Privacy Policy

SynStack AI (“we”, “our”, “us”) explains in this policy how we collect, use, and safeguard personal data when you visit synstack.ai, request a demo, or use the SynStack AI platform as an authenticated user.

We aim to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

SynStack AI operates in the United Kingdom. For data protection enquiries, please contact us at hello@synstack.ai

2. Who this policy covers

This policy addresses two different groups of people, and we are explicit below about which section applies to which:

• Site visitors — anyone who browses synstack.ai or submits a demo request, without an account
• Platform users — anyone with an authenticated account who uses one or more of our AI agents

The two groups have materially different data footprints. A site visitor who never requests a demo generates page-visit analytics only. A platform user's content is processed by AI models and, for some agents, by other third-party services — see sections 3 to 6.

3. What data we collect

A. Site visitors

• Demo request email address — if you submit the “Request a demo” form
• Page-visit analytics — pages visited, browser type, and similar usage data, collected on every page (see section 11)

B. Platform users

• Account email address — used to authenticate you and to control which agents you’re authorised to use
• Content you type, paste, or upload into an agent — briefs, documents, ad creative, video, transcripts, or any other material you submit — and the output our AI models generate from it. This is sent to the third-party AI providers listed in section 6.
• Per-call usage and cost telemetry — which user, which agent, which AI model, and token counts for every AI call we make. This does not include the text of your prompts or the AI’s output.
• A colleague’s account email — if you share a report or tracker with another SynStack AI user, we record their account identifier to grant them access
• Page-visit analytics — as above

We do not knowingly collect sensitive personal data (health, financial, or biometric data) about you as part of operating the platform itself. If you choose to paste such data into an agent as part of your own content, see section 4.

4. Publicly available data about people who aren’t SynStack users

Some agents — specifically Customer Reviews and Media Coverage Tracker — retrieve publicly available content from the open web, such as published customer reviews or published news and media coverage, in order to summarise and analyse it for you. That content may contain personal data about individuals who have never used SynStack AI — for example, a named reviewer or a person quoted in a news article.

We rely on legitimate interests as the lawful basis for this processing: monitoring already-public commentary and coverage about a brand is a legitimate business activity, and the data was already made public by the individual or the publisher. If you are such an individual and want to object to this processing or request erasure, contact us at hello@synstack.ai and we will review your request.

5. Lawful basis for processing

• Demo request email — legitimate interests (responding to your enquiry)
• Account email, agent content and output, colleague sharing — legitimate interests (operating the platform and providing the functionality you’ve requested)
• Usage and cost telemetry — legitimate interests (monitoring and controlling the cost of operating the platform)
• Publicly available third-party data — legitimate interests, as explained in section 4
• Page-visit analytics — legitimate interests, in low-privacy-impact, aggregated form (see section 11)

Where we rely on legitimate interests, you have the right to object — see section 9.

6. Sub-processors

We use the following third-party services. This list states plainly what each one actually receives — not a general description of what the service is for.

We do not sell your data to any third party.

7. International data transfers

Our database and file storage are hosted in the UK — Supabase’s eu-west-2 region (AWS, London). Platform data at rest — your account, your saved runs and reports, and uploaded or generated files — stays in the UK.

That is separate from what happens when an agent calls an AI provider. Content you submit to an agent is processed outside the UK and the EEA by our AI providers — Anthropic, OpenAI, and Perplexity are US-based; Google’s Gemini API may also process requests outside the UK/EEA. None of the AI APIs we currently use offer an EU-only or UK-only inference region, so this transfer is unavoidable for any agent that calls those models.

Other sub-processors in the table above may also process data outside the UK/EEA as part of delivering their own service — see each provider’s own privacy policy for details.

8. Data retention

We retain your data — account details, content, and generated output — until you delete it yourself, or until you ask us to delete your account. There is no automatic deletion, expiry, or retention limit: nothing is removed on a schedule, and nothing expires on its own.

Demo request email addresses are kept until you ask us to remove them.

9. Your rights and deletion

Most agents let you delete a saved run, review, or report directly within the product. Where that isn’t currently available, email us and we’ll delete it for you.

Account deletion is a manual process. Email hello@synstack.ai to request it, and a person on our team will delete your account and associated data — this is not an automated or instant process.

Under UK GDPR, you also have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Object to processing carried out under legitimate interests
• Lodge a complaint with the ICO at ico.org.uk

To exercise any of these rights, email us at hello@synstack.ai

10. Security

The platform is protected by:

• Email and password authentication to access your account
• Per-agent access control — your account is only authorised to use the specific agents granted to it
• Ownership checks on our API routes — requests are verified against your authenticated session before any of your data is read or changed
• Row-level security in our database — enforced at the database layer, not just in application code

11. Cookies and analytics

The only cookie we set directly is a strictly necessary session cookie, used to keep you signed in once you’ve logged in. We don’t use any other cookie.

We use Vercel Analytics to collect anonymised page-visit data (pages viewed, browser type) from everyone who visits synstack.ai, including logged-in platform users. It does not use cookies. It loads only if you accept in the cookie banner shown on your first visit — if you reject, or haven’t yet made a choice, it does not load.

12. Changes to this policy

We may update this policy as our product evolves. The “last updated” date at the top of this page will always reflect the most recent version.

13. Contact

For any privacy-related questions, please contact: hello@synstack.ai