Last updated 6 September 2026
Who we are
Synion is operated by Amarcode Studios Limited, registered in England & Wales, the data controller for the personal data described here. [Registered address and data-controller contact — set before launch.]
What we collect
Your email address and sign-in credentials (handled by Hanko, our authentication provider). The label and optional email an agent gives when it asks to work on your account, and your approval or refusal with any reason you write. A hash of your API key — never the key itself. The prompts, briefs, recordings and images provided to the Service by you or your agents, and the media generated from them. Usage counts against your quota, and technical logs needed to run the Service. Analytics cookies are set only with your consent (see the Cookie Policy).
Why we use it
To provide the Service (authenticate you and your agents, generate and store media, meter your quota), to keep your account secure (registrations expire, keys can be revoked, requests are rate-limited), to respond to support requests, and — with consent — to understand how the Service is used. Our lawful bases are performance of a contract, our legitimate interest in running a secure service, and consent for analytics.
What we never do
We do not read the text your agents write to us as instructions, we do not share content between accounts, and we do not sell personal data. Log lines carry identifiers and lengths, never the content of a prompt, a label or a key.
Who we share it with
Processors acting on our instructions: Hanko (authentication); providers of generative models, speech synthesis and video rendering, which receive the prompts, recordings and images needed for a given generation; hosting and object-storage providers; and Google Tag Manager/Analytics when you have accepted analytics cookies.
Where it is kept
Infrastructure runs in the United Kingdom and the European Union. Where a processor transfers data elsewhere, appropriate safeguards apply.
How long we keep it
Account data and generated media are kept while your account is active and for a reasonable period afterwards, then deleted. Pending agent registrations expire after fifteen minutes; approved, denied and claimed ones are kept as part of your account history. You can request deletion at any time.
Your rights
Under UK GDPR you can ask to access, correct, delete or port your data, restrict or object to processing, and withdraw consent. You can complain to the Information Commissioner’s Office (ico.org.uk).
Contact
[Data-controller contact address — set before launch.]