Privacy Policy

Synthax, Inc. ("Synthax," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at synthos.tech or use our AI-powered code generation platform (collectively, the "Services"). Synthax is headquartered at 535 Mission Street, Suite 1400, San Francisco, CA 94105, United States.

Please read this Privacy Policy carefully. If you disagree with its terms, please discontinue use of the Services. By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy.

1. Information We Collect

1.1 Information You Provide Directly

We collect information you voluntarily provide when you register for an account, subscribe to a plan, contact our support team, or otherwise communicate with us. This information may include:

• Account information: Full name, email address, username, and password when you create a Synthax account.
• Billing information: Credit card numbers, billing address, and payment details, which are processed through our third-party payment processor (Stripe, Inc.) and are not stored directly on our servers.
• Profile information: Job title, company name, team size, and programming language preferences that you choose to provide to personalize your experience.
• Communications: Messages you send us through our contact form, support tickets, or email correspondence, including any attachments or code samples you voluntarily share.
• Survey responses: Feedback, satisfaction ratings, and other responses to surveys or questionnaires we conduct for product improvement purposes.

1.2 Information Collected Automatically

When you access or use the Services, we automatically collect certain information about your device and usage patterns, including:

• Log data: IP address, browser type and version, operating system, referring URLs, pages viewed, links clicked, and the date and time of your visit.
• Device information: Hardware model, operating system version, unique device identifiers, and mobile network information where applicable.
• Usage data: Features you interact with, queries submitted to our AI systems (where not excluded by your settings), error logs, and performance metrics.
• Cookies and tracking technologies: Information collected through cookies, web beacons, pixel tags, and similar technologies. Please see Section 6 below and our Cookie Policy for more details.

1.3 Code and Development Context Data

Our core platform functionality involves processing code and development context to provide AI-assisted completions, reviews, and test generation. We handle this data as follows:

• Code snippets: Code submitted to our completion and review APIs is processed in real time to generate AI responses and is not retained by default beyond the current session.
• Codebase indexing: For customers who enable codebase indexing, we store vector embeddings and structural representations of your code to power retrieval-augmented generation. Raw source code is not stored; only mathematical representations derived from it are retained.
• Enterprise private deployment: Enterprise customers with private cloud deployment options retain their code entirely within their own infrastructure. No code data is transmitted to Synthax servers in this configuration.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing and Improving Our Services

• To create and manage your account and deliver the platform features you have subscribed to.
• To process payments, send invoices, and manage billing relationships.
• To personalize your experience, including applying your language and framework preferences to AI suggestions.
• To monitor and improve the performance, security, and reliability of our infrastructure.
• To train and improve our AI models, using anonymized and aggregated data where applicable, subject to the opt-out controls described in Section 8.
• To develop new features, products, and services based on usage patterns and customer feedback.

2.2 Communications

• To send transactional emails including account confirmations, password resets, and billing receipts.
• To send product updates, feature announcements, and technical notifications related to the Services you use.
• To send marketing communications about Synthax products and services, where you have given consent or where we have a legitimate interest and you have not opted out.
• To respond to your customer support requests and inquiries in a timely manner.

2.3 Legal and Compliance Purposes

• To comply with applicable laws, regulations, legal processes, and governmental requests.
• To enforce our Terms of Service and other agreements.
• To detect, investigate, and prevent fraudulent activity, unauthorized access, and other misuse of the Services.
• To protect the rights, property, and safety of Synthax, our users, and the public.

3. How We Share Your Information

We do not sell your personal information to third parties. We may share your information in the following limited circumstances:

3.1 Service Providers

We engage third-party service providers who process data on our behalf to support our operations. These providers are contractually bound to use your data only as directed by us and in accordance with this Privacy Policy. Our current categories of service providers include:

• Cloud infrastructure: Amazon Web Services (AWS) and Google Cloud Platform for hosting and computing infrastructure.
• Payment processing: Stripe, Inc. for secure payment card processing.
• Customer support: Intercom, Inc. for customer support chat and ticketing systems.
• Analytics: Amplitude, Inc. for product analytics and usage metrics.
• Email delivery: SendGrid (Twilio) for transactional and marketing email delivery.

3.2 Business Transfers

In the event of a merger, acquisition, sale of assets, financing, or reorganization involving Synthax, your information may be transferred to the acquiring entity as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

3.3 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a governmental request.

3.4 Consent

We may share your information with third parties in any other manner with your prior consent or at your direction.

4. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. The retention periods we apply are:

• Account data: Retained for the duration of your account and for 90 days following account deletion, after which it is permanently deleted from our systems.
• Usage logs: Retained for 12 months for security, debugging, and service improvement purposes, then automatically purged.
• Billing records: Retained for 7 years to comply with financial regulations and tax requirements.
• Support communications: Retained for 3 years to support quality assurance and dispute resolution.
• Codebase embeddings: Deleted within 30 days of account termination or upon request.
• Anonymized aggregated analytics: May be retained indefinitely for statistical and research purposes.

You may request deletion of your personal data at any time as described in Section 7. We will honor deletion requests within 30 days, subject to legal retention obligations.

5. Data Security

We implement appropriate technical and organizational security measures designed to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Our security measures include:

• Encryption of data in transit using TLS 1.2 or higher on all connections to our Services.
• Encryption of data at rest using AES-256 encryption for all stored customer data.
• Access controls limiting employee access to customer data on a need-to-know basis, with audit logging of all access.
• Regular security assessments including third-party penetration testing at least annually.
• SOC 2 Type II certification covering our security, availability, and confidentiality controls.
• Incident response procedures and breach notification processes compliant with applicable regulations.

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our Services. Please refer to our Cookie Policy for a detailed description of the types of cookies we use, their purpose, and your options for controlling them.

In summary, we use the following categories of cookies:

• Strictly necessary cookies: Required for the Services to function. These cannot be disabled.
• Analytics cookies: Help us understand how users interact with our website. May be disabled via cookie preference settings.
• Functional cookies: Remember your preferences (such as theme and language settings). May be disabled but will reduce functionality.
• Marketing cookies: Used to deliver relevant advertising. Disabled by default; enabled only with your explicit consent.

7. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

7.1 Access and Portability

You have the right to request access to the personal information we hold about you and to receive it in a portable, machine-readable format. You can access much of your account data directly through your account settings. For additional data access requests, contact us at privacy@synthos.tech.

7.2 Correction

You have the right to request correction of inaccurate or incomplete personal information we hold about you. You can update most account information directly in your account settings. Contact us to correct information you cannot update yourself.

7.3 Deletion

You have the right to request deletion of your personal information. You may delete your account through your account settings, which will initiate our deletion process. We will complete deletion within 30 days, retaining only data we are legally required to retain.

7.4 Opt-Out of AI Training

You may opt out of having your usage data used to train or improve our AI models by adjusting the relevant setting in your account privacy preferences. Opting out will not affect the quality of AI suggestions you receive.

7.5 Marketing Communications

You may opt out of receiving marketing emails from us by clicking the unsubscribe link in any marketing email, or by contacting us at privacy@synthos.tech. Transactional emails related to your account cannot be opted out of.

7.6 California Residents

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know about the categories of personal information collected, the right to opt out of sale or sharing of personal information (we do not sell personal information), and the right to non-discrimination for exercising privacy rights. To exercise these rights, contact us at privacy@synthos.tech.

7.7 European Residents

Residents of the European Economic Area (EEA) and United Kingdom have rights under the General Data Protection Regulation (GDPR) and UK GDPR, including the right to object to processing, the right to restrict processing, and the right to lodge a complaint with a supervisory authority. Our legal bases for processing include contract performance, legitimate interests, legal obligation, and consent. To exercise GDPR rights, contact our Data Protection Officer at dpo@synthos.tech.

8. International Data Transfers

Synthax is headquartered in the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from the laws of your country.

For transfers from the EEA, UK, or Switzerland to the United States, we rely on Standard Contractual Clauses approved by the European Commission, Data Privacy Framework certifications where applicable, and other lawful transfer mechanisms. By using our Services, you consent to the transfer of your information to the United States and other countries.

9. Children's Privacy

Our Services are not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to remove that information from our servers promptly. If you believe we may have collected information from a child under 16, please contact us at privacy@synthos.tech.

10. Third-Party Links and Services

Our Services may contain links to third-party websites, applications, and services. This Privacy Policy applies only to Synthax's Services and does not extend to third-party sites or services. We encourage you to review the privacy policies of any third-party sites or services you visit through links from our Services.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will provide notice through the Services (such as a prominent notice on our website) and, where appropriate, by email to the address associated with your account. The date of the most recent revision appears at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Synthax, Inc.
Attn: Privacy Team
535 Mission Street, Suite 1400
San Francisco, CA 94105
United States

Email: privacy@synthos.tech

For EU/UK GDPR inquiries: dpo@synthos.tech

We will respond to all privacy inquiries within 30 days of receipt. For complaints that cannot be resolved directly with us, you may contact the relevant supervisory authority in your jurisdiction.