Synthesia Privacy Policy

This document is Synthesia's Privacy Policy, governing the collection, use, and disclosure of personal data in connection with its AI video generation platform and associated services, with GDPR and UK GDPR cited as primary legal frameworks alongside CCPA and other applicable laws. The policy states that Synthesia collects account information, usage data, content data (including uploaded images and voice recordings used to generate AI avatars), technical identifiers, and marketing data, and that the agreement authorizes use of this data for service delivery, product improvement, safety enforcement, and marketing communications. Notably, the policy addresses the collection and processing of biometric-adjacent data in the form of personal likeness and voice recordings for custom AI avatar creation, which creates processing obligations that engage specialist data protection regimes including the Illinois Biometric Information Privacy Act and similar state biometric laws in the United States, as well as GDPR Article 9 considerations depending on how such data is classified by regulators. The policy engages GDPR, UK GDPR, CCPA/CPRA, and potentially BIPA and other US state biometric privacy laws; compliance obligations vary materially by jurisdiction and the policy's adequacy under these frameworks may depend on how regulators classify AI-generated likeness and voice data. Material considerations include the dual role Synthesia occupies as both a data controller for its own users and a data processor for enterprise customers, cross-border data transfer mechanisms, and the adequacy of consent obtained for biometric or likeness data processing.