Synthesia Privacy Policy

This is Synthesia's privacy policy explaining how the AI video creation company collects and uses your personal data, including your name, email, usage data, and — if you create a custom AI avatar — your facial likeness and voice recordings. The most important thing to know is that Synthesia may use your uploaded content, including recordings of your face and voice, to improve its AI systems unless you actively opt out. If you create a custom AI avatar, you should review the opt-out mechanism for AI training use of your biometric data and submit a data subject request via privacy@synthesia.io if you want your data deleted.

This document is Synthesia's privacy policy governing the collection, use, storage, and disclosure of personal data for users of its AI video generation platform, operating under GDPR (for EEA/UK users) and CCPA (for California residents) as primary legal bases including consent, legitimate interests, and contractual necessity. The policy creates obligations for Synthesia to respond to data subject access, deletion, rectification, and portability requests, and imposes on users the responsibility to ensure they have lawful basis to submit third-party personal data (including biometric/facial likeness data for custom AI avatars). Notably, the policy permits Synthesia to use customer-uploaded content to train and improve its AI models unless users opt out, and it collects biometric-adjacent data (facial likeness, voice recordings) for AI avatar creation — a practice that creates heightened risk under Illinois BIPA, Texas CUBI, and analogous state biometric privacy statutes. GDPR (Regulation 2016/679), UK GDPR, CCPA/CPRA (Cal. Civ. Code §1798.100 et seq.), and the EU AI Act are all engaged given Synthesia's AI-generated synthetic media product; material compliance considerations include: lawful basis documentation for biometric data processing, cross-border data transfer mechanisms (SCCs), AI-generated content disclosure obligations, and vendor/sub-processor management under GDPR Art. 28.