Synthesia

Synthesia explicitly states it does not use Customer Data for AI training without instructions, but collects Usage Information for service improvements and model enhancement. The language permits using aggregated/anonymized data and Usage Information to improve underlying technologies, creating moderate concern about what constitutes 'improvement' and whether Usage Information could indirectly inform training.

“[ToS] 'we may generate, collect and analyze data and information relating to such use and interaction...for the purposes of improving the Services' and '[Privacy] 'process the information relating to your use and interaction with the Services...to improve our Platform and underlying technologies and for our internal research'”

Customer retains ownership of Customer Data, but grants Synthesia a broad, worldwide, non-exclusive license to access, use, process, copy, distribute, perform, export and display Customer Data for service provision, maintenance, improvement, and security purposes. The license is limited in stated scope but survives termination for incorporated content, creating moderate concern about scope creep.

“[ToS] 'Customer grants us...a worldwide, non-exclusive, limited term license to access, use, process, copy, distribute, perform, export and display Customer Data...only as reasonably necessary (a) to provide, maintain and improve the Services'”

Synthesia shares data with service providers, affiliates, and third parties under stated controls. A Data Processing Addendum is referenced but not fully provided. Service providers are required to maintain 'reasonable data practices,' but the Privacy Policy indicates sharing with 'affiliated and unaffiliated service providers' without detailed sub-processor list visibility, creating moderate concern.

“[Privacy] 'we will share your information with affiliated and unaffiliated service providers which assist us in carrying out the processing activities' and '[ToS] 'Before sharing Customer Data with any of our third party service providers, we will ensure that the third party maintains, at a minimum, reasonable data practices'”

Synthesia commits to delete Customer Data upon account deletion 'unless legally prohibited' and per Security Practices, but retention periods for Other Information are vague ('as long as necessary'). Backup retention and specific timelines are not clearly documented, creating moderate concern about data lifecycle clarity.

“[ToS] 'upon Customer's deletion of its account, Synthesia shall, unless legally prohibited, delete all Customer Data and Custom Avatars in its systems' and '[Privacy] 'We may retain Other Information pertaining to you for as long as necessary for the purposes described in this Privacy Policy'”

Synthesia explicitly states that Customer owns all Customer Data and generated videos. Synthesia retains no ownership rights to outputs; it only holds a limited license to use Customer Data for service delivery. This is enterprise-friendly with clear IP ownership protection.

“[ToS] 'Customer will own all Customer Data, but excluding the components of the Services and Synthesia Content' and 'What's Yours is Yours…Customer will own all Customer Data'”

Synthesia references a Security Practices page and mentions GDPR compliance, but the provided documents do not include explicit SOC 2 Type II, ISO 27001, or HIPAA certifications. A Data Processing Addendum is referenced but the full document is not provided, making compliance verification incomplete.

“[ToS] 'we will maintain physical, and technical safeguards for the security, confidentiality and integrity of Customer Data at a level not materially less protective than as described in our Security Practices' and '[Privacy] 'More detailed information about our security is available on the Security Practices page'”