Please refer to [UPS's privacy policy](https://www.ups.com/sg/en/support/shipping-support/legal-terms-conditions/privacy-notice.page) for the information on how they use and process your shipping information.
413
414### How we store your data
415
416Synology retains the collected information only for the necessary period of time to fulfill the purpose of providing the services, including any legal or business requirements. The information that we collect from you will be managed by our maintenance personnel with adequate authorization.
417
418In addition, you have the rights to control your personal information at any time, which include:
419
420- access the information that we collected from you;
421- correct any inaccurate or incomplete information;
422- request deletion of your information from our records.
423
424## C2
425
426### Data we collect
427
428Synology C2 service is a cloud service operated by Synology. C2 service requires a Synology Account. We collect payment information from you to clear the transaction and provide the service to you. You should refer to the "Payment" section for more information. Additionally, we may collect usage and operation information in order to keep your service secure, up-to-date, and performing as expected.
429
430In addition, to help us understand the channel that our subscribers come from, we collect the information regarding the channels of the subscribers (e.g., the URL of the event's webpage) after successfully subscribed. The mentioned information does not contain any personal information and we cannot identify individuals from this information.
431
432For each C2 service, the types of data we will collect, and the use of your data are described as follows:
433
434- **C2 Backup** stores Your Content (as defined in C2 [Terms of Service](https://c2.synology.com/legal/terms_conditions)) that you back up from your source device or cloud services and is fully encrypted. For cloud services backup, we only collect necessary personal data and the index information of Your Content in order to provide search features and backup services. For device backup, device metadata and device IP are also collected to provide backup service. For cloud services, user related data including name and email account are collected with encryption to provide backup service. To provide the email notification service, we will collect and encrypt the email address that you chose to send email notifications for your C2 Backup service status. Other usage information generated by using the C2 Backup service, such as backup policy setting or device amount and other unidentifiable information, will not be encrypted and are collected and will solely be used for the purpose of improving the service experience and adding new features.
435- **C2 Identity** collects Your Content (as defined in C2 [Terms of Service](https://c2.synology.com/legal/terms_conditions)) and the metadata of the devices registered to C2 Identity, such as hostname, IP, serial number, operation system and version, storage usage, system uptime, and disk encryption status. Our collection of both these types of data enables us to provide the C2 Identity Service. Other usage information generated by using the C2 Identity service, such as the user count of each status, the registered device count of each status, group count, application count, link expiration time, file size and other unidentifiable information, will not be encrypted and are collected and used for the purpose of improving the service experience and adding new features.
436- **C2 Object Storage** is a reliable and flexible object storage solution suitable for storing unstructured data. It only stores the data You uploaded hereto in order to provide the object storage service.
437- **C2 Password** collects all data created, uploaded and stored by you in encrypted format within Your C2 Password account. We have no way of accessing decrypted versions of these data. The encrypted data include but is not limited to attachments, passwords, payment cards, personal identities, bank accounts, router information, and secure notes. Other usage information generated by using the C2 Password service, such as server logs, billing information, IP addresses, make and model of your device, number of items shared and, in the vaults, account email, profile name, and other unidentifiable information, will not be encrypted and are collected and used for the purpose of improving the service experience and adding new features.
438- **C2 Storage** stores data that you upload or sync from your Synology NAS Devices. For Hyper backup, you may choose to encrypt the data prior to uploading it. For Hybrid Share, the data is encrypted before uploading.
439- **C2 Surveillance** stores the videos that are uploaded from Your Synology NAS Devices. Such videos are recorded by the cameras that You have bound to the corresponding Plan through Synology Surveillance Station. The period of time when Synology retains Your uploaded videos depends on Your Plan. You can also delete the videos from C2 Surveillance at any time. Synology will not access Your uploaded video data.
440- **C2 Transfer** stores data that You uploaded for a transfer task and data uploaded to Your Storage Space. Such data, including the file content and file name, uploaded by You are completely encrypted at Your endpoint before being stored onto our platform. However, there are two cases where the C2 server decrypts and temporarily accesses the file: (a) When You apply dynamic watermark with the receiver's information to the transferred document, the C2 server will decrypt and temporarily access the document. The receiver's phone number and/or email address will be used for applying the dynamic watermark that demonstrates the receiver's information, or be hashed and used for one-time-password (OTP) verification, and will be stored on our platform until the transfer task is removed from Your account; and (b) When Your Content from Your Storage Space is transferred with watermark, the C2 server will decrypt and temporarily access the document to apply the watermark. In order to provide log records, IP addresses of Users (as defined in C2 [Terms of Service](https://c2.synology.com/legal/terms_conditions)) will also be collected by our server. Other usage information generated by using the C2 Transfer service, such as link expiration time, file size and other unidentifiable information, will not be encrypted and are collected and used for the sole purpose of improving the service experience and adding new features.
441
442### How we use your data
443
444Synology only uses data you provide to us to offer you the C2 service that you order from us. We do not access or analyze the data you upload, except that, as stated above, for the cloud service backup, we will access part of Your Content to provide service and search feature. Apart from C2 Backup, other C2 services will not access the data you upload. To provide service stability and optimize user experience, Synology may analyze non-personal identifiable service usage information that cannot be used to identify you or your device.
445
446### How we store your data
447
448Synology maintains your files in the Unites States, Germany, or Taiwan depending on your choice. Synology C2 services support full encryption of your files. Your data is protected with industry-standard encryption practices. Your files will never be accessed by our engineers unless a specific technical support request is made by you and requires us to do so. You can delete your data anytime during the subscription period. If your subscription ends, all your data will be deleted after a "**grace period**" defined by the [Synology C2 Terms of Service](https://c2.synology.com/legal/terms_conditions). If you choose to delete your Synology Account, your data and subscription status for Synology C2 will also be forfeited and removed.
+ ADDEDC2 cloud services: storage locations and encryption described

C2 files are stored in the US, Germany, or Taiwan depending on your choice, and are encrypted. C2 Transfer is an exception: the server briefly decrypts documents to add watermarks, and logs user IP addresses.

449
450## Synology AI Advisor
451
452### Data we collect
453
454Synology AI Advisor is an interactive feature available on our website that enables users to engage in AI-powered conversations for assistance, guidance, and support. When using this feature, your chat conversations and feedback (such as thumbs up or thumbs down on AI responses) are collected and stored in an anonymous manner. This data is used to maintain continuity in ongoing conversations and to help improve the quality and accuracy of AI responses.
455
456Conversations are stored exactly as entered. We strongly recommend that users do not share any personal information during their interaction with the AI Advisor.
457
458Chat data and feedback are not linked to your Synology Account or any other identifying information. Instead, a randomly generated session ID is used solely to determine whether a conversation is new or ongoing.
459
460### How we use your data
461
462The collected data is used to provide relevant AI responses, preserve conversation context, and assess the quality of the AI through user feedback. Synology may use this data to improve the AI Advisor experience and underlying models.
463
464To enhance functionality, Synology may transmit conversation data to OpenAI and Microsoft Azure, and utilize their LLM (large language model) services to generate the final response for the user. Access to conversation and feedback data is strictly limited to authorized personnel and is used only for maintaining and improving the AI Advisor feature.
+ ADDEDAI Advisor chats go to OpenAI and Microsoft Azure

What you type into Synology's AI Advisor chat is stored, may be sent to OpenAI and Microsoft Azure, and may be used to improve Synology's AI. Synology says the chats are tied only to a random session ID, not your account, and warns you not to type personal information.

465
466### How we store your data
467
468Conversation logs and user feedback are stored securely on Synology servers and identified only by session ID. They are not associated with your Synology Account or any personally identifiable data from our systems.
469
470Users may request deletion of their AI Advisor conversation data by providing their session ID. Upon verification, all data associated with that session will be permanently removed.
471
472Session data may be retained for up to one year to support continuity and service improvement. Conversation data used for system training or evaluation is stored in a format that cannot be linked back to specific users.
473
474## Synology Deep Search
475
476### Data we collect
477
478Synology Deep Search is a desktop application for local AI file search. All file indexing, AI processing, and search activities take place locally on your computer. Synology does not collect or receive your files, search index, or search queries.
479
480Deep Search supports face grouping, which is performed entirely on your computer. Information used to create face groups, such as photos, facial images, facial feature data, and person-name labels, is not transmitted to Synology.
481
482Photo Location Search is an optional feature and is disabled by default. If you enable this feature, Synology receives the GPS coordinates (latitude and longitude) embedded in photos to retrieve corresponding place names for location-based search. No photo content, image data, search index, or other file content is transmitted.
+ ADDEDDeep Search runs locally, with an optional location feature

Synology Deep Search does its file search, AI processing, and face grouping on your own computer and does not send files, photos, or face data to Synology. One optional feature, off by default, sends the GPS coordinates stored in your photos to Synology to look up place names.

483
484Synology collects your Synology Account information when you redeem or activate promotional access to Deep Search, or if you sign in to contact [Deep Search Technical Support](https://sy.to/deep_search_support).
485
486### How we use your data
487
488GPS coordinates are used solely to retrieve corresponding place names for location-based search.
489
490When you sign in to your Synology Account, your account information is used, as applicable, to verify and apply promotional access to Deep Search or to authenticate your account and provide technical support.
491
492Your files, photos, facial images, facial feature data, search index, and search queries are processed locally on your computer and are not transmitted to or used by Synology.
493
494### How we store your data
495
496GPS coordinates submitted through Photo Location Search are processed only for the time necessary to provide the requested place names and are not retained by Synology. Photo Location Search can be disabled at any time in the Deep Search settings to stop further GPS data transmission.
497
498The storage and retention of your Synology Account information and promotional access details are governed by Synology's [Privacy Statement](https://www.synology.com/company/legal/privacy).