Privacy Policy

Effective date: 27 June 2026

SynthAI Ltd. ("SynthAI", "we") protects personal information collected through synthai.one and our Vancouver lab programmes in accordance with PIPEDA and British Columbia privacy standards.

Who is responsible for your data?

Data controller: SynthAI Ltd., 400 Granville Street, Suite 900, Vancouver, BC V6C 1T2, Canada. BN 739582614BC0001.

Privacy officer contact: [email protected]

Information categories we collect

Website visitors

• Contact form submissions (name, email, message content, subject selection).
• Cookie consent records and optional analytics identifiers.
• Server logs: IP address, browser user-agent, pages viewed, timestamps.

Programme participants

• Registration details: name, email, organization, billing contact.
• Attendance and cohort assignment records.
• Workshop feedback and optional portfolio showcase permissions.
• Payment confirmation metadata (processed by third-party payment providers; we do not store full card numbers).

Why we process your information

SynthAI uses personal information exclusively for identifiable purposes communicated at collection:

1. Service delivery: Enrolment, lab scheduling, hybrid session links, certificate issuance.
2. Communication: Responding to enquiries, programme updates, alumni forum administration.
3. Compliance: Tax records, contract fulfilment, legal requests.
4. Improvement: Aggregated analytics on site usage when you consent to analytics cookies.
5. Security: Fraud prevention, abuse detection on contact forms.

Legal basis and consent

PIPEDA requires meaningful consent for collection, use and disclosure. SynthAI obtains:

• Express consent: PIPEDA checkbox on contact forms (never pre-checked); optional analytics cookies via banner.
• Implied consent: Reasonable follow-up to enquiries you initiate.
• Contractual necessity: Data required to deliver programmes you purchase.

Withdraw consent anytime by emailing [email protected]. Withdrawal may limit our ability to provide ongoing services.

Disclosure to third parties

We disclose personal information only when necessary:

• Payment processors for programme fees.
• Email and video conferencing providers for lab delivery.
• Cloud hosting for synthai.one (Canadian residency preferred).
• Professional advisers under confidentiality agreements.
• Regulators or courts when legally compelled.

We do not sell or rent personal information to advertisers or data brokers.

International transfers

Some subprocessors may process data outside Canada (e.g., US-based analytics if consented). We evaluate contractual safeguards and minimize cross-border flows. Details available on request.

Retention schedule

Data type	Retention
Contact enquiries	24 months from last contact
Programme records	7 years
Cookie preferences	6 months
Analytics (if enabled)	Up to 26 months aggregated

Your rights under PIPEDA

You may:

• Access personal information we hold about you.
• Request correction of inaccurate data.
• Challenge compliance with PIPEDA principles.
• Withdraw consent for non-essential processing.

Submit requests to [email protected]. We respond within 30 days unless an extension applies under PIPEDA.

Office of the Privacy Commissioner

Unresolved concerns may be escalated to the OPC:

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, QC K1A 1H3
Toll-free: 1-800-282-1376
Web: www.priv.gc.ca

Cookies

See our Cookie Policy for categories, vendors and opt-out methods. Cookie consent stored six months in sa_cookie_consent.

Security

SynthAI applies HTTPS, access controls, staff PIPEDA training and secure deletion for expired records. Report security concerns to [email protected].

Generative AI tools in programmes

Lab exercises may use ChatGPT, Copilot or Claude under vendor terms. Do not submit confidential employer data without authorization. SynthAI is not responsible for third-party AI vendor data practices.

Minors

Programmes target adult professionals. We do not knowingly collect data from individuals under 16 without parental consent. Contact [email protected] if you believe such data was collected in error.

Automated decision-making

SynthAI does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals. Enrolment decisions involve human review of applications when capacity limits apply.

Data breach notification

If a breach creates real risk of significant harm, SynthAI will notify affected individuals and the Office of the Privacy Commissioner as required under PIPEDA, and document remediation steps taken.

Access request procedure

Email [email protected] with your name, contact details and description of information sought. We verify identity before disclosure. Reasonable requests are fulfilled at no charge; excessive or repetitive requests may incur a fee permitted under PIPEDA.

Complaints handling

We investigate privacy complaints promptly. A designated privacy contact acknowledges receipt within five business days and aims to resolve matters within 30 days, keeping you informed of progress.

Policy revisions

27 June 2026: Initial policy published.

Updates posted here with revised effective date. Significant changes communicated to active participants via email.

Questions

[email protected] · SynthAI Ltd., 400 Granville Street, Suite 900, Vancouver, BC V6C 1T2, Canada

Marketing communications

SynthAI sends programme updates and lab schedules to enrolled participants based on contractual necessity. Optional newsletters require separate opt-in. Unsubscribe links appear in non-essential emails; processing stops within ten business days of a valid opt-out request.

Participant portfolio showcases

Capstone demonstrations may be photographed or recorded for internal cohort feedback. Public showcase use requires explicit written consent per participant, specifying scope and duration. Declining showcase permission does not affect programme completion.

Corporate client data

When delivering team enablement sprints on client premises, SynthAI may process employee names and emails provided by the client controller. In such cases, the client organization remains responsible for employee notice unless a data processing addendum assigns specific roles in writing.

De-identified analytics

Aggregated website statistics — page views, referral sources, device categories — do not identify individuals when analytics cookies are consented. We do not attempt to re-identify analytics data.

Record accuracy

Participants should notify [email protected] of changes to contact details. We rely on you to provide accurate enrolment information so certificates and schedule notices reach the correct recipient.

Third-party links

synthai.one may link to ChatGPT, Copilot, Claude or OPC resources. Those sites operate under independent privacy policies. Review vendor terms before submitting personal or employer data to external AI tools during lab exercises.

Data minimization principle

SynthAI collects the minimum personal information required for each purpose. Enrolment forms exclude non-essential fields. Analytics, when enabled, uses aggregated metrics rather than individual behavioural profiles for advertising.

Processor relationships

Service providers processing data on our behalf — hosting, email delivery, payment confirmation — are selected for reasonable security practices and contractual confidentiality obligations consistent with PIPEDA accountability requirements.

Retention of feedback

Anonymous workshop feedback may be retained indefinitely for curriculum improvement. Identifiable feedback linked to your name is retained up to three years unless you request earlier deletion and no legal hold applies.

Access for persons with disabilities

Privacy notices are available in accessible HTML on synthai.one. Request alternative formats by emailing [email protected]; we aim to respond within 15 business days.

Law enforcement requests

SynthAI reviews legal requests for personal information carefully. We disclose data only when compelled by valid Canadian legal process or to protect safety, and document each disclosure internally.

Account closure

When you request account or enrolment record closure, we delete or anonymize personal data not subject to legal retention, typically within 30 days of verified request, except financial records held for tax compliance.

Privacy impact reviews

SynthAI conducts periodic internal reviews when launching new data collection features — such as additional form fields or analytics tools — to confirm PIPEDA alignment before deployment.

Contacting the OPC

You may lodge a complaint with the Office of the Privacy Commissioner if we cannot resolve your concern. We encourage contacting [email protected] first so we can address issues directly and promptly.

Subprocessor updates

When we add subprocessors that handle identifiable personal information, we update this policy and assess contractual safeguards. Material subprocessor changes affecting active participants are communicated by email where practicable.

Participant rights summary

In summary: you may access, correct, withdraw consent and complain about our handling of personal information. We respond to [email protected] requests without undue delay and within PIPEDA timelines unless an extension is legally permitted.

Website server logs

Standard web server logs may record IP address, user agent and requested URLs for security monitoring. Logs are rotated and deleted according to our retention schedule unless needed for incident investigation.

Enrolment payment data

Payment card processing occurs through third-party processors. SynthAI stores transaction references and amounts for accounting but not full card numbers on our systems.

Hybrid session recordings

Video links for hybrid lab participation may be logged by conferencing providers under their privacy terms. SynthAI does not record hybrid streams for marketing without explicit participant consent communicated before each session.

Questions and updates

This policy may be updated to reflect new lab services or legal requirements. The effective date at the top indicates the current version. Continued use of synthai.one after updates constitutes acknowledgment where PIPEDA permits. Direct questions to [email protected] anytime.