Privacy Policy

• Account: your email address, name and profile picture from sign-up or Google sign-in, and your plan.
• What you make and upload: prompts, images, video, music, stories and edits you create, and files you upload (for example reference photos).
• Billing: your plan, billing period and payment status. Card details are entered with Stripe and never reach us.
• Usage: credits used, which models you run, pages you visit, device and browser type, and IP address, for security, abuse prevention and improving the product.
• Messages: what you send us, such as support requests and credit requests.

• To run the Service: sign you in, run your generations, store your gallery, stories and edits, and keep your canvas in sync across devices.
• To bill paid plans and keep your credit allowance right.
• To keep the Service safe: rate limits, fraud and abuse prevention, and enforcing our terms.
• To understand and improve the product, using usage analytics.
• To answer you, and to send service emails (receipts, important changes). Marketing emails are optional and you can unsubscribe at any time.

We don't sell your personal data, and we don't use your content to train AI models.

When you run a generation, your prompt and any images or files it uses are sent to the model provider that runs that model, and the result is sent back and stored for you. Providers process this to produce the result, under their own terms and privacy policies.

We use these service providers, each only for what's listed:

• Clerk: sign-in and accounts.
• Supabase: our database and file storage (your gallery, stories, edits and music).
• Vercel: hosting the website and app, and cookie-free page-view counts (Vercel Web Analytics).
• Stripe (and Stripe's Link, when it is the reseller): payments, invoices and tax.
• Replicate: running most image, video and music models (including models from Black Forest Labs, Google, ByteDance, Kuaishou and others, and ElevenLabs Music).
• OpenAI: writing stories and enhancing prompts.
• Modal: our own video model and video exports.
• PostHog: product analytics.
• Upstash: rate limiting.
• Resend: sending email.
• Cloudinary: serving the example images on our website.
• Google: sign-in, if you choose it.

We may also disclose data if the law requires it, or to protect people's safety or our rights.

We use cookies and browser storage that the Service needs to work: to keep you signed in (Clerk) and to remember your canvas and layout on your device. We also use product analytics (PostHog) to see how features are used, and Vercel Web Analytics, which counts page views without cookies. We don't use advertising cookies.

• Your account and content: while your account is open. Things you delete leave your gallery straight away and are removed from storage in our regular cleanup.
• When you ask us to close your account, we delete your account data and content within 30 days, except what we must keep by law (for example billing records).
• Backups are kept for a limited time and then overwritten.

Data is encrypted in transit, and access to it is limited to the systems that need it. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.

Wherever you live, you can ask us to:

• give you a copy of your personal data, in a portable format;
• correct it;
• delete it, along with your account and content;
• stop using it for analytics or marketing.

Write to support@synthemo.com from your account's email address. We answer within 30 days. We won't treat you differently for using these rights.

California: you have these rights under the CCPA/CPRA. We don't sell or share personal information for cross-context behavioral advertising.

EU, EEA and UK: we process your data to perform our contract with you (running the Service and billing), on our legitimate interests (security, abuse prevention and improving the product), and with your consent where we ask for it (for example marketing email), which you can withdraw at any time. You also have the rights to object and to restrict processing, and to complain to your data protection authority. Your data is processed in the United States; where that requires safeguards, our providers use the European Commission's standard contractual clauses or an equivalent mechanism.

The Service isn't for children under 13, and we don't knowingly collect their data. If you believe a child under 13 has given us personal data, write to support@synthemo.com and we'll delete it.

We'll update this policy as the Service changes and show the date at the top. If a change matters, we'll tell you by email or in the app.

Privacy questions and requests: support@synthemo.com.