Synthestat · Briar Hamsfest Consulting s.r.o.

Privacy notice

How personal data is handled in the Synthestat portal (Articles 13 and 14 GDPR).

Last updated: 5 October 2026

1. Controller and scope

The controller is Briar Hamsfest Consulting s.r.o., Wolkerova 607, 473 01 Nový Bor, Czech Republic, IČO 03486770. Our privacy contact is info@synthestat.com; you can also write to the registered office.

This notice covers the portal's public pages, user accounts and the use of the service. Your organisation decides what content it uploads. Where that content contains personal data, for example uploaded human survey data, we process it on your organisation's behalf as a processor, and your organisation's own privacy notice applies to the people concerned. Business customers conclude a data processing agreement with us under Article 28 GDPR for the personal data they upload. The standard data processing agreement is available here; request a signed copy at info@synthestat.com.

DPA: download English · Czech

2. What we process, why, and on which legal basis

Account data: name, email address, organisation, role, invitations, and either a password (stored only as a hash) or, if you sign in with Google, the Google account email and identifier. Used to create and run your account. Legal basis: the contract, where you contract with us yourself (Article 6(1)(b)); otherwise our legitimate interest in providing the service to the organisation you represent (Article 6(1)(f)).
Sign-in and activity records: sign-ins, sign-outs and the portal pages you open while signed in, with time, IP address, browser user agent, organisation and role. Used for security, abuse prevention, support and operating the service. Legal basis: legitimate interest (Article 6(1)(f)).
Subscription, credits and billing: plan, credit balance and usage, model usage and cost, invoices and payment status. Card payments, where enabled, run on Stripe's checkout page; we do not receive card numbers. Legal basis: the contract or legitimate interest as above, and legal obligations for accounting and tax records (Article 6(1)(c)).
Workspace content: studies, questionnaires, scenarios, prompts, generated outputs and uploaded files. Used to provide the service. For personal data in uploaded content we act as processor (see section 1).
Email: invitations and service messages sent to your address. Legal basis as for account data.
Technical request data: your browser sends IP address, requested address, time and browser information to our servers. Used to deliver pages, diagnose errors and keep the service secure. Legal basis: legitimate interest (Article 6(1)(f)).
Correspondence: what you send us, to answer it. Legal basis as for account data.

Providing account data is needed to use the portal; without it we cannot create an account. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Synthetic respondents in the portal are generated, not real people.

3. Where the data comes from

Mostly from you. Your organisation's administrator provides your name and email address when inviting you. If you sign in with Google, Google confirms your email address and name. Stripe tells us whether a payment succeeded.

4. Recipients and processors

These are the processors and recipients the portal uses, as confirmed by the operator. Several are used only when configured or chosen:

Contabo: hosting of the portal and its data, in Germany (EU).
OpenRouter: routes requests to AI models. Prompts built from your workspace content (questionnaires, scenarios, population descriptions) go through OpenRouter to the provider of the model chosen for a run. The default model catalogue includes models from Google, Z.ai, OpenAI, inclusionAI, DeepSeek and Anthropic.
Anthropic and Google (Gemini): directly, when a run uses one of their models through our or your organisation's own key.
TypeSafe: the “Jev” model for closed survey questions, when chosen.
Model endpoints your organisation configures with its own key or address. Your organisation chooses these.
Stripe: card payments, when card checkout is enabled.
Google: Google sign-in, when you choose it.
Map image providers: when you open a map, your browser loads map images directly from OpenStreetMap's tile servers or Esri (ArcGIS), which receive your IP address and browser information.
Our email delivery provider, for invitations and service messages.
Deepgram (through OpenRouter): generates the Academy video voiceover from narration text we write. No user data is sent.
Professional advisers and public authorities, where necessary or legally required.

Speech recognition for media contrasts runs on our own servers. We do not sell personal data. Contact info@synthestat.com for the current list of recipients for your organisation.

5. Transfers outside the EU

OpenRouter and several model providers are based outside the European Economic Area, so using their models can transfer data to third countries such as the United States. These transfers rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses (Chapter V GDPR). Contact info@synthestat.com for the safeguard that applies to a particular recipient and for a copy of the clauses.

Your organisation's administrators can switch on EU-only routing. The portal then sends model requests only through OpenRouter's EU endpoint and refuses direct providers and your organisation's own endpoints.

6. How long we keep data

We keep personal data only as long as the purpose needs it or the law requires it. After the period ends we delete or anonymise it.

Data	How long	Basis
Account data	While the account exists. The password hash and Google sign-in identifier are deleted when the account is closed; name, email address, organisation and role are kept for 3 years after the account is closed or the subscription ends.	Contract (Art. 6(1)(b) GDPR) or legitimate interest (Art. 6(1)(f)); afterwards the limitation period for contractual claims, Civil Code §629(1).
Workspace content (studies, questionnaires, results, generated outputs)	For the subscription. After it ends your organisation has 30 days to export its content; then it is deleted. Earlier deletion on your organisation's request.	We process it for your organisation: Art. 28(3)(g) GDPR and the data processing agreement.
Uploaded files, including human survey data	Until the deletion date set for the upload (by default 90 days after upload), and no longer than workspace content.	Art. 28(3)(g) and Art. 5(1)(e) GDPR; the data processing agreement.
Sign-in and activity records, technical logs	12 months from the event; longer only while a specific security incident or legal claim needs them.	Legitimate interest in security and abuse prevention (Art. 6(1)(f) GDPR); storage limitation (Art. 5(1)(e)).
Rendered prompts stored with survey responses	30 days, then emptied by a daily clean-up.	Storage limitation (Art. 5(1)(e) GDPR).
Database backups	30 days, then deleted. Data deleted elsewhere disappears from backups when they expire.	Security of processing (Art. 32 GDPR); storage limitation (Art. 5(1)(e)).
Invoices and other tax documents	10 years from the end of the tax period in which the supply took place.	Legal obligation: VAT Act No. 235/2004 Coll., §35(2).
Other accounting records	Financial statements 10 years, accounting documents and books 5 years, from the end of the accounting period; longer while the period for assessing tax is still open.	Legal obligation: Accounting Act No. 563/1991 Coll., §31(2); Tax Procedure Code No. 280/2009 Coll., §148.
Correspondence	3 years after the matter is closed, unless it is an accounting record.	Legitimate interest in handling claims (Art. 6(1)(f) GDPR); limitation period, Civil Code §629(1).

Ask info@synthestat.com about the period that applies to your data.

7. Your rights

Depending on the legal conditions, you may request access, rectification, erasure, restriction or portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier processing. We may ask for information to confirm your identity, and we normally respond within one month.

You can complain to the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz, or another competent supervisory authority.

8. Browser storage, children and updates

What the portal stores in your browser is described in cookies and storage. The portal is for business users and is not directed at children. Changes in the portal may require an updated notice; the date above identifies this version.