Privacy, in plain language

This policy applies to the Synlecto web app and the Study Companion browser experience.

Synlecto is the data controller for account and product usage data.

If you use Synlecto through a campus program, your institution may also act as a controller for their admin reporting.

This page is a plain-language summary. Contact us if you need a formal copy for your records.

Account data: email address, auth provider identifiers, and optional profile fields you choose to add.

Study data: guide metadata, study activity, preferences, and sync status.

Extension usage data: video titles, URLs, and transcript or caption text from supported pages when you generate a guide (processed transiently; not stored as raw transcripts).

Billing data: subscription status and Stripe customer IDs. Payment card details are handled by Stripe.

Technical data: device identifiers, IP address, browser signals, and diagnostic logs for security and support.

Provide the service, sync data, and deliver support (contract).

Secure and improve reliability (legitimate interests).

Process payments and meet tax or accounting obligations (legal obligation).

Send product updates or optional analytics only when you opt in (consent). You can opt out at any time.

We do not use automated decision making that produces legal effects.

We use essential cookies to keep you signed in, protect sessions, and remember preferences.

Optional product analytics and marketing cookies are used only when you opt in.

You can clear cookies in your browser settings, but some features may not work without them.

Raw transcript storage: 0 days. We do not persist transcript text after generation.

AI processing: transcripts are sent only to generate guides. Outputs are stored as guides and study materials.

Logs and error tooling (Sentry): redacted to avoid transcript or student content. We record operational metadata only.

Model training: we do not train models on user content, transcripts, or derived study outputs.

Hosting and storage providers (e.g., Vercel and Supabase).

Payments and subscription management (Stripe).

AI processing providers used to generate guides (e.g., OpenAI).

Error monitoring for reliability (Sentry).

We share the minimum data needed to deliver the service and use data processing agreements where required.

A list of subprocessors is available on request.

Some providers process data outside the UK or EEA. This may include the United States.

Where required, we rely on Standard Contractual Clauses and the UK International Data Transfer Addendum.

You can request more details through support.

Local data remains on your device until you delete it.

Account data is retained while your account is active.

Billing records are retained for statutory accounting periods.

Security logs are retained for limited periods to protect the service.

GDPR rights include access, correction, deletion, restriction, portability, and objection.

You can withdraw consent at any time for optional marketing or analytics.

You have the right to lodge a complaint with the ICO (UK) or your local supervisory authority (EU).

To exercise rights, contact support through Help & feedback. We may ask you to verify your identity.

Encryption in transit and strict access controls protect your data.

We monitor for abuse and unusual activity.

No method of transmission or storage is 100 percent secure.

Synlecto is not directed to children under 13.

If you are under 16, you should have parent or guardian permission where required by local law.

We may update this policy from time to time. Material changes will be shared in-app or by email.

For privacy questions or deletion requests, contact the Synlecto team at hello@synlecto.com or through Help & feedback.