SynthSocial Platform Privacy Notice

1. Who we are and our roles

SynthSocial is a trading name of Felsinea Ltd (company number 17149226), registered office 203 West Street, Fareham, Hampshire, England, PO16 0EN. Our data-protection contact is Giulio Benassi, at info@synthsocial.io. We have not appointed a Data Protection Officer.

For account administration, customer relationships, billing, our own business records and service capacity monitoring, Felsinea acts as a controller. For Exercise content and participant information that a customer puts into SynthSocial, the customer decides why and how that information is used. The customer is usually the controller and Felsinea processes that information on the customer's instructions under the Data Processing Agreement (DPA). If you are a Player, contact the organisation running your Exercise about its use of your information; we will pass requests to it where appropriate.

2. Information and why we use it

We handle the following information to provide and administer SynthSocial:

• Account and contact details: name, business email, organisation, account identifiers and login/session information, used to set up and secure accounts and provide support.
• Exercise and Player content: scenario context, prompts, generated text, posts, Player submissions and images or videos uploaded by a customer. We host saved Exercise content and media in Supabase. The customer controls this content and is responsible for its lawful use.
• AI prompts and selected text: AI text generation is available in SynthSocial plans but is only used when an Organiser chooses to submit a prompt. The prompt and text the Organiser selects, including selected Player posts if directed, are sent to OpenAI to generate draft text. Images and videos are not sent to OpenAI. We do not use customer content to train general-purpose AI models.
• Business and billing records: customer correspondence, Order Forms and invoices, used to manage the relationship, provide support, collect fees and meet legal/accounting obligations.
• Service capacity information: account-linked usage information held in Supabase, used to monitor service capacity and identify unusual spikes. Vercel and OpenAI provide service or generation metrics that we currently receive only in aggregate and cannot use to identify which Organiser caused a spike. We use these metrics to operate the service, not for advertising or behavioural analytics.

We generally rely on contract necessity to provide and administer the service, legitimate interests to manage business relationships and protect service capacity, and legal obligations for required accounting or compliance records. Customers are responsible for selecting the lawful basis, giving notices and obtaining any permissions needed for their Exercise content and participants.

3. Service providers

We use suppliers to operate SynthSocial and our business. Their terms, security measures and locations may change. The primary service region for customer data in Supabase is the UK. A UK tenant or hosting region does not mean every supplier or support system processes information only in the UK. Where a supplier processes information outside the UK, the relevant transfer safeguards apply.

Vercel provides application hosting and reports server-use metrics. Based on our current configuration, metrics available to us from Vercel are aggregate and do not identify an individual Organiser. Railway does not receive customer data. If our use of these or other providers changes, we will update the applicable notices and DPA information.

We may also disclose information to professional advisers, regulators or authorities where required by law, or to a successor in connection with a business transfer subject to appropriate protections. We do not sell personal information or use it for cross-context behavioural advertising.

4. Retention and deletion

By default, we store customer-provided Exercise data and media while the subscription is active. After access ends, customers have the read-only review period set out in the Terms of Use: normally 90 days for One-Off Use and 30 days for an Annual Subscription, unless the Order Form says otherwise. Customers may ask us to delete their active customer data earlier, including at contract termination. We handle each request individually and will delete the requested data from active Supabase systems within 30 days of a verified request, subject to legal retention requirements and the DPA.

After the review period, content is removed from active systems under our normal deletion cycle unless the customer has asked us in writing to retain it temporarily, for example during a seasonal pause, or the law requires retention. Backup copies may remain until they expire under the provider's configured backup arrangements and are not ordinarily available for use. If data has been sent to OpenAI at an Organiser's direction, retention and available deletion controls depend on the endpoint, settings and OpenAI's terms; we cannot promise immediate deletion from OpenAI systems.

We keep business correspondence and account records for as long as reasonably needed to manage the relationship, provide support, meet legal obligations and handle claims. Invoices are retained for the period required by applicable accounting and tax rules. A request to delete account information can be sent to info@synthsocial.io; deletion may be limited where we must retain particular records by law.

5. Cookies and browser storage

The SynthSocial application uses essential session or authentication storage needed for Organiser sign-in and Exercise access. Those cookies or equivalent browser storage items are required for the service to work and are not used for advertising.

On the public marketing website we also use:

• Preference cookie: a single cookie (ss_cookie_consent) that stores whether you chose Accept or Decline on our cookie banner, so we remember your choice.
• Google Analytics: if you Accept, we load Google Analytics to measure how visitors use the marketing website (for example page views and form conversions). Google Analytics uses its own cookies. We do not load it unless you Accept. If you Decline, we do not load Google Analytics.

You can change your analytics cookie choice at any time via Cookie settings in the website footer. We do not use cookies for cross-context behavioural advertising.

6. Children and Exercise participants

SynthSocial is intended for adult Organisers and is not designed for children to register or operate accounts independently. A customer may choose to include under-18 participants in an Exercise. The customer is responsible for deciding whether that use is appropriate and lawful, providing suitable information and supervision, moderating content to avoid harm, and obtaining parental or guardian consent where required. We process participant information on the customer's instructions where we act as processor.

7. Your rights and contact

If Felsinea is the controller, you may have rights to request access, correction, deletion, restriction or portability, or to object to processing, depending on the circumstances and applicable law. Contact Giulio Benassi at info@synthsocial.io. We handle requests individually and respond within the time required by law, normally one calendar month. If your request concerns Exercise or Player content controlled by a customer, please contact that organisation; we will assist it under the DPA.

You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

8. Changes

We will update this notice when our processing practices materially change and will make the current version available through the SynthSocial website or service.