Privacy Policy

1. Data Controller

The data controller responsible for your personal data is KreatorFlow Ltd (trading as synts.ai), a company registered in England and Wales (Company No. 16420097). Contact: support@synts.ai

2. What Data We Collect

We collect the following categories of personal data:

• Account data: Name, email address, password (hashed), and billing information
• Usage data: Generation history, credit usage, feature interactions, and session logs
• Technical data: IP address, browser type, device information, and cookies
• Generated content: Prompts and AI-generated outputs stored on your account
• Communications: Support tickets, emails, and feedback you send us

3. Legal Basis for Processing

We process your data under the following lawful bases:

• Contract performance: To provide and maintain the Platform services you subscribed to
• Legitimate interests: To improve the Platform, prevent fraud, and ensure security
• Consent: For marketing communications (you may withdraw consent at any time)
• Legal obligation: To comply with applicable laws and regulations

4. How We Use Your Data

Your data is used to: provide and maintain Platform services; process payments and manage subscriptions; send transactional emails (receipts, account alerts); improve Platform performance and features; detect and prevent fraud or abuse; comply with legal obligations; and, where you have consented, send marketing communications.

5. Data Sharing & Third Parties

We share data only with:

• BytePlus (infrastructure partner): Generation prompts are processed through BytePlus ModelArk APIs. BytePlus processes this data as a data processor under our instructions.
• Payment processors: Billing data is handled by our payment provider under their own privacy policy.
• Hosting providers: Platform data is stored on secure cloud infrastructure.

We do not sell your personal data. We do not share your data with advertisers.

6. International Data Transfers

Some data may be transferred internationally (e.g., to BytePlus infrastructure in Asia-Pacific). Where this occurs, we ensure appropriate safeguards are in place, including standard contractual clauses and transfers to jurisdictions with adequate data protection standards.

7. Data Retention

We retain your account data for as long as your account is active. Generated content is retained according to your subscription tier's storage limits. Upon account deletion, personal data is removed within 30 days. Some data may be retained longer where required by law or for legitimate dispute resolution.

8. Your Rights

Under applicable data protection law, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a structured, machine-readable format
• Restrict processing: Limit how we use your data
• Object: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent

To exercise your rights, email support@synts.ai. We will respond within 30 days.

9. Cookies

We use essential cookies for authentication and session management. We use analytics cookies to understand Platform usage (you can opt out). We do not use advertising or tracking cookies. For full details, see our Cookie Policy.

10. Children's Privacy

The Platform is not intended for users under 18. We do not knowingly collect data from children. If we become aware that a user is under 18, we will promptly delete their account and data.

11. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, and regular security assessments. However, no system is 100% secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the Platform. The "Last updated" date at the top indicates the most recent revision.

13. Complaints

If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction, including the Information Commissioner's Office (ICO) at ico.org.uk.