Appearance
Privacy Policy
Last Updated: October 12, 2026
Synthetic Users prioritizes privacy with regards to handling your personal data, which includes identifying information like your name, credit card details, and contact info, or data that can be linked to these to identify you either directly or indirectly.
We may update this privacy notice and notify you of significant changes. To exercise your data rights or for questions, contact us at support@syntheticusers.com.
Who we are
Synthetic Users, Inc. (4223 Glencoe Ave, Suite C215-523, Marina del Rey CA 90292) is the controller for personal data collected on our website, and for account, billing and usage data about the people who use our platform. If you are in the EU or UK, we either operate through our local establishment or, where required, have appointed an EU representative and UK representative (see "How to contact us").
This notice covers our website (www.syntheticusers.com) and our platform. The platform means the Synthetic Users app at app.syntheticusers.com, our API, and our connectors for AI assistants such as ChatGPT and Claude (together, the Platform).
For the content customers put into the Platform and the results it produces (Customer Content), we act as a processor for the organization that subscribes (the Customer), under our Data Processing Addendum. The Customer is the controller of any personal data in its workspaces. If a workspace holds personal data about you, contact that organization first. We'll help them respond.
What we collect
On our website
- Contact details you submit (name, work email, company, message).
- Marketing preferences and newsletter sign-ups.
- Recruitment data you provide (CV, profile, assessments).
- Prospecting data from public professional sources such as LinkedIn (where lawful).
- Device and usage data from your browser (IP address, approximate location, pages viewed, timestamps, diagnostics).
- Cookies and analytics identifiers (see Cookies section)
On the Platform
- Account and workspace data:
- your name and work email, from your sign-in through Google Firebase
- the workspaces and projects you belong to, your roles, and invitations
- Billing data: your organization's plan and usage, such as the interviews it has run and the credits it has used, and its billing email. We handle billing ourselves; card payments are processed by Stripe, and we don't store card numbers.
- Customer Content:
- what you enter or upload: research goals, study setups and questions, audience descriptions, concepts, images, videos, documents and context files
- the websites you test and, for user tests set up in the web app, any sign-in details you save for them
- what the Platform produces from all this: synthetic users (AI-generated profiles of fictional people), interview transcripts, recordings and screenshots of user tests, insights, summaries, reports and exports
- Usage and log data:
- IP address, browser and device information, and the time of each request
- the pages, features and API endpoints you use, errors, and diagnostics, linked to your user ID, name and email for product analytics and feature flags
- Connector data: see "Using Synthetic Users from ChatGPT or Claude" below.
We don't collect payment card details, government identifiers or health information; card payments go through Stripe. Our Terms of Service ask Customers to avoid putting sensitive personal data into the Platform.
We use your personal data for the following purposes, relying on the lawful bases listed in brackets:
- To respond to inquiries, demo requests, or support messages (based on contract or legitimate interests).
- To send marketing communications and updates about our products and services (based on consent in the EU/UK or soft opt-in where permitted; you can opt out at any time).
- To identify and contact potential business customers using public professional information such as LinkedIn (based on legitimate interests; you can opt out at any time).
- To manage recruitment and hiring, including reviewing applications and conducting interviews (based on steps to enter a contract and legal obligations).
- To maintain and secure our website and the Platform, prevent fraud, and analyse usage for service improvement (based on legitimate interests).
- To provide the Platform: run studies, generate synthetic users and interviews, analyse uploaded files, and produce reports and exports (based on contract; for Customer Content, on the Customer's instructions as its processor).
- To carry out requests from AI assistants you connect in the workspace you chose, and send them the results they request (based on contract).
- To create and secure accounts: authenticate you and enforce workspace and project permissions (based on contract and legitimate interests).
- To measure usage and bill your organization, including the credits interviews use (based on contract and legal obligations).
- To send service messages, such as a notice that a study or report is ready (based on contract or legitimate interests).
- To comply with law and enforce our terms (based on legal obligations and legitimate interests).
We do not use Customer Content to train AI models. Our AI subprocessors may use it only to provide the Platform, under agreements that prohibit them from training their models on it.
Cookies and analytics
We use strictly necessary cookies and, with your consent where required, analytics and advertising cookies or pixels that may share limited data with analytics or ad partners.
Manage choices via our cookie banner or browser settings. See our Cookie Policy for full details.
On the Platform, we use strictly necessary cookies and similar storage to keep you signed in and secure, and analytics to understand how the Platform is used.
Using Synthetic Users from ChatGPT or Claude
You can connect your Synthetic Users account to AI assistants such as ChatGPT (from OpenAI) and Claude (from Anthropic). We call these connected apps. You choose to connect them. They aren't our service providers: they act for you, under their own terms.
How connecting works. You start the connection in the app, sign in to Synthetic Users, and choose one workspace. The app can then act in that workspace, in the projects you belong to, with your permissions there. It can:
- read projects, audiences, studies, synthetic users, files, interview transcripts, insights and reports
- create projects
- create, edit and delete audiences and research goals
- create and edit studies, and add files to them or remove files from them
- generate synthetic users
- ask follow-up questions of completed interviews and user tests, summaries and reports
- upload files
- create summaries, reports and exports
It can't reach other workspaces.
What we receive.
- Tool calls. The requests the app sends to our connector, with the details it includes, such as a study setup, interview questions or an audience description. The app writes these from your conversation, so they can include text you typed or pasted.
- Files.
- Files you upload through our panels or our upload page.
- In ChatGPT, if you attach a file and ask for it to be used, ChatGPT gives our server a short-lived link. We download the file directly, over HTTPS, only from ChatGPT's file hosts (oaiusercontent.com, openai.com and chatgpt.com).
- A connection record. It identifies you, your chosen workspace and the app, and records when the connection was made, when it expires and when it was last used.
- Technical data. For example, IP addresses and the time of each request. ChatGPT also sends an identifier for the conversation. We keep only a scrambled (hashed) form of it, briefly, to avoid showing the same progress card twice.
We don't receive your conversation with the app, its memory, or files you share with it, except a file the app passes to us as described above.
What the app receives.
- The data it requests while carrying out your requests: for example project and study names, study setups, synthetic user profiles, interview transcripts, findings, report content and download links.
- OpenAI and Anthropic handle this data under their own terms and privacy policies. We don't control what they keep.
Interviews and credits.
- Interviews use your workspace's credits.
- They start only when you click Confirm and run in our confirmation card, or on the confirmation page it links to while you're signed in to Synthetic Users. The card shows the participants and the maximum credits.
Keeping and ending a connection.
- Access tokens last 1 hour. Refresh tokens last 30 days and renew each time the app uses one, so a connection stays active until you end it or it goes 30 days unused.
- We store these tokens only in hashed form, and we delete expired or revoked ones within about an hour.
- A connection also stops working if you leave the workspace or the workspace is deleted.
- To disconnect, open Settings → Connect to MCP in Synthetic Users and, under Connected apps, disconnect the app. Its access stops at once.
- Removing the connector in ChatGPT or Claude stops the app from using it, but may not tell us. The connection then expires after 30 days unused.
- What disconnecting doesn't do:
- It doesn't delete anything created through the connection.
- It doesn't stop interviews already running.
- It doesn't affect data already sent to the app.
- Download links already issued keep working until they expire, within 24 hours.
Sharing your data
We share your data with trusted service providers (hosting, authentication, analytics, email, AI processing, monitoring, customer support, recruiting, advisors) who act under written contracts, access only what is needed, and are bound by confidentiality and security obligations. The providers that process Platform data are listed on our Subprocessors page. We notify Customers before engaging a new one, as our DPA requires.
On the Platform, we also share data:
- With AI subprocessors. We send study inputs to AI model providers to generate synthetic users, interviews, analysis and reports. Study inputs include study setups, audience descriptions, uploaded files and images, interview content, and the sign-in details of websites you test.
- With connected apps you choose, such as ChatGPT or Claude. We send them the results they request for you.
- With members of your workspace, who can see Customer Content according to their roles.
- With websites you test. In a user-testing study, our browser visits the website you name and interacts with it, using any sign-in details you saved.
We may disclose data when required by law, to protect rights, in corporate transactions, or with your consent.
Data storage and international transfers
We store all sensitive customer data in the client's own region to ensure compliance with local data residency requirements. Customer data is stored within the same geographic region as your organization (e.g., EU data in EU, US data in US, UK data in UK, Canadian data in Canada).
In limited circumstances, certain data may be transferred outside your region for specific service functions:
- Account holder information (names and emails of platform users) may be processed by HubSpot, which operates from the US.
- User inputs that form part of study generation may be securely transmitted to our AI subprocessors (OpenAI, Anthropic, Google, Meta, and Mistral) in the US for AI processing.
- IP addresses, diagnostic data and traces of AI processing may be transmitted to our logging and monitoring systems located in the US for security and monitoring purposes.
- Results you request through a connected app are sent to its provider (OpenAI or Anthropic), which may process them in the US or elsewhere under its own terms.
When such transfers occur, we use approved safeguards such as the EU Standard Contractual Clauses and UK Addendum, along with supplementary measures. Details available on request.
Retention
Website
- Marketing contacts: 24 months from last interaction or until opt-out.
- Inquiry forms: 12 months from resolution.
- Prospecting records: 12 months from last outreach or opt-out.
- Recruitment data: 12 months from decision unless hired.
- Logs and diagnostics: up to 12 months, unless required longer for security or legal reasons.
Platform
- Customer Content:
- Kept for the term of the Customer's agreement, or until the Customer asks us to delete it.
- When you delete an item, it's removed from your workspace.
- We complete deletion requests within 30 days, and deleted data leaves our backups within 90 days.
- Embeddings of context files are deleted within 30 days after the Customer's contract ends.
- Account data: kept while your account exists, and deleted when you ask us to delete your account.
- Connected apps:
- Access tokens expire after 1 hour, and refresh tokens after 30 days unused.
- Expired and revoked tokens are deleted within about an hour.
- Pending connection requests expire after 30 minutes, authorization codes after 10 minutes, and interview confirmations after 30 minutes.
- Links: upload links expire after 15 minutes, and download links after 24 hours.
- Billing records: kept as long as tax and accounting law requires.
Your rights
EU/UK: You can access, correct, delete, restrict, or object to processing (including marketing), request portability, and complain to your local authority. We respond within one month.
California: You can know, correct, delete, opt-out of sale/share, and limit use of sensitive data. We respond within 45 days.
We do not sell your data for money. If we use advertising cookies, that may count as "sharing" under California law—you can opt out via the Do Not Sell or Share My Personal Information link or your cookie settings.
Where we hold your data as a processor for your organization, we'll refer your request to it or help it respond.
On the Platform you can also:
- edit or delete projects, studies, audiences and files
- disconnect connected apps in Settings → Connect to MCP → Connected apps
- ask us to delete your account and the data it owns
We acknowledge deletion requests within 5 business days and complete them within 30 days.
Security
We apply technical and organizational measures appropriate to risk, including encryption in transit, access controls, vendor due diligence, and incident response.
On the Platform:
- Data is also encrypted at rest.
- Connected apps sign in with OAuth 2.1 and PKCE, and each connection is limited to one workspace.
- We store access and refresh tokens only in hashed form.
- Upload links accept a single file and expire after 15 minutes, and interview confirmations can be used once.
Our SOC 2 Type 2 report covers Security, Availability and Confidentiality for 24 June 2024 to 15 May 2025.
To report a security vulnerability, email support@syntheticusers.com.
Synthetic users
Synthetic users are AI simulations, not people. Their profiles and answers are generated and don't describe any real person.
If you put information about real people into the Platform, such as transcripts of your own customer interviews, you're responsible for having the right to do so.
Children
Our website is not directed to children. We do not knowingly collect data from individuals under 16 (or 13 in the US). The Platform is for business use: you must be at least 18 to use it (see our Acceptable Use Policy). Contact us if a minor's data has been submitted.
How to contact us
- Email: support@syntheticusers.com
We may update this notice from time to time. The latest version will always be dated 12 October 2026 unless superseded by a newer update.