1. Who we are
Synthesise AI is operated by Harry Needham Ltd ("we", "us", "our"), a company registered in England and Wales.
Registered address: Tyttenhanger House, Coursers Road, Colney Heath, St Albans, Hertfordshire, AL4 0PG
Contact for privacy matters: harry@harryneedham.com
We are the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO), registration number ZB240404.
2. What this policy covers
This policy explains what personal data we collect when you use the Synthesise AI platform, why we collect it, who we share it with, and what rights you have.
This includes the marketing emails we send you, if you have consented to receive them. It does not cover our public marketing website, nor any third-party site we link to.
3. What data we collect
Account data
- Your name and email address
- Your password (stored only as a secure cryptographic hash — we never see or store your actual password)
- Your access tier (basic or pro)
- Your profile details, such as business name, avatar, Instagram handle, or website, if you provide them
Business Brain and platform content
Information you enter or upload about your business, including:
- Your offer, pricing, and delivery
- Your audience, messaging, and positioning
- Your brand voice, stories, and frameworks
- Your goals and revenue figures
- Client wins and results you record
- Files you upload (documents, offer docs, transcripts)
Onboarding and check-in responses
Your answers to onboarding questions, monthly Signal reports, 30-Day Plan requests, and check-ins. This includes questions about your business situation, capacity, working style, and life context.
Please note: one onboarding question asks whether there is anything important we should factor in, giving examples such as a new baby, burnout, or a health challenge. If you choose to share information about your health or other sensitive matters, this is special category data under UK GDPR. You are never required to provide it. Where you do, we process it on the basis of your explicit consent, given by voluntarily entering it, and solely to adapt the platform's guidance to your circumstances. You may withdraw that consent and ask us to delete it at any time.
Conversations and outputs
- Your conversations with the AI tools on the platform
- Outputs you save to your Asset Library
- Content, campaigns, notes, and calendar entries you create
Usage data
- Which tools you use and how often
- Login times and session information
- Roadmap progress and completion
Voice recordings
If you use voice input, your audio is transcribed to text. The audio is processed transiently and is not retained by us after transcription.
What we do not collect
- Payment card details. All payments are handled outside the platform by third-party payment providers (such as Stripe or ThriveCart). We never see, receive, or store your card details.
- We do not use analytics, tracking pixels, or advertising cookies.
4. Why we process your data, and our legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Creating and managing your account, providing the platform | Performance of a contract (Art. 6(1)(b)) |
| Personalising AI outputs using your Business Brain and profile | Performance of a contract (Art. 6(1)(b)) |
| Adapting guidance to sensitive information you voluntarily share (e.g. health, capacity) | Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
| Keeping the platform secure, preventing misuse and fraud | Legitimate interests (Art. 6(1)(f)) |
| Improving and troubleshooting the platform | Legitimate interests (Art. 6(1)(f)) |
| Sending you service and account emails (password resets, account notices) | Performance of a contract (Art. 6(1)(b)) |
| Sending you marketing emails | Consent (Art. 6(1)(a)), which you may withdraw at any time |
| Keeping business and accounting records | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have considered your rights and freedoms and concluded that our interests do not override them. You may object to this processing at any time.
5. AI processing
The platform uses large language models to generate outputs from your Business Brain and the information you provide.
- Your conversations and Business Brain content are sent to our AI providers (listed below) to generate responses.
- Our AI providers do not use your data to train their models. This is contractually established through our commercial API agreements with them.
- AI-generated outputs are suggestions, not professional advice. See our Terms of Service.
6. Who we share your data with
We share your data only with the service providers ("sub-processors") we use to run the platform. Each is bound by a data processing agreement and may only process your data on our instructions.
| Sub-processor | What they do | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | Data hosted in the EU/UK region; company based in the USA |
| Vercel | Application hosting | USA |
| Anthropic | AI processing (Claude) | USA |
| OpenAI | AI processing and voice transcription | USA |
| Resend | Transactional emails (password resets, account notices) | USA |
| Kit (formerly ConvertKit) | Marketing emails, if you have consented | USA |
We may also disclose your data where required by law, or to establish, exercise, or defend legal claims.
We never sell your data. We never share it with advertisers.
7. International transfers
Some of our sub-processors are based in the United States. Where your personal data is transferred outside the UK, we rely on appropriate safeguards, specifically the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, incorporated into our agreements with each provider.
You may request a copy of the relevant safeguards by contacting us.
8. Information about your own clients
If you enter information about your clients into the platform — for example, client names, results, testimonials, or copies of conversations — you are the data controller for that information, and we act as your data processor.
You are responsible for having a lawful basis to share that information with us, and for informing your clients as required. We will process it only to provide the platform to you, and on the terms of our Data Processing Agreement, which sets out our obligations as your processor.
Wherever possible, we ask that you anonymise client information. You rarely need a real name for the platform to be useful.
9. How long we keep your data
- While your account is active: for as long as you use the platform.
- After your account ends: we retain your account data, Business Brain, conversations and outputs for 90 days, so you can request an export or reinstate your account. After 90 days, it is permanently deleted.
- Records we must keep by law: the platform does not process your payment or accounting data (that is handled by our external payment providers). Where we are legally required to retain records that include your personal data — for example, to meet tax or company-law obligations — we keep those for up to 6 years.
- Marketing consent records: retained until you withdraw consent, and for a reasonable period afterwards to evidence that withdrawal.
You may request earlier deletion at any time (see your rights below).
10. How we protect your data
- All data is encrypted in transit (TLS) and at rest.
- Row-level security is enforced at the database level, meaning no user can access another user's data.
- Passwords are stored only as secure hashes.
- Access to production data is restricted and logged.
- Public sign-up is disabled; accounts are created individually.
No system is perfectly secure, but we take these measures seriously and review them regularly.
11. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten")
- Restrict how we process your data
- Portability — receive your data in a structured, machine-readable format
- Object to processing based on our legitimate interests
- Withdraw consent at any time, where we rely on consent
To exercise any of these rights, email harry@harryneedham.com. We will respond within one month.
If you are unhappy with how we have handled your data, you may complain to the Information Commissioner's Office at ico.org.uk, or call 0303 123 1113.
12. Cookies
We use strictly necessary cookies, which keep you logged in and maintain your session, plus one functional cookie that remembers your light or dark mode choice. The strictly necessary cookies do not require consent under UK law; the theme cookie is only set when you actively choose a theme. See our Cookie Notice for the full list.
We do not use analytics, advertising, or tracking cookies. If this changes, we will update this policy and ask for your consent first.
13. Children
The platform is intended for business use by adults. It is not directed at anyone under 18, and we do not knowingly collect data from children.
14. Changes to this policy
We may update this policy from time to time. If we make a material change, we will notify you by email or through the platform. The "last updated" date at the top will always reflect the current version.
15. Contact
Harry Needham Ltd Tyttenhanger House, Coursers Road, Colney Heath, St Albans, Hertfordshire, AL4 0PG harry@harryneedham.com