SyntheticBrew SyntheticBrew
Try Cloud

Privacy Policy

Last updated: July 23, 2026

1. Who we are and what this policy covers

Synthetic AI Inc (“Synthetic AI,” “we,” “us,” or “our”) is a Delaware corporation located at 2810 N Church St, PMB 155747, Wilmington, Delaware 19802-4447, USA. We provide SyntheticBrew, an AI agent runtime, through the following offerings (together, the “Services”):

  • The website at syntheticbrew.ai, including our documentation and blog.
  • SyntheticBrew Cloud — our hosted software-as-a-service platform.
  • Custom integration services — done-for-you AI agent implementations delivered by our team.

This policy describes how we handle personal information when we act as a data controller — that is, when we decide the purposes and means of processing. When our customers build agents, chat widgets, or applications on SyntheticBrew Cloud and their own end users submit content through them, we process that content as a data processor on the customer’s behalf and on the customer’s instructions; the customer’s own privacy policy governs that processing.

If you do not agree with this policy, please do not use the Services. Where consent is not required by law, your use of the Services constitutes acceptance of the practices described here.

2. Information we collect

Website visitors

  • Connection data that your browser transmits automatically: IP address, date and time of the request, pages viewed, referrer, browser type and version, operating system, and device information.
  • Analytics data collected through the tools described in Section 5, including page visits, link interactions, and click positions.

SyntheticBrew Cloud customers

  • Account data: your email address and a hashed password (we store only the hash, never the plain password), plus language and interface preferences. If you sign in with Google, we receive and store your email address and a Google account identifier from Google under your Google privacy settings.
  • Team data: names and email addresses of teammates you invite, and their roles.
  • Billing data: your plan, billing address, and payment transaction history. Card payments are processed by Stripe; we never receive or store full card numbers.
  • Usage metadata: login timestamps, feature usage counts, monthly active user counts, and API request metadata. Anonymous visitors of a chat widget you deploy are counted once using a persistent pseudonymous visitor identifier.
  • Content and AI interaction data: the prompts and messages submitted to agents in your workspace, documents and knowledge-base files you upload, agent and schema configurations, and AI-generated outputs. Where this content belongs to your end users, we process it on your behalf as described in Section 1.
  • Credentials you configure: LLM provider API keys, MCP server configurations, and other integration credentials you add to your workspace so your agents can use them. We use them only to make the requests you configure.
  • Support communications: the contents of emails you send to [email protected], including any attachments or screenshots you choose to include.

Custom integration customers and prospects

When you book a fit call, scheduling runs through Calendly, which collects your name, email address, and selected time under its own privacy policy. When you email us, we keep the correspondence. During a custom integration engagement, we handle the project materials, data samples, system credentials, and communications you share with us under the statement of work governing that engagement.

3. How we use information

  • Provide, operate, secure, and maintain the Services.
  • Create and authenticate your account and manage your team.
  • Process payments and manage subscriptions.
  • Send transactional messages such as password resets, billing notices, and service announcements.
  • Respond to support requests and sales inquiries.
  • Measure and improve website and product performance.
  • Detect, prevent, and investigate fraud, abuse, and unauthorized access.
  • Comply with legal obligations and enforce our Terms of Service.

AI interaction data

We build infrastructure, not foundation models. We do not use your content to train AI models. How your AI interaction data flows depends on how you configure the Services:

  • Bring your own key (BYOK). If you configure your own LLM provider key, your prompts and outputs are transmitted directly to your chosen provider for inference. That provider’s agreement with you governs its use of the data; we are not a party to it.
  • Demo key. If you use the demo LLM key included with SyntheticBrew Cloud, inference and embedding requests are routed through OpenRouter to the model provider serving the request, which varies by model. That content is handled under OpenRouter’s and the serving provider’s data policies. Some platform-provided model access is served through DeepInfra under its data policy.

Legal bases (EEA, UK, and Switzerland)

Where GDPR or equivalent law applies, we process personal data on these bases:

  • Performance of a contract — creating and operating your account, providing the Services, processing payments, and sending transactional messages.
  • Legitimate interests — securing the Services, preventing fraud and abuse, measuring and improving the website and product, and marketing to business contacts.
  • Consent — where required, for example for certain cookies and marketing communications; you can withdraw it at any time.
  • Legal obligation — retaining billing and tax records and responding to lawful requests.

4. How we share information

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share personal information with the following providers to operate the Services.

Providers processing on our instructions:

  • Hetzner Online GmbH (Germany) — cloud infrastructure hosting for SyntheticBrew Cloud and our website.
  • Resend — transactional email delivery.
  • OpenRouter and DeepInfra — LLM inference routing for the demo key, as described in Section 3.

Providers that also process some data for their own purposes under their own privacy policies:

  • Cloudflare — content delivery, security filtering, and network-error reporting in front of our websites.
  • Stripe — payment processing, checkout, and billing portal; Stripe acts independently for fraud prevention and financial compliance.
  • Google — website and product analytics (Google Analytics 4), font delivery in the Cloud application (Google Fonts), and sign-in with Google.
  • Yandex — website and product analytics (Yandex Metrica), as described in Section 5.
  • Ahrefs — aggregate, cookieless website analytics.
  • Calendly — call scheduling for sales and fit calls.

We may also disclose personal information where required by law, subpoena, or a governmental request; where reasonably necessary to protect the rights, property, or safety of Synthetic AI, our users, or the public; or, in connection with a merger, acquisition, financing, or sale of assets, to the parties and advisors involved, consistent with applicable law.

5. Cookies, analytics, and local storage

Our website, the SyntheticBrew Cloud application, and our documentation site load the following measurement tools:

  • Google Analytics 4 (measurement ID G-QM8W4T1H8S) — page views, traffic sources, and engagement metrics, using cookies.
  • Yandex Metrica (counter 109861753) — page views and interaction measurement, using cookies. Our configuration includes click mapping, link tracking, accurate bounce tracking, and ecommerce events through the site data layer. Session replay (Webvisor) is switched off on every surface: we do not record page content, typed input, mouse movement or scrolling.
  • Ahrefs Web Analytics (key 8XmJL3KUhBeIYCJI73sNqg) — aggregate, cookieless page-visit measurement on the website.

Our servers also report a small number of product-lifecycle events (such as account signup and first agent use) to Yandex Metrica together with a pseudonymous account identifier, so we can measure activation. A pseudonymous account identifier may likewise be associated with usage events in analytics. You can limit browser-side analytics collection with browser settings and extensions, the Google Analytics opt-out browser add-on, and Yandex’s opt-out tools.

The SyntheticBrew Cloud application uses browser localStorage for authentication tokens and interface preferences, a sbrew_theme cookie (one year, shared across syntheticbrew.ai subdomains) to remember your theme choice, and loads the interface font from Google Fonts, which transmits your IP address to Google. These are functional mechanisms, not tracking. A full list of cookies and storage is in our Cookie Notice.

6. Where data is stored and international transfers

SyntheticBrew Cloud and our website are hosted on Hetzner infrastructure in Germany (European Union). Synthetic AI Inc is a United States company, and some of our service providers (including Stripe, Resend, DeepInfra, and Google) process data in the United States or other countries. Where personal data of individuals in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses. We have not appointed a representative in the EU or UK under Article 27 GDPR; requests from any jurisdiction can be sent directly to [email protected].

7. Data retention

  • Account data is retained while your account exists.
  • When you delete your account, your account record is deleted, and associated workspace data (agents, documents, conversations) is purged through our support process within 30 days, subject to residual copies in backups and to legal retention obligations. You can also request purging at any time via [email protected].
  • Billing and transaction records are retained as required by tax and accounting law.
  • Website connection logs are kept for a limited period for security purposes and then deleted or anonymized.
  • Aggregated or de-identified data that no longer identifies you may be retained without time limit.

8. Security

We protect personal information with measures including TLS encryption in transit, bcrypt password hashing, SHA-256 hashing of API tokens, Ed25519-signed session tokens, role-based access controls, and security review of changes to the platform. No system is completely secure, and we cannot guarantee absolute security; we will notify you and the relevant regulator of a personal data breach where the law requires it.

9. Your rights

Depending on where you live, you may have the right to:

  • Confirm whether we process your personal data and receive a copy of it.
  • Correct inaccurate or incomplete personal data.
  • Delete your personal data.
  • Restrict or object to processing, including objecting to direct marketing at any time.
  • Receive your data in a portable, machine-readable format.
  • Withdraw consent at any time, without affecting processing that happened before withdrawal.
  • Lodge a complaint with your data protection supervisory authority.

To exercise any of these rights, email [email protected]. We will verify your identity using the contact details associated with your account and respond within the timeframe required by applicable law. If we process data on behalf of one of our customers (Section 1), we will refer your request to that customer and support them in answering it.

California and other US state residents

We collect the categories of personal information described in Section 2: identifiers (name, email, IP address), commercial information (transactions, plan history), internet activity (usage and analytics data), approximate geolocation (derived from IP address), and professional information (company name and role, if you provide them). We collect them from you and your devices, and we disclose them only to the service providers listed in Section 4 for the business purposes listed in Section 3. We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we have no actual knowledge of selling or sharing personal information of consumers under 16. You have the rights to know, access, correct, and delete personal information, and the right not to be discriminated against for exercising them. Submit requests, directly or through an authorized agent, to [email protected]; agents must provide the resident’s signed authorization.

10. Children

The Services are not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact [email protected] and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Changes appear on this page with an updated “Last updated” date, and we will give more prominent notice — by email or in the product — before material changes take effect. Continued use of the Services after a change takes effect constitutes acceptance of the updated policy.

12. Contact

Synthetic AI Inc
2810 N Church St, PMB 155747
Wilmington, Delaware 19802-4447, USA
Email: [email protected]