Privacy Policy
Last updated: 9 November 2026
1. Introduction
This Privacy Policy explains how Synona ("we", "us", "our") collects, uses, stores and protects personal data when you visit synona.app, ask for a free check, or use Synona studies.
Synona is a product of AI CTRL Ltd, a company registered in England and Wales (company number 17051085). Our registered office is 23 Holland Grove, London SW9 6ER.
AI CTRL Ltd is the data controller for the personal data described in this policy, except where section 5 says otherwise. We handle personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and under the EU GDPR where it applies to visitors in the European Economic Area.
If you have a question about this policy, email info@synona.app.
2. What Synona does
Synona studies how visitors move through a website. Synonas are synthetic visitors: AI agents, each drawn from a Persona, that open a customer's public web pages in a browser and try to get a Job done, such as finding a product or reaching checkout. Each attempt is a Walk. A User Study walks the current site to find problems. A Change Study walks a proposed version against the original to measure the change.
Synonas are not real people, and no real person takes part in a Synona study.
Today we run studies ourselves and email the results to you as a PDF. Later we will offer a hosted dashboard, with share links and sign-in by an emailed link. This policy covers both, and we will update it before the dashboard opens.
3. Data we collect
When you ask for a free check
The request form on synona.app collects:
- the website you want studied;
- your email address;
- whether you work at the brand that owns the site or at an agency acting for it;
- your role (for example founder, marketing, e-commerce, product or agency);
- the range of orders, bookings or sign-ups the site gets in a month;
- how you reached the page, if the link carried it: campaign tags (UTM parameters) and advertising click identifiers from Google, Microsoft, Meta or LinkedIn.
A Cloudflare Turnstile check runs when you send the form, to stop automated spam. It looks at signals from your browser and returns a pass or fail; we do not receive or keep those signals.
We store your request in a Cloudflare D1 database and email you a 6-digit code to confirm the address is yours. Once you enter the code, we send an alert email to the person who runs studies, so a person can review it. Requests whose address is never confirmed are deleted after 7 days.
When you email us
If you write to info@synona.app, we receive your email address, your name if you give it, and whatever the message contains.
When we run a study for you
Synonas visit the public pages of the site you asked us to study. For each Walk we store:
- screenshots of the pages the Synona saw;
- the text of those pages;
- a record of each step: what the Synona clicked, scrolled or typed, the page address, the screen size, and the time.
These records are about your website, not about people. A screenshot may still show personal data that your site displays publicly, such as a reviewer's name, a staff photo or a contact address. We do not look for that data and we do not use it for anything other than the study. See section 5.
We also keep the study's results: findings, hypotheses, reports and the PDF we send you, and the email addresses we send them to.
When you use the dashboard (not yet available)
When the hosted dashboard opens, we will collect the email address you sign in with, the time you signed in, and which studies and share links you open. Anyone who opens a share link may be recorded as a visit to that link.
Usage analytics
With your consent, we use PostHog, hosted in the European Union, to understand how visitors use synona.app: pages viewed, buttons clicked, how far a visitor got through the form, the browser and device, and the approximate location derived from the IP address. When you send the request form, we link these events to your email address and the website you entered, so we can see which pages lead to requests. See our Cookie Policy.
Technical data
Our hosting provider, Cloudflare, processes IP addresses, browser type, request times and the pages requested, to deliver the site and protect it from abuse.
4. Lawful basis for processing
| Data | Lawful basis | Purpose |
|---|---|---|
| Free-check request and emails you send us | Steps taken at your request before a contract (Art. 6(1)(b)), and legitimate interests (Art. 6(1)(f)) | To review your request, run the free check, send you the results and answer your questions |
| Study records (screenshots, page text, step records) and results | Contract (Art. 6(1)(b)), and legitimate interests (Art. 6(1)(f)) for any personal data shown incidentally on your site | To run the study you asked for and deliver the results |
| Campaign tags and click identifiers | Consent (Art. 6(1)(a)) | To learn which campaigns lead to requests |
| Usage analytics | Consent (Art. 6(1)(a)) | To improve synona.app. You can withdraw consent at any time; see the Cookie Policy |
| Turnstile check, technical data and security logs | Legitimate interests (Art. 6(1)(f)) | To keep the site and the form free of spam and abuse |
| Dashboard sign-in and share links (when available) | Contract (Art. 6(1)(b)) | To let you and the people you share with see your studies |
| Invoices and payment records (paid plans) | Legal obligation (Art. 6(1)(c)) | To keep accounting records required by law |
We do not send you marketing emails unless you ask for them. Emails about your request, your study or your plan are not marketing. If you opt in to product updates or a newsletter, we send those until you unsubscribe.
5. Personal data on the sites we study
Synonas only visit pages that any member of the public can open. They do not sign in to your admin, your customer accounts or your analytics, and we never ask for your customers' data.
If a public page shows personal data, it can appear in a screenshot or in the page text we store. We process it only to produce your study, we keep it only as long as the study records (section 9), and we do not extract it, index it or use it to contact anyone.
You must not ask us to study pages that show your customers' personal data, such as order pages or account areas. If you see personal data in a result that should not be there, email info@synona.app and we will remove it.
Synonas do not buy, book, pay, or send contact, enquiry or demo-request forms on live sites. Where a Job tests signing up for a free trial and you have agreed to it, a Synona may create a trial account using an email address we control, clearly marked as a test. These addresses do not belong to real people.
6. Service providers (sub-processors)
We share data with the following providers, each under a data processing agreement or equivalent terms:
| Provider | What it does for us | Data it handles | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosts synona.app, stores free-check requests (D1), routes email to info@synona.app, runs the Turnstile spam check | Request form data, emails, IP addresses and technical data | Global network; requests are stored in the European Union (D1 EU jurisdiction) |
| PostHog Inc. | Usage analytics, with your consent | Analytics events, and your email and website once you send the form | European Union (PostHog EU cloud) |
| TypeSafe AI, Inc. (Jev model) | The AI model that drives Synonas during Walks | Screenshots and page text from your site, Persona and Job descriptions | United States |
| Anthropic PBC (commercial API terms) | The AI model that analyses Walks, asks Synonas why they stopped, and drafts findings | Screenshots, page text and step records from your study | United States |
| Resend, Inc. | Sends the code email, request alerts and result emails from synona.app | Email addresses and message content, including result PDFs | European Union (Ireland) |
| Microsoft (Microsoft 365) | Receives email sent to info@synona.app | Email addresses and messages | United Kingdom |
| Google Cloud (Google LLC / Google Cloud EMEA Ltd), not yet in use | Will host the study application, its database and file storage, and the dashboard | Study records and results, dashboard accounts | We will name the region in this policy before any data moves there |
Before we move study data to Google Cloud, study records are kept on computers operated by AI CTRL Ltd in the United Kingdom, with backups on the same computers.
We do not allow AI model providers to train their models on your study data: Anthropic's commercial API terms and TypeSafe's policy both exclude training on our inputs. We may also run open models on AI CTRL Ltd computers in the United Kingdom, in which case study data does not leave them.
We do not sell personal data, and we do not share it with advertisers.
7. International transfers
Some providers process data outside the United Kingdom and the European Economic Area, including in the United States (Anthropic, and Cloudflare's global network). Where they do, we rely on one of these safeguards:
- a UK adequacy regulation, including the UK Extension to the EU-US Data Privacy Framework where the provider is certified;
- the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum;
- the UK International Data Transfer Agreement.
PostHog analytics data stays in the European Union.
8. Security
We limit access to request and study data to the people who run studies. Data travels over encrypted connections. A person reviews every finding before it is sent to you.
9. How long we keep data
| Data | How long |
|---|---|
| Free-check requests that do not become a customer, and the alert emails about them | 24 months from the request |
| Emails you send us | 24 months from the last message, unless they form part of a customer record |
| Study records (screenshots, page text, step records) and results | Until you ask us to delete them. We remove personal data visible in a screenshot on request. |
| Dashboard accounts and share-link records (when available) | While the account is open, then 30 days |
| Usage analytics | Up to 24 months from collection |
| Security logs | 90 days |
| Invoices and payment records | 6 years after the end of the financial year they relate to, as UK law requires |
After these periods we delete the data or make it anonymous. You can ask us to delete your data sooner; see section 10.
10. Your rights
Under data protection law you have these rights over your personal data:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct data that is wrong or incomplete.
- Erasure: ask us to delete your data.
- Restriction: ask us to limit how we use your data.
- Portability: receive data you gave us in a structured, machine-readable format.
- Objection: object to processing we carry out on the basis of legitimate interests.
- Withdraw consent: withdraw consent to analytics at any time. This does not affect processing that happened before.
To use any of these rights, email info@synona.app. We will reply within one month.
If you are not satisfied with our answer, you can complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
If you are in the European Economic Area, you can also complain to the data protection authority where you live.
11. Automated decisions
We do not make decisions about people by automated means that have legal or similarly significant effects. AI models produce study findings about websites, and a person reviews them before we send them.
12. Children
Synona is a service for businesses and is not aimed at anyone under 18. We do not knowingly collect personal data from children. If you think a child has sent us personal data, email info@synona.app and we will delete it.
13. Changes to this policy
We may update this policy when our service, our providers or the law changes. When we make a material change, we will:
- update the "Last updated" date at the top of this page;
- email customers at least 14 days before the change takes effect.
14. Contact
For any question about this policy or your personal data, email info@synona.app, or write to AI CTRL Ltd, 23 Holland Grove, London SW9 6ER.