Privacy Policy

Introduction

Welcome. Synthetic.ai, ("Synthetic," "Company" or "we," "our" or "us") understands that privacy is important to you and want you to know that we are committed to safeguarding your Personal Information and Business Information (defined below). As a result, we want to provide you with a clear picture of how the Personal Information that you provide to us is processed, including by our agentic AI systems, managed, and protected by us, and what your choices are with respect to that information.

This Privacy Policy is global in nature and governs the Company's websites, including www.synthetic.ai, all subdomains and portals (collectively, the "Site"), as well as any applications and other services that post a link to this Privacy Policy. This Privacy Policy applies to personally identifiable information from or about an individual ("Personal Information") that we may collect from you through these channels.

Synthetic provides agentic, AI-powered bookkeeping services to businesses and their advisors. Our Services include automated transaction categorization and reconciliation, preparation of management reports and dashboards, workflow and task management, and business resources for business owners and operators (collectively, the "Services"). Our mission is to handle the business side of software, so that entrepreneurs can focus on building incredible products.

By using the Site or Services, you acknowledge that you have read this Privacy Policy. Where applicable law, platform rules, or the nature of the processing requires consent, we will request consent separately, including through account settings, in-product notices, authorization flows, cookie consent tools, or other appropriate mechanisms. If you do not provide information that is necessary to deliver a requested feature or Service, that feature or Service may not be available to you.

This Privacy Policy does not apply to any products, services, websites, or content that are offered by third parties ("Third Party Services"), which are governed by their respective privacy policies.

Residents of certain states in the United States may have additional rights and Synthetic will update this policy as and when such laws become applicable to it.

PLEASE READ THIS PRIVACY POLICY CAREFULLY BEFORE USING OUR SERVICES. YOUR ACCESS TO AND USE OF THE SERVICES IS ALSO SUBJECT TO OUR TERMS OF USE (THE “TERMS OF USE”). BY USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THIS PRIVACY POLICY. WHERE APPLICABLE LAW REQUIRES CONSENT FOR SPECIFIC PROCESSING ACTIVITIES, WE WILL REQUEST YOUR CONSENT SEPARATELY THROUGH APPROPRIATE MECHANISMS. IF YOU USE THE SERVICES ON BEHALF OF AN ORGANIZATION, YOU REPRESENT THAT YOU ARE AUTHORIZED TO DO SO.

Our Role: Business/Controller and Service Provider/Processor

Synthetic provides Services primarily to business customers. Depending on the context, Synthetic may process Personal Information in different roles.

When we process Personal Information contained in business, financial, accounting, operational, vendor, customer, employee, contractor, or advisor data provided by or on behalf of a business customer solely to provide the Services to that business customer, we generally act as a service provider, processor, or similar role under applicable privacy laws.

When we process Personal Information for our own business purposes — such as account registration, billing, customer relationship management, service security, fraud prevention, legal compliance, product analytics, service improvement, development of new features, marketing, and communications — we may act as a business, controller, or similar role under applicable privacy laws.

Where a separate data processing agreement, business customer agreement, or other written agreement applies, that agreement may further describe the parties’ roles and obligations with respect to Personal Information contained in Financial Information and other information submitted to or connected with the Services.

What Information We Collect

Information You Provide to Us

The type of information you provide to us depends on the nature of your interaction with the Site and our Services.

From Users of Our Service

You do not need to provide any information to merely visit the Site.

Personal Information

If you register for an account or seek to use our Services, we may then ask you to provide us with certain basic information, including:

• First and Last Name
• Email Address
• Business Address
• Telephone Number or Mobile Number
• Date of Birth
• Payment card information (which is processed by our third-party payment processor)
• Name of business
• Business industry and size
• Web analytics and other information that could reasonably be used to identify you personally or identify your household
• Demographic information, such as your country, state, or county of residence or business operation ("Demographic Information")

We also collect Financial Information as follows:

In connection with providing our AI-powered bookkeeping and back-office Services, we may also process financial and operational information that you or your organization choose to provide or connect to the Services, such as accounting system data, transaction records, invoices, receipts, bank or card feeds, chart of accounts and related documentation, corporate ownership structure and percentages as well as information we derive from or generate about that data (for example, categorizations, reconciliations, anomaly flags, suggested entries or workflows). Where this Financial Information also contains Personal Information, we will treat it as Personal Information under this Privacy Policy.

In all instances, your decision to provide us with information is voluntary, but if you choose not to provide any requested information, you may not be able to take advantage of all of the Site's features or our Services.

For General Visitors to the Site

In addition to information that you choose to submit to us, we and/or our service providers may automatically collect and/or store certain information when you visit or interact with the Site ("Usage Information"). This Usage Information may be stored and/or accessed from your personal computer, laptop, tablet, mobile phone or other device (a "Device") whenever you visit or interact with our Site. Usage Information may include:

• Your IP address, IDFA, Android/Google Advertising ID, IMEI, or another unique identifier
• Your Device functionality (including browser, browser language, operating system, hardware, mobile network information)
• Referring and exit web pages and URLs
• The areas within our Site that you visit and your activities there, including remembering you and your preferences
• Your Device location or other geolocation information, including the zip code, state or country from which you accessed the Services
• Your Device characteristics
• Certain other Device data, including the time of day you visit our Site

Information We Collect When You Interact with Third-Party Sites and Integrated Tools

The Services may include functionality that allows certain kinds of interactions between the Site and your account on a third-party website or application, including accounting platforms, financial institutions, or other AI-enabled tools that you choose to connect. The use of this functionality may involve the third-party site providing information (which may include Personal Information and Financial Information) to us. These third parties may retain any information used or provided in any such communications or activities and these third parties' practices are not subject to our Privacy Policy. We may not control or have access to your communications through these third parties. Further, when you use third-party sites or services, you are using their services and not our services and they, not we, are responsible for their practices. You should read the applicable third-party privacy policies before using such third-party tools on our Site.

Information About Other Individual Provided by Business Customers

Business customers and their authorized users may upload, connect, or otherwise make available information relating to third parties, including customers, vendors, employees, contractors, owners, advisors, payees, and other business contacts. If you provide or connect Personal Information about another individual, you represent that you have the authority, consent, or other legal basis required to provide that information to Synthetic and to permit Synthetic to process it as described in this Privacy Policy, our Terms of Use, and any applicable customer agreement or data processing agreement.

Categories of Information We Collect

The chart below summarizes the categories of Personal Information we may collect, examples of each category, why we use it, the categories of recipients to whom we may disclose it, and our general retention approach. Not all categories apply to every user, account, or Service.

The categories, examples, purposes, recipients, and retention periods described above are intended to provide a general summary of our practices. The specific Personal Information we collect, use, disclose, and retain may vary depending on your relationship with us, the Services you use, the integrations you enable, your account settings, your organization's instructions, and applicable legal requirements

Cookies and Other Tracking Technologies

We may use various methods and technologies to store or collect Usage Information ("Tracking Technologies"). Where required by applicable law, we will obtain your consent before using certain Tracking Technologies and will respect your choices regarding their use. Tracking Technologies may set, change, alter or modify settings or configurations on your Device. A few of the Tracking Technologies used on the Site include, but are not limited to, the following:

• Cookies. A cookie is a file placed on a Device to uniquely identify your browser or to store information on your Device. Our Site may use HTTP cookies, HTML5 cookies, Flash cookies and other types of cookie technology to store information on local storage. We use cookies for purposes such as enabling core site functionality, remembering your preferences, helping us understand how you use the Site, and, in some cases, to personalize content and advertising in combination with other Tracking Technologies.
• Web Beacons. A Web Beacon is a small tag (which may be invisible to you) that may be placed on our Site's pages and messages. We may use web beacons for tracking purposes.
• Embedded Scripts. An embedded script is programming code that is designed to collect information about your interactions with the Site, such as the links you click on.
• ETag, or entity tag. An ETag or entity tag is a feature of the cache in browsers. It is an opaque identifier assigned by a web server to a specific version of a resource found at a URL.
• Browser Fingerprinting. Collection and analysis of information from your Device, such as, without limitation, your operating system, plug-ins, system fonts and other data, for purposes of identification.
• Recognition Technologies. Technologies, including application of statistical probability to data sets, which attempt to recognize or make assumptions about users and devices (e.g., that a user of multiple devices is the same user).

We may use Tracking Technologies for a variety of purposes, including:

• To allow you to use and access the Site, including for the prevention of fraudulent activity and improved security functionality
• To assess the performance of the Site, including as part of our analytic practices or otherwise to improve the content, products or services offered through the Site
• To offer you enhanced functionality when accessing the Site, including identifying you when you sign into our Site or keeping track of your specified preferences or to track your online activities over time and across third-party sites
• To deliver targeted advertising, including content relevant to your interests on our Site and third party sites based on how you interact with our content

Users can opt-out of certain Google-related tracking technology and customize the Google Display Network ads that they receive, by visiting the Google Ads Settings. Google also recommends installing the Google Analytics Opt-out Browser Add-on for your web browser.

You can also learn more about cookies and your choices by reviewing any cookie notice or cookie policy that we may make available on the Site from time to time, and, where applicable, by using any cookie banner or consent-management tools provided on the Site to manage or withdraw your consent to non-essential cookies.

Please note that even if you exercise opt-out choices, you may continue to receive advertisements, for example, ads based on the particular website you are viewing (e.g., contextually based ads).

Why We Collect Personal Information

We may use your Personal Information for various purposes, including:

• Responding to requests for information
• Providing, developing, customizing and improving your services
• Fulfilling your requests for services
• Enforcing agreements with users
• Verifying your identity and for fraud prevention
• Creating accounts
• Evaluating your employment application if you have applied for a job with us
• Providing you with updates and information about services we provide
• Creating user preferences regarding emails and other correspondence
• Sending you marketing information about Synthetic
• Sending you email and text communications such as electronic newsletters about our Services which may be of interest to you
• Improving the effectiveness of our Site, our marketing endeavors, and our product and service offerings
• Helping us address problems with and improve our Site and our products and services, including testing and creating new products, features, and services
• Using information (including Financial Information and other data connected to the Services) to operate, support, and improve our AI-powered features and automation, including quality assurance, testing, and developing new capabilities and product features, while applying appropriate de-identification and access controls where feasible
• Protecting the security and integrity of the Site, including understanding and resolving any technical and security issues reported on our Site
• Resolving disputes
• Engaging in analysis, research, and reports regarding the use of our Site and Services
• Supporting automated recommendations, categorizations, anomaly detection and workflow suggestions within the Services, and conducting human review of model outputs where needed for quality, accuracy, or compliance
• For internal business purposes and our legitimate interests
• Complying with the law and protecting the safety, rights, property or security of Synthetic, the Services, and the general public
• For purposes disclosed at the time you provide your information or as otherwise set forth in this Privacy Policy

When We Disclose Personal Information

We may disclose your Personal Information in the following circumstances:

(a) Synthetic Suppliers

We may use third-party suppliers to perform certain services on behalf of us or the Site or Services, such as: (i) creating and updating Site functionality; (ii) billing or processing credit cards, and/or electronic or manual payments; (iii) assisting us in Site operations; (iv) managing a database of customer information; (v) hosting the Site and improving performance of the Sites; (vi) designing and/or operating the Site's features; (vii) tracking the Site's activities and analytics, including marketing and market research; (viii) data enhancement (to learn more about our customers); (ix) providing customer support such as technical support; (x) enabling us and/or third parties to send you special offers or perform other administrative services, such as customer service, security, tech and operational support; (xi) providing cloud infrastructure, data storage, security, and logging services to support our AI models and automation features; and (xii) other services designed to assist us in maximizing our business potential.

Without limiting the foregoing, with your permission, we may share your Personal Information with those suppliers in order to assist in the supply of our Services to you.

(b) Third Party Service Providers

Our Services are integrated with a variety of Third Party Service Providers. The purpose of these integrations is to enable you to send and receive information between yourself, Synthetic, and the Third Party Service Provider in connection with the Services. For example, a Third Party Service Provider that is a payment service provider may initiate a payment on your behalf based on instructions you provide through the Services. We will disclose your information to Third Party Service Providers as necessary to facilitate the integrations you enable. Those Third Party Service Providers may also transmit data about you and your transactions to Synthetic, and we will incorporate that data into the Services to support the functionality you have requested.

These Third-Party Service Providers may use your Personal Information to provide the integrated services and as otherwise described in the applicable Third-Party Service Provider agreement. The information that you supply directly to any Third-Party Service Provider shall be governed by the applicable third-party service provider's privacy policy.

(c) To Protect the Rights of Synthetic and Others

To the fullest extent permitted by applicable law, we may also disclose your information when required to by law or if we believe in good faith that doing so is necessary or appropriate to: (i) protect or defend the rights, safety or property of Synthetic, its affiliates, third parties or the general public; or (ii) to respond to claims that any content violates the rights of a third party. This includes exchanging information with other companies and organizations for fraud prevention, spam/malware protection, and other similar purposes.

(c) Disclosure to Law Enforcement

We reserve the right to release current or past personal information: (i) in the event that we believe that the Services are being or have been used to commit unlawful acts; or (ii) if the information is subpoenaed or requested pursuant to any court order or lawful request by public authorities, including to meet national security or law enforcement requirements; provided, however, that, where permitted by applicable law and not prohibited by a court order or legal restriction, we shall provide you with prompt notice (via email or other reasonable means) and a reasonable opportunity to challenge the subpoena or court order prior to disclosure of any personal information.

(d) In Connection with a Business Transfer

We also reserve the right to disclose and transfer all information: (i) to a subsequent owner, co-owner or operator of the Site and/or our Services; or (ii) in connection with a merger, consolidation, restructuring, the sale of substantially all of our interests and/or assets or other corporate change, including during any due diligence process; or (iii) if we are the subject of bankruptcy proceedings; provided, however, that if we are involved in a bankruptcy proceeding, merger, acquisition or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on the Site of any change in ownership or uses of your personal information, as well as any choices that you may have regarding your personal information.

(e) To Affiliates of Synthetic

We may provide information to affiliates and nonaffiliated third parties who perform services or functions for us in conjunction with our services to you, but only if we have a contractual agreement with the other party which prohibits them from disclosing or using the information other than for the purposes for which it was disclosed.

(f) On the Basis of Consent

Where you provide consent, we share your information as described at the time of consent, such as when authorizing a third-party application or website to access your Synthetic account or participating in promotional activities by Synthetic partners or third parties.

(g) Marketing

We may share your information, including your Personal Information, with our affiliates for direct marketing purposes. We may also share information with third parties, such as accounting, bookkeeping, business tools, or financial services vendors, for co-marketing or promotional activities only with your prior consent or where permitted by applicable law. You may opt out of such sharing at any time by contacting us using the information in the Contact Us section.

(h) For Internal Business Processes and Promotion

Where permissible under applicable law, we may use certain information about you, such as your email address, de-identify it, and share it with social media platforms, to generate leads, drive traffic to Synthetic, or otherwise promote our products and services.

Sales, Sharing, Targeted Advertising, and Opt-Out Choices

We do not sell Personal Information for money. However, some U.S. state privacy laws define “sale,” “sharing,” “targeted advertising,” or similar terms broadly. Depending on how our Site, advertising vendors, analytics tools, or marketing partners operate, our disclosure of identifiers, internet or network activity information, cookie identifiers, or similar information to advertising, analytics, or social media partners may be considered a “sale,” “sharing,” or processing for “targeted advertising” under applicable law.

Where required by applicable law, you may opt out of:

• the sale of Personal Information;
• sharing of Personal Information for cross-context behavioral advertising;
• processing of Personal Information for targeted advertising; and
• profiling in furtherance of decisions that produce legal or similarly significant effects.

You may exercise these rights by using any “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link made available on our Site, by adjusting cookie consent settings where available, or by contacting us as described in the “Contact Us” section.

Where required by law, we honor valid opt-out preference signals, including Global Privacy Control signals, as requests to opt out of sale, sharing, or targeted advertising for the browser or device through which the signal is submitted. If you use different browsers or devices, you may need to enable the signal on each browser or device. Where we can reasonably associate an opt-out preference signal with your account, we will apply the request to that account as required by applicable law.

We do not knowingly sell or share Personal Information of individuals under 18 years of age.

Agentic AI Systems and Bookkeeping Automation

We use agentic, AI-powered systems as core infrastructure to deliver and improve our bookkeeping and financial back-office Services. These systems operate autonomously to, among other things, categorize, post, and reconcile transactions, generate journal entries and management outputs, initiate workflows, and, where appropriate, communicate with you (for example, by requesting clarification or additional documentation) without routine human review by Synthetic. Where required by applicable law, AI-generated communications will be identified as such.

Our personnel do not independently audit, review, or verify the correctness of AI-generated bookkeeping outputs, and we do not provide assurance, audit, or accounting advice regarding those outputs. You and your organization are responsible for determining whether, and to what extent, to rely on, export, or act on AI-generated outputs, and you do so at your own risk and subject to our Terms of Use.

As of the date of this Privacy Policy, we do not use AI systems to make decisions that produce legal or similarly significant effects about individual consumers (such as decisions about eligibility for credit or employment) and would not do so without appropriate human involvement and, where required by applicable law, additional notices or consent.

AI Inputs, Outputs, and Model Improvement

The Services may process Financial Information and other information submitted to or connected with the Services, prompts, instructions, corrections, feedback, user interactions, AI-generated outputs, workflow activity, and related usage data to provide, maintain, troubleshoot, secure, evaluate, and improve the Services and our AI-powered features.

Where permitted by applicable law and applicable customer agreements, we may use such information to test, validate, benchmark, improve, and develop AI systems, automation tools, and related functionality. We will use commercially reasonable measures designed to reduce privacy risk, which may include access controls, aggregation, de-identification, data minimization, filtering, contractual restrictions, and other privacy-enhancing safeguards where appropriate.

We do not use information received from Google Workspace APIs to create, train, or improve machine-learning or artificial-intelligence models that serve users other than the specific user whose data is being processed, except to the extent expressly permitted by the Google API Services User Data Policy and Google Workspace API policies.

If we materially change how we use Personal Information or Financial Information and other information submitted to or connected with the Services for AI model development, training, or improvement in a way that requires additional notice or consent under applicable law or platform rules, we will provide such notice or obtain such consent before applying the change.

Automated Processing and Profiling

Our AI-powered bookkeeping systems may generate categorizations, reconciliations, anomaly flags, suggested entries, workflows, dashboards, reports, and other outputs based on information submitted to or connected with the Services. These outputs are designed to support business bookkeeping and operational workflows.

We do not currently use automated processing or profiling to make decisions about individual consumers that produce legal or similarly significant effects, such as decisions relating to consumer credit, employment, housing, insurance, education, criminal justice, or access to essential goods or services.

If we introduce automated decision-making or profiling that is subject to additional notice, access, opt-out, human review, explanation, or appeal rights under applicable law, we will provide the required disclosures and choices before or at the time required by law.

Aggregated Information

We may aggregate, de-identify, and/or anonymize any information collected through the Services such that such information is no longer linked to your Personal Information. We will not attempt to re-identify de-identified information except as permitted by applicable law. We may use and share this aggregated and anonymized information (non-Personal Information) for any lawful purpose, including for research and marketing purposes and may also share such data with our affiliates and third parties, including promotional partners and others. Notwithstanding the foregoing, this paragraph does not apply to information received through Google Workspace APIs, which is subject to the additional restrictions set forth in the "Google Workspace / Gmail Data" section below.

Google Workspace / Gmail Data

If you connect Google Workspace or Gmail to the Services, we request access only to Google Workspace API scopes that are necessary to provide user-facing features you choose to use, such as transaction categorization, reconciliation support, receipt or invoice matching, financial reporting, workflow support, and related bookkeeping automation.

Synthetic’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google Workspace API data, including Gmail content or metadata:

• for serving ads, retargeting, personalized advertising, or interest-based advertising;
• for sale to advertising platforms, data brokers, or information resellers;
• to determine creditworthiness or for lending purposes;
• to create, train, or improve machine-learning or artificial-intelligence models that serve users other than the specific user whose data is being processed, except to the extent expressly permitted by applicable Google policies; or
• for any purpose unrelated to the user-facing Services you request.

We do not allow humans to read Gmail message content or Google Workspace data except where you have provided affirmative consent for support or troubleshooting, where necessary for security or abuse investigations, where required to comply with applicable law, or where the data has been aggregated and anonymized for permitted internal operations.

You may disconnect Google Workspace or Gmail from the Services through account settings or the applicable Google permissions settings. Where required by applicable law or platform policy, we will provide reasonable means to request deletion of Google Workspace data retained by Synthetic, subject to legal, security, and operational retention requirements.

Your Rights and Choices About the Personal Information We Collect

You may choose to restrict the collection or use of your Personal Information in the following ways:

• Whenever you are asked to fill in a form on our website or our other Services, consider what information to include and exclude.
• We may provide you with access to your registration information and the ability to edit this information in your account settings dashboard. Please be aware that even after you delete or update information within our Services, we may not immediately delete residual copies from our active servers and may not remove information from our backup systems. Similarly, if and to the extent any information is indexable by search engines, it may not be updated by such search engines when we update it, and old versions may be archived by them or by third parties outside our control.
• Some of our Services may provide you with additional information and choices about your privacy, which you should review.
• If you have previously agreed to our using your Personal Information for direct marketing purposes, you may change your mind at any time by writing to us using the contact information below.

We will try to comply with your request(s) as soon as reasonably practicable.

Where required by applicable law, you may have additional rights in relation to profiling or automated decision-making carried out using your Personal Information, including the right to request information about the logic involved in certain automated processes and the significance and envisaged consequences for you, or to request human review. You can contact us as described in the "Contact Us" section to learn more or to exercise these rights, to the extent they apply to you.

Administrative Correspondence. Please also note that if you do opt-out of receiving marketing-related emails from us, we may still send you messages for administrative or other purposes directly relating to your use of the Services, and you cannot opt-out from receiving those messages.

Retention of Personal Information

We retain Personal Information only for as long as reasonably necessary and proportionate to fulfill the purposes described in this Privacy Policy, including providing the Services, maintaining accounts, supporting integrations, complying with legal obligations, resolving disputes, enforcing agreements, maintaining security, preventing fraud, and preserving business records.

Our retention periods vary depending on the type of information and the context in which it is processed. For example:

• account and profile information is generally retained for the duration of the account and a reasonable period thereafter. Upon account closure or termination, we will delete or de-identify your Personal Information within a reasonable period, subject to applicable legal retention requirements, backup procedures, and any applicable customer agreement;
• billing, tax, payment, legal, and accounting records are retained for the period required by applicable law and business recordkeeping requirements;
• security logs and fraud-prevention records are retained for as long as reasonably necessary for security, investigation, and compliance purposes;
• Financial Information and other information submitted to or connected with the Services are retained in accordance with the applicable customer agreement, account settings, product functionality, legal requirements, backup procedures, and operational needs;
• marketing preferences and suppression records may be retained as needed to honor opt-out requests; and
• de-identified, aggregated, or anonymized information may be retained for lawful business purposes where it no longer identifies or reasonably can be linked to an individual.

When Personal Information is no longer needed, we will delete, de-identify, aggregate, or otherwise handle it in accordance with applicable law and our internal retention practices.

Children's Privacy

The Site and Services are intended for business customers and authorized representatives who are at least 18 years old or the age of majority in their jurisdiction. The Site and Services are not directed to children, and we do not knowingly collect Personal Information from children under 13. We also do not knowingly sell or share Personal Information of individuals under 16. If you believe that a child has provided Personal Information to us, please contact us and we will take appropriate steps in accordance with applicable law.

International Data Transfers

Synthetic is based in the United States, and we and our service providers may process and store Personal Information in the United States and other jurisdictions. These jurisdictions may have data protection laws that differ from the laws of your jurisdiction.

Where required by applicable law, we use appropriate safeguards for cross-border transfers of Personal Information, which may include contractual protections, data processing agreements, standard contractual clauses, transfer risk assessments, technical and organizational safeguards, or other lawful transfer mechanisms.

Updating Personal Information

We prefer to keep your Personal Information accurate and up to date. If you would like to change your contact information, please contact us using the contact information in the Contact Us section below.

If so, we will make good faith efforts to make requested changes in our then active databases as soon as reasonably practicable (but we may retain prior information as business records). Please note that it is not always possible to completely remove or delete all your information from our databases and that residual data may remain on backup media or for other reasons, such as a legitimate business reason.

In addition, please note that if you implement a deletion request but later sign up for information or Services, your most recent request will control our information relationship with you.

Links

For your convenience, the Site(s) and this Privacy Policy may contain links to other websites. Synthetic is not responsible for the privacy practices including their use of AI, advertising, products, services, or the content of such other websites. None of the links on the Site(s) should be deemed to imply that Synthetic endorses or has any affiliation with the links.

Data Security and Incident Notification

We maintain administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, loss, misuse, disclosure, alteration, and destruction. These safeguards may include access controls, least-privilege permissions, encryption in transit, encryption or protective controls for data at rest where appropriate, logging and monitoring, vendor security review, personnel confidentiality obligations, vulnerability management, incident response procedures, and other measures appropriate to the nature of the information and the Services.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we determine that a security incident involving Personal Information requires notice under applicable law, we will provide notice to affected individuals, customers, regulators, or other parties as promptly as practicable and within the timeframes required by applicable law and any applicable agreement.

California Privacy Rights

Under California law, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and the Shine the Light law, California residents may have certain additional rights regarding their Personal Information. These may include the right to request information about our collection, use, disclosure, 'sale' or 'sharing' of your Personal Information, to request access to and deletion or correction of certain Personal Information we maintain about you, and to opt out of certain processing of your Personal Information for purposes of targeted advertising or 'sale'/'sharing', subject to applicable exceptions.

California residents may also request certain information regarding Synthetic's disclosures in the prior calendar year, if any, of their Personal Information to third parties for those third parties' own direct marketing purposes. If you are a California resident, you can make such a request or exercise these rights by contacting us as set forth in the Contact Us section. You must clearly state the nature of your California privacy request and provide sufficient information for us to process your request, including at a minimum your name, email address, and California postal address. We will respond to your request within the timeframe required by California law.

Nevada Privacy Rights

If you are a Nevada resident, you have the right to request certain information from us regarding the collection and sale of your covered information (as defined in Nevada Revised Statutes 603A.320) during your visit to our websites or when you otherwise interact with us online. If you have sought or acquired, by purchase or lease, any goods or services for personal, family, or household purposes from the Synthetic Site, you may ask us to disclose whether we have sold (for monetary consideration) certain covered information about you.

As a Nevada resident, you may also request to opt out of us sharing such information about you. To make this inquiry, please submit a request by contacting us. You must include your full name, email address, and attest that you are a Nevada resident by providing a Nevada postal address in your request. Please state whether you are requesting information and/or opting out.

We will process your request within 60 days, or we will let you know if we need additional time. We may require additional information to verify your identity before we can respond.

Global Privacy Controls

Where required by applicable law, we recognize and honor valid opt-out preference signals, including Global Privacy Control ("GPC") signals as requests to opt out of sale, sharing, targeted advertising, or other processing covered by the applicable law. We process such signals in accordance with the requirements of the state privacy laws that apply to us.

Do Not Track

Do Not Track (“DNT”) is a legacy browser setting for which there is not a uniform legal or technical standard. We do not currently respond to DNT signals. For clarity, this does not limit our handling of GPC or other legally recognized opt-out preference signals where required by applicable law.

International Data Transfers

Because Synthetic works with global companies and technologies, we may transfer your Personal Information outside of the country in which it was originally provided. This may include transfers to third parties, such as developers, service providers or affiliated entities who are located outside the United States, where data protection laws may not offer the same level of protection as those in the U.S. Where required by applicable law, we use appropriate safeguards for cross-border transfers of Personal Information, which may include contractual protections, data processing agreements, standard contractual clauses, transfer risk assessments, technical and organizational safeguards, or other lawful transfer mechanisms.

Changes to our Privacy Policy

If you have questions or concerns with respect to our Privacy Policy, you may contact us using the contact information in the Contact Us section below. We may elect to change or amend our Privacy Policy; in such event, we will post the updated Privacy Policy on the Site with a revised “Last Updated” date. For material changes that affect how we process your Personal Information or Financial Information, we will provide notice through email, in-product notification, or other reasonable means before or at the time the changes take effect. Your continued use of the Services after the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes.

Contact Us

If you have any questions or concerns about this Privacy Policy and/or if you want to exercise any of the rights that you are given under this Privacy Policy, please email us at hello@synthetic.ai or contact us by mail at 965 Folsom Street, Apt 301, San Francisco, CA 94107.

Privacy Notice for US Residents

Residents of certain states in the United States, including without limitation California, Colorado, Connecticut, Utah, Virginia, and others as their laws become effective, may have additional rights with respect to their Personal Information. This Supplemental Policy is intended to describe those rights and how to exercise them, to the extent such laws apply to Synthetic.

This Supplemental Policy describes Synthetic's practices regarding the collection, use, and disclosure of Personal Information and provides instructions for submitting data subject requests, including, where applicable, in relation to profiling or automated decision-making carried out using your Personal Information.

This Notice does not apply to personal information that we process as a service provider on behalf of our customers.

Appeals

If we deny your request to exercise a privacy right and applicable law gives you a right to appeal, you may appeal our decision by replying to our response or contacting us at the address in the “Contact Us” section with the subject line “Privacy Appeal.” We will review and respond to your appeal within the timeframe required by applicable law. If your appeal is denied, we will provide information about how you may contact the applicable regulator where required by law.

Your Rights to Your Personal Information

Generally, the rights available to residents of certain U.S. states under applicable privacy laws can be categorized as follows:

• Confirm whether we process their personal information
• Access and delete certain personal information
• Data portability
• Opt-out of personal data processing for targeted advertising and sales
• Correct inaccuracies in their personal information, taking into account the information's nature processing purpose
• Opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects

Processing of Sensitive Information and Certain Automated Processing: We must obtain your express consent prior to collecting and processing certain categories of sensitive personal data such as precise geolocation data, data about protected characteristics and genetic or biometric data. Where required by applicable law, we will also obtain your consent, or provide you with additional notice and choices, before using your Personal Information in certain forms of profiling or automated decision-making that may produce legal or similarly significant effects for you.

Sensitive Personal Information: Where applicable law provides a right to limit the use or disclosure of Sensitive Personal Information, we will honor that right to the extent required. We use Sensitive Personal Information only for purposes reasonably necessary and proportionate to provide the requested Services, maintain security and integrity, prevent fraud, verify or maintain account access, comply with law, and other purposes permitted by applicable law, unless we provide additional notice and obtain consent where required.

Non-Discrimination: Synthetic will not discriminate against customers who exercise their rights under state privacy laws.

Personal Information of Minors

Our Site and Services are not directed to children under the age of 18, and we do not knowingly collect Personal Information directly from children under the age of 13. We do not solicit Personal Information directly from children.

Financial Incentives for Consumers

We do not have any programs which provide financial incentives for consumers.

Exercising Access, Data Portability, and Deletion Rights

To exercise any of these rights, you can submit your request by contacting us. We will respond to your privacy requests within the timeframe required by applicable law and notify you of the action(s) we have taken or required steps to fulfill the request.

Only you or a person registered with the appropriate state authority that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Verification and Authorized Agents

We may verify your request by matching information you provide with information we maintain, asking you to log into your account, requesting additional information reasonably necessary to verify your identity, or using other verification methods permitted by applicable law. If you submit a request through an authorized agent, we may require proof that you authorized the agent to act on your behalf and may also require you to verify your identity directly with us, unless otherwise prohibited by applicable law. We will use information provided for verification only for the purpose of verifying and responding to your request.