Privacy Policy

Introduction

Synthetic White AI Studio AB ("Synthetic White", "we", "our", "us") provides an advanced AI platform enabling companies to create images, videos, and customizable AI powered workflows. We are committed to safeguarding your privacy and ensuring transparency regarding how we collect, process, and store personal data. This Privacy Policy outlines our practices in compliance with applicable laws including the EU General Data Protection Regulation (GDPR).

Our role

Synthetic White acts as an independent data controller for account and contact data of users, log data, cookie data and billing data. This Privacy Policy describes that processing. Synthetic White acts as a data processor for personal data contained in content uploaded to the Platform by business customers and in content generated from it. For that processing the business customer is the data controller and our Data Processing Agreement (commercial.syntheticwhite.com/legal/dpa) applies.

Company information

Definitions

• Platform refers to all digital tools, interfaces, APIs, workflows, and services provided by Synthetic White.
• User refers to any individual or entity accessing or using the Platform.
• Content refers to any material uploaded, generated, created, or submitted through the Platform.

Data we collect

Information you provide

• Account registration details including name, company name, email, authentication credentials.
• Communication content such as support emails or feedback messages.
• Billing details, including company name, address, organisation number, VAT number and billing contact. Payment card details are processed directly by our payment processor and are not stored by us.

Automatically collected data

• IP address, device identifiers, browser information, and operating system.
• Log files including timestamps, feature usage, system interactions, and diagnostic information.
• Cookies and tracking technologies for security, analytics, and platform optimization. On our website we use Google Analytics and Google Tag Manager. Non-essential cookies are only used with your consent, which you can manage in the cookie settings.

Third party integrations

If you connect third party accounts or services, we may receive information such as:

• API tokens
• User identifiers
• Data relevant to executing workflows

Synthetic White does not control third party data policies. You are responsible for reviewing those policies.

Customer content

Content uploaded to the Platform by a business customer or its users (images, videos, prompts, text input and workflow data) is processed by Synthetic White on behalf of that customer, in the role of data processor. The business customer is the data controller for that content and determines why and how it is processed. This processing is governed by our Data Processing Agreement and not by this Privacy Policy. If you are an individual whose personal data appears in such content, please contact the business customer that uploaded it. We will forward any request we receive directly to them.

How we use data

We process data strictly for the following purposes:

• Delivering, maintaining, and improving the Platform.
• Authenticating and securing user accounts.
• Customizing user experience and workflow preferences.
• Debugging, optimizing, and monitoring platform performance.
• Communicating service updates, billing information, and security notices.
• Meeting legal, regulatory, or contractual obligations.

We do not use customer content to train, fine tune or otherwise adapt our own or any third party models without the business customer's prior written consent. Content stored in the Platform's brand reference library is retained as stored input and applied as constraints when content is generated. It does not form part of any model, and it is deleted when the customer's content is deleted.

Legal basis for processing (GDPR)

We rely on one or more of the following under Article 6(1) of the GDPR:

• Providing, maintaining and improving the Platform, and administering business customers' accounts and users: legitimate interest in performing our agreement with the business customer that the user represents.
• Authenticating and securing accounts, debugging and monitoring performance: legitimate interest in a secure and functional service.
• Customising user experience and workflow preferences: legitimate interest in providing a useful service.
• Service updates, billing information and security notices: legitimate interest in communicating with our customers.
• Invoicing and bookkeeping: legal obligation under the Swedish Bookkeeping Act.
• Analytics and optimisation cookies: consent.
• Establishing, exercising or defending legal claims: legitimate interest.

Data ownership and rights

Customer content

Synthetic White does not claim ownership of content uploaded to or generated through the Platform. Rights in such content are governed by the AI Studio Terms of Service.

Your rights

Under GDPR, you have the right to:

• Access your personal data
• Request correction or deletion
• Request data portability
• Object to or restrict processing
• Withdraw consent at any time

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You also have the right to lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se.

Requests concerning personal data for which we are the controller may be sent to privacy@syntheticwhite.com. If your request concerns content uploaded to the Platform by a business customer, we act only as a processor. We will forward your request to that customer without undue delay, and they are responsible for responding to it.

Your right to object

Where we process your personal data on the basis of our legitimate interests, you have the right to object at any time on grounds relating to your particular situation. We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Mandatory information and automated decisions

Account and billing details are required to enter into and perform the agreement with the business customer. Without them we cannot provide access to the Platform. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Data retention

Account data is retained for the duration of the customer relationship and deleted within three (3) months after it ends. Billing data and accounting records are retained until the end of the seventh year after the calendar year in which the relevant financial year ended, as required by the Swedish Bookkeeping Act. Support communications are retained for twenty-four (24) months.

Analytics cookies (Google Analytics) are stored on your device for up to two (2) years following consent. Cookie consent preferences and persistent visitor identifiers are retained for thirteen (13) months. Web server log files (IP addresses) are deleted after thirty (30) days; remaining diagnostic logs are anonymised after thirteen (13) months and retained as statistical data.

Data sharing and transfers

We may share information only with:

• Service providers under confidentiality agreements, including Stripe and Zoho Billing (payments and billing) and Google Workspace (email)
• Cloud hosting, analytics, or processing partners
• Legal authorities when required by law

Your data may be transferred internationally. Where personal data is transferred outside the EU or EEA, the transfer is made under an appropriate mechanism under Chapter V of the GDPR, including an adequacy decision or the European Commission's Standard Contractual Clauses together with any supplementary measures required.

A copy of the Standard Contractual Clauses relied upon may be requested at privacy@syntheticwhite.com.

Security measures

We use industry standard encryption, access controls, monitoring, and secure hosting environments. No system is completely secure.

If a personal data breach occurs affecting personal data for which we are the controller, we notify the competent supervisory authority and, where required by law, the affected individuals without undue delay. Where we act as a processor, we notify the business customer in accordance with our Data Processing Agreement.

Children's data

The Platform is intended for business use. We do not knowingly collect information from children under 16.

Our website

This section adds what is specific to syntheticwhite.com.

Demo and contact requests

When you request a demo or contact us we collect your name, work email, company and anything you write in the form, and the meeting you book. We use it to reply to you and to prepare the conversation. We don't add you to marketing lists without asking. Requests are kept while we are in contact with you and for up to twenty-four (24) months after the last contact.

Our visit log

Our own visit log records each page you view, how long it is on your screen and how far down you scroll, what you click, when, the site or tagged campaign link that sent you, your approximate location (city, region and country, worked out from your connection, not GPS), the network your connection comes from, your IP address, and your device type, operating system, browser, screen size and language. It sets no cookies. When we review a visit we may also look up the public host name registered for its IP address. We use it to understand which pages and which organisations are interested in our services and to keep the site secure, on the basis of our legitimate interest, and you can object to it at privacy@syntheticwhite.com.

We may look at one visitor's visits together, as a single journey through the site: visits from the same remembered browser (only if you accept analytics), or from the same connection and the same kind of device while its IP address is kept. If you send us a form, we link it to the pages you viewed and to your earlier and later visits linked in the same way, so we can prepare for the conversation. IP addresses are deleted after thirty (30) days, and after thirteen (13) months each visit is anonymised and kept only as statistics.

Cookies on our website

Google Analytics sets its cookies (_ga and _ga_ followed by an ID) only if you accept them in the cookie card; they last up to two (2) years. If you accept, our visit log also remembers your browser with a random ID so we can see when you come back. Your choice is kept for thirteen (13) months and then we ask again; you can change it at any time with Cookie settings at the bottom of every page, and saying no removes Google's cookies and the returning-browser ID. Our own visit log otherwise uses a random ID that lasts only while the tab is open, and the site remembers your light or dark theme in your browser.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Each version is identified by a version number and an effective date, and superseded versions are available on request. This Privacy Policy describes our own processing as a data controller. It does not amend the AI Studio Terms of Service or the Data Processing Agreement, which are updated in accordance with their own terms.