Synthius Privacy Policy

Effective date: June 18, 2026
Controller: Synthius
Contact: privacy@synthius.ai
DPO or EU representative: appointed

This Privacy Policy explains how Synthius processes personal information when you use our app, website, desktop app, APIs, and related services.

Synthius is a private personal memory and self-understanding tool. With your direction, Synthius can process your chats, files, notes, transcripts, and other materials to help create a structured representation of your own biography, preferences, experiences, work context, psychometrics, communication style, and user-centric relationship map.

1. Summary

We process your data to provide the Synthius service you request. We do not sell your personal information. We do not use your uploaded files, chats, or generated personal memory to train shared AI models. When you choose an AI provider supported by Synthius, currently OpenAI or Google Gemini, we send only the data needed to perform the requested feature under provider terms intended for business/API use and no training on customer content.

You control your Synthius data. You can delete uploads, generated persona memory, relationship-map entries, and your account. You can also ask us to access, correct, export, restrict, or delete personal information, subject to legal limits.

Synthius uses two main consent and agreement points: first on the account-creation screen, and second on the persona-creation consent gate shown in the onboarding Files screen for a first persona and in the new-persona dialog for later personas. Deletion actions use a separate confirmation so you understand what will be removed.

2. Personal Information We Collect

Account and billing information

We collect information such as your name, email address, account credentials, subscription status, billing metadata, support messages, and security logs.

User-provided content

If you choose to upload or connect materials, we process the content you provide. This may include:

• chat exports from messaging services;
• emails or communication archives;
• documents, notes, journals, PDFs, text files, spreadsheets, and similar files;
• social network exports;
• voice transcripts or interview transcripts;
• profile answers and in-app messages;
• metadata such as file names, timestamps, participants, message order, and source labels.

Uploaded content may contain information about you and other people. You are responsible for making sure you have the rights, authority, or other lawful basis to upload and process the content you provide.

Derived memory and analysis

When you ask Synthius to build your personal memory, we may create structured outputs such as:

• biography facts about you;
• life events and experiences;
• preferences and dislikes;
• work history and projects;
• communication style;
• psychometric traits and values about you;
• a user-centric relationship map showing people in your life from your perspective;
• source references, confidence levels, and change history.

Synthius should not be used to create standalone profiles about other people. Relationship-map information must remain about your context and your perspective.

Sensitive information

Your materials may reveal sensitive information, including health, mental health, sex life or sexual orientation, racial or ethnic origin, religious or philosophical beliefs, political opinions, union membership, precise location, biometric information, financial hardship, family matters, or private communications.

We process sensitive information only when needed to provide features you choose, when allowed by law, and after the relevant in-product consent prompt has been accepted where consent is required. For EU/UK users, where a feature requires explicit consent for special-category data or optional sensitive analysis, Synthius presents that consent before the relevant processing starts. You may later withdraw consent by contacting privacy@synthius.ai and by stopping further use of the affected materials or deleting the relevant data where available.

Device, usage, and security data

We collect technical information such as device and browser type, app version, pages or features used, timestamps, crash logs, authentication events, security events, and approximate region. We use this to operate, secure, debug, and improve Synthius.

Cookies and similar technologies

We use necessary cookies for authentication, security, preferences, and service operation. We use analytics or marketing cookies only if disclosed in a cookie banner or settings panel where required by law. We honor applicable opt-out preference signals where required.

3. How We Use Personal Information

We use personal information to:

• create and maintain your account;
• process uploads you choose to provide;
• parse and structure your materials into your private memory;
• generate your biography, social context, preferences, work memory, experiences, style, and psychometric analysis;
• provide chat, search, memory, report, export, and deletion features;
• route requests to the AI provider you select;
• maintain source references, audit trails, and version history;
• provide support and respond to your requests;
• secure the service, prevent abuse, investigate incidents, and enforce our terms;
• comply with legal obligations;
• improve the reliability, privacy, and security of Synthius using aggregated, de-identified, or test data that does not include your private uploaded content unless you separately consent.

We do not use your uploaded content or generated personal memory to train shared AI models.

4. Legal Bases For EU/UK/Swiss Users

Where GDPR, UK GDPR, or Swiss data protection law applies, we rely on the following legal bases:

• Contract: to provide Synthius features you request, maintain your account, process uploads, and generate your private memory.
• Consent: for optional features that require consent, including certain sensitive-data, psychometric, or provider-choice features.
• Explicit consent: for processing special-category data about you when you enable sensitive-life-analysis or psychometric features.
• Legitimate interests: to secure the service, prevent abuse, maintain logs, improve non-sensitive product reliability, respond to support requests, and process incidental third-party mentions as part of your user-directed archive, where our interests are not overridden by individual rights.
• Legal obligation: to comply with tax, accounting, security, court, regulatory, and legal process obligations.

You may withdraw consent at any time. Withdrawal does not affect processing that occurred before withdrawal.

5. Information About Other People In Your Materials

Your uploads may include names, messages, photos, stories, opinions, or other information about friends, family, colleagues, or other third parties. Synthius processes this information only as part of your private account and your user-directed memory.

We apply these limits:

• We do not create public profiles of non-users.
• We do not merge people across different users' accounts.
• We do not sell or share third-party information for advertising.
• We do not contact people found in your uploads.
• We do not intentionally infer sensitive traits about third parties.
• We provide controls to hide, delete, or exclude people and sources from your account.

If you are a non-user and believe Synthius stores information about you in a user's private account, use our privacy request page or contact privacy@synthius.ai. We will review the request, verify identity where appropriate, consider the privacy rights of all affected people, and delete, restrict, or suppress information where required or appropriate.

Because Synthius usually does not know the identities or contact details of third parties mentioned in user uploads, direct notice to every third party may be impossible or involve disproportionate effort. We maintain this public notice so non-users can understand and exercise their rights.

6. AI Providers and Subprocessors

Synthius uses AI infrastructure providers selected by you or made available by us, currently OpenAI and Google Gemini. We use these providers to parse, summarize, extract, classify, transcribe, and generate responses. We require production providers to offer business/API terms, processor or service-provider commitments where applicable, and no training of shared models on customer content by default or by contract.

Provider processing may include prompts, source excerpts, uploaded files needed for the selected feature, generated outputs, and technical metadata. Provider retention varies by provider, endpoint, account, and plan. Current provider details are listed in our Subprocessor Notice.

If you bring your own provider account or API key, your provider relationship and settings may affect retention, training, billing, and rights. We link the provider notice during persona creation.

We also use service providers for hosting, storage, database services, security, payment processing, support, email, analytics, and error monitoring.

7. Disclosure of Personal Information

We disclose personal information only as needed to:

• provide the service through subprocessors and infrastructure vendors;
• process payments;
• provide support;
• comply with law or legal process;
• prevent fraud, abuse, security incidents, or harm;
• complete a merger, acquisition, financing, reorganization, bankruptcy, or similar business transaction, subject to appropriate confidentiality and user notice where required;
• act with your direction or consent.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising unless we provide required notices and opt-out rights. Our intended policy is not to use uploaded content, derived memory, or social graph data for advertising.

8. International Transfers

Synthius and its providers may process personal information in the United States, the European Economic Area, the United Kingdom, and other countries where we or our providers operate.

For transfers from the EEA, UK, or Switzerland to countries without an adequacy decision, we use appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, the EU-U.S. Data Privacy Framework where applicable, transfer impact assessments, encryption, access controls, and contractual security commitments.

9. Retention and Deletion

We keep personal information only as long as needed for the purposes described in this policy, unless a longer period is required for legal, security, tax, accounting, dispute-resolution, or abuse-prevention reasons.

Default retention rules:

• Account data: retained while your account is active and for a limited period after deletion for legal and security purposes.
• Uploaded content: retained until you delete it, replace it, or delete your account, subject to backup and legal exceptions.
• Derived memory and social graph: retained until you delete it, request deletion, or delete your account.
• AI provider logs: retained according to the selected provider and plan.
• Security logs: retained for a limited period needed for security, abuse prevention, and legal compliance.
• Backups: deleted or overwritten according to encrypted backup cycles, ordinarily within 90 days unless legally preserved.

When you delete data, we delete or de-identify it from active systems and instruct applicable service providers to do the same where required. Some residual copies may remain temporarily in encrypted backups or logs.

10. Your Rights

Depending on where you live, you may have rights to:

• access personal information;
• receive a copy of personal information;
• correct inaccurate personal information;
• delete personal information;
• restrict or object to processing;
• withdraw consent;
• opt out of sale, sharing, or targeted advertising;
• limit use of sensitive personal information;
• appeal a denied request;
• complain to a data protection authority.

Submit requests to privacy@synthius.ai or through our privacy request page.

We may need to verify your identity before responding. If a request concerns information about multiple people, we may limit disclosure or deletion to protect other people's rights.

11. California Privacy Notice

This section applies to California residents where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies.

Categories collected

We may collect:

• identifiers;
• customer records;
• commercial information;
• internet or network activity;
• geolocation at general regional level and precise location only if you provide it;
• audio or transcript information if you provide it;
• professional or employment information;
• education information if you provide it;
• inferences about your preferences, characteristics, behavior, attitudes, abilities, or aptitudes when you enable analysis features;
• sensitive personal information, including account credentials, contents of messages or files you upload, health or mental health references, religious or philosophical beliefs, political opinions, sex life or sexual orientation, racial or ethnic origin, union membership, precise location, financial account information, or other sensitive data contained in your materials.

Purposes

We use these categories to provide Synthius, generate user-directed memory and analysis, secure the service, process payments, provide support, comply with law, and perform internal operations.

Sale and sharing

We do not sell your personal information. We do not share uploaded content, generated memory, or social graph data for cross-context behavioral advertising.

If we ever use advertising technologies that qualify as "sharing" under California law, we will provide a "Do Not Sell or Share My Personal Information" mechanism and honor applicable opt-out preference signals.

Sensitive personal information

We use sensitive personal information only to provide the service you request, maintain security, verify identity, comply with law, and other purposes permitted by California law. We do not use sensitive personal information to infer characteristics outside the service you request without providing required rights and notices.

California rights

California residents may request to know, access, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and avoid discrimination for exercising rights. Submit requests to privacy@synthius.ai or through our privacy request page.

12. Other U.S. State Privacy Rights

Residents of Colorado, Connecticut, Virginia, Utah, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states may have privacy rights under state law. These may include access, correction, deletion, portability, opt-out of targeted advertising, sale, profiling, and consent or opt-out rights for sensitive data.

We extend core access, deletion, correction, export, and opt-out controls broadly, even where not legally required.

13. Automated Processing and AI

Synthius uses AI to help structure and summarize user-provided data. Synthius is not intended to make decisions with legal or similarly significant effects about you or anyone else. You must not use Synthius outputs for employment, housing, credit, insurance, education, healthcare, legal, immigration, criminal justice, eligibility, or other consequential decisions without separate legal review and safeguards.

AI outputs may be incomplete or wrong. You should review and correct your memory before relying on it.

14. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit, encryption at rest, access controls, logging, least-privilege permissions, vendor review, secure development practices, and incident response procedures.

No system is perfectly secure. You are responsible for protecting your login credentials and connected provider accounts.

15. Children

Synthius is intended for users who are at least 18 years old. Do not use Synthius if you are under 18. Do not upload data primarily about children unless you have legal authority and the feature has been approved for that use by Synthius.

16. Changes

We may update this Privacy Policy. If changes are material, we will provide notice through the app, email, or another appropriate method. The effective date above shows when this policy last changed.

17. Contact

Questions or requests: privacy@synthius.ai
Security issues: security@synthius.ai
Legal notices may be sent electronically to privacy@synthius.ai.