Privacy policy.
What Synthicate keeps about you, why, who sees it and for how long.
Effective date: [EFFECTIVE DATE]
1. Who we are
Synthicate is run by [COMPANY NAME], ABN [ABN], of [REGISTERED ADDRESS] (“Synthicate”, “we”, “us”). This policy says what personal information Synthicate keeps, why, who sees it and for how long. We handle it under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Write about privacy to [PRIVACY EMAIL].
Synthicate is for businesses. Most of what it keeps is about organisations, creators and deals. The personal information is mostly about the people who sign in, and what they write and upload.
2. What we collect
Your sign-in. Your name, your email and a password. The password is stored only as a hash, never as you typed it.
Your sessions. Each time you sign in we record the session, with your IP address and your browser’s description of itself, to keep you signed in and help keep your account secure.
Sign-in attempts. To slow down anyone guessing passwords or running scripts, we count sign-in and sign-up attempts from each IP address, and actions from each account, over short periods.
Your organisation. Its name, and whether it’s a studio or a brand.
Your email choice. Whether you get an email when a deal needs you, and which notifications have been emailed. Deal emails go to the address you sign in with; you can switch them off in Settings › Notifications.
Creators (studios). Each creator’s name, one-line bio, picture, niches, platforms and handles, followers, rate card, private notes, the confirmations (each account’s AI labels, with the date they were confirmed; the likeness; no adult links), and each post’s link and numbers (views, likes, comments, shares). Creators aren’t people, but a handle or a note can point to the people behind one.
Product packs and briefs (brands). Each pack’s name, category, one line, product page, photos, size, colours, logo, the words on the pack and its rules. Each brief’s words, filters, price, slots, “stays up” period and the brief checker’s warnings.
Deals. Every offer, counter, message, draft, approval, problem raised, settlement, live link and label tick, with who did it and when.
Live post checks. When a studio sends a deal’s live link, Synthicate asks the platform’s public embed service whether the post exists and which account posted it. We keep the post’s ID, the handle the platform named, the answer’s status and when we asked; never the post’s numbers, words or pictures.
Uploaded files. Pack photos, logos, creator pictures and drafts (images and videos).
Notifications. What you’ve been told and what you’ve read.
Payment records. The amounts, and references from the payment provider: payment, transfer and refund IDs, and a studio’s account ID with the provider and whether it can be paid. We never see or keep card numbers or bank account numbers. Brands enter card details on the provider’s page. Studios give their identity and bank details to the provider directly.
What you send us, such as emails.
We don’t connect to your social media accounts, read your audience’s data or use advertising trackers.
3. Why we collect it
To run the marketplace:
- to open and protect accounts;
- to show creators to brands and briefs to studios: the grade and weekly state, and matching a creator to a brief’s filters;
- to run deals and their timers, and to have the payment provider hold, release or refund each payment;
- to tell each side what’s waiting on it;
- to settle problems, and to keep the record both sides rely on;
- to enforce the terms and the Acceptable use policy, for example with the brief checker;
- to meet our legal duties, such as tax records.
We don’t sell personal information, and we don’t use it for advertising.
Decisions made by the product. Some moves happen automatically. A creator’s grade and weekly state are calculated from the numbers its studio enters, and they decide which briefs it qualifies for and whether a brand sees it as a match. Timers move a deal on when nobody acts: an offer expires, an unpaid deal is cancelled, a draft counts as approved, a payment is released or refunded.
4. Who sees what
What someone sees depends on their side and their deals. Every request checks that the person’s organisation owns the thing, or is one of the two sides of the deal.
- A creator’s public card (name, handle, niches, platforms, grade and weekly state, views a post, engagement, followers, and the studio’s name) is shown to brands only after its studio confirms both checks. A brand also sees the creator’s rate card beside an offer price.
- Private notes on a creator are seen only by its studio.
- A product pack’s name, category and cover photo are seen by studios that can see the brief. The whole pack, with every file, is seen once one of their deals on that version is agreed.
- Briefs are seen by studios when they’re open to every studio and a creator qualifies, or nearly does. Any other brief is seen once it sends them an offer.
- A deal’s thread, drafts and money are seen only by its two sides.
- Signed-out visitors see the public site only.
- Synthicate staff can see what’s needed to run the service, help you and settle a problem.
5. Who we share it with
Service providers that handle it for us:
- Stripe, the payment provider. It takes brands’ card payments, checks studios’ identity, keeps their bank details, and holds and moves deal payments. It also handles that information under its own privacy policy.
- [HOSTING PROVIDER], which hosts the database and the uploaded files.
- [EMAIL PROVIDER], once Synthicate sends email.
When a live link is checked (section 2), TikTok or YouTube is asked about that one post: only the post’s address goes to them, from our server.
Beyond them, we share personal information only with the other side of your deal (section 4), our professional advisers, a buyer of the business if it’s sold, or when the law requires it or someone’s safety depends on it.
6. Where it’s stored
The database and uploaded files are stored in [HOSTING REGION]. Stripe may handle information outside Australia, including in the United States. When we send personal information overseas, we take reasonable steps to make sure the receiver handles it in line with the APPs.
7. How long we keep it
- The deal record. Deals, money lines and thread messages are never deleted. They’re the record for both sides, and money records have to be kept under tax law. We keep them for at least [7 years] after a deal ends.
- Files a deal used stay with the deal record.
- Account and organisation details are kept while the account is open, then for [period] after it closes, except what the deal record needs.
- Sign-in sessions last up to 14 days and renew while you use Synthicate. Ended sessions are deleted after [period].
- Files no deal uses, such as an unused pack photo, are deleted within [period] of the account closing.
8. Your rights
Seeing and correcting. You can see and correct most of your details in the app. For anything else, write to [PRIVACY EMAIL]. We’ll check who you are, answer within 30 days and charge nothing. If we refuse, we’ll say why.
A copy of your data. Settings, under Your data, downloads everything your organisation holds as one file: the account, its creators and their posts or its product packs and briefs, its deals with their messages and money, its notifications, and a list of its uploads. For anything it doesn’t cover, write to [PRIVACY EMAIL].
Closing and deleting. You can close your account in Settings, under Your data, once none of its deals is open or holding a payment: its creators are archived, its open briefs close, and nobody can sign in to it again. Closing keeps your details; to have the personal information we no longer need deleted, write to [PRIVACY EMAIL]. What stays is what a deal relied on: the deal, its money lines and messages, and the files sent in it, because the other side relies on them and the law requires the money record. We’ll keep only what the record needs.
9. What your browser keeps
- One cookie keeps you signed in. Synthicate doesn’t work without it.
- Two more cookies keep your display choices: how your roster and your Today page are laid out, and nothing else. The Cookie policy lists all three.
- Nothing for analytics or advertising, and no third-party trackers. The payment provider’s page sets its own cookies when a brand pays.
If that changes, we’ll update this policy first, and ask you where the law requires it.
10. Keeping it safe
Passwords are stored as hashes. Every request checks who’s asking before anything is shown. Uploaded files are checked by their contents, not their names. No system is perfectly safe. If a data breach is likely to cause serious harm, we’ll tell the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.
11. Complaints
Write to [PRIVACY EMAIL] and say what happened. We’ll answer within 30 days. If you’re not happy with our answer, you can complain to the OAIC at oaic.gov.au.
12. Changes and contact
We’ll post any change here with a new date, and tell you in the app and by email before a change that affects you takes effect. Privacy questions go to [PRIVACY EMAIL], or by post to [REGISTERED ADDRESS].