Synapsis
Privacy Policy

Privacy Policy

Last updated: 31 August 2026

This Privacy Policy explains how Synapsis (“Synapsis”, “we”, “us”, or “our”) collects, uses, stores and protects your personal data when you use our website and application (the “Service”). We are committed to protecting your privacy and handling your data in an open and transparent manner, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Note: This is an interim policy provided in good faith and based on standard practice for learning applications. It is intended to be helpful and transparent but has not yet been reviewed by a qualified legal professional. We will update it following professional review.

1. Who we are

Synapsis is an evidence-based learning platform for students and professionals, operated from the United Kingdom. For the purposes of data protection law, Synapsis is the “data controller” of your personal data. If you have any questions about this policy or your data, you can contact us at [email protected].

2. What data we collect

We collect and process the following categories of personal data:

  • Account data: your name, email address and an encrypted (hashed) password. If you sign in with Google, we receive your name, email address and profile identifier from Google.
  • Learning content: the notes, flashcards, brain dumps, curricula, uploaded documents and images, and any other study material you create or upload.
  • Progress and usage data: your study activity, review history, spaced-repetition scheduling data, mastery scores, exam attempts and results, and preferences.
  • Payment data: if you subscribe to a paid plan, your payment is processed by Stripe. We do not store your full card details. We retain a subscription status, plan, and billing identifiers needed to manage your subscription.
  • Communications: messages you send us (for example, via our contact form) and your marketing preferences.
  • Technical data: limited data such as log information and cookies necessary to operate the Service securely (see Section 8).

3. How we use your data and our legal bases

We process your personal data on the following legal bases under UK GDPR:

  • To provide the Service (performance of a contract): creating and managing your account, storing your learning content, generating study schedules, spaced-repetition reviews, AI tutor responses, question generation and mastery tracking.
  • To process payments (performance of a contract): managing subscriptions, trials, renewals and cancellations via Stripe.
  • To keep the Service secure and improve it (legitimate interests): preventing fraud and abuse, debugging, and understanding how features are used. We balance these interests against your rights.
  • To send you service and marketing messages: transactional emails (for example, a welcome guide or account notices) are sent on the basis of our contract/legitimate interests; optional marketing emails are sent only with your consent, which you can withdraw at any time.
  • To comply with legal obligations: for example, retaining records required by law.

4. AI-powered features

Some features (such as the AI tutor, automatic question generation, feedback on brain dumps and exam marking) send the relevant learning content you provide to a large language model in order to generate a response. This processing is carried out through our infrastructure provider’s AI service on our behalf. Your content is used to produce your results; we do not sell it, and it is not used to train third-party public models through this processing. Please avoid entering sensitive personal information (yours or anyone else’s), or real patient identifiable data, into AI features.

5. Who we share your data with

We do not sell your personal data. We share it only with trusted service providers (“processors”) who help us run the Service:

  • Abacus.AI — our hosting, database and AI processing provider, which stores your data and runs the application infrastructure.
  • Stripe — our payment processor, which handles subscription billing and card processing.
  • Our email provider — used to deliver transactional and (where you have consented) marketing emails.

We may also disclose data where required by law, to protect our rights, or in connection with a business transfer (such as a merger or acquisition), in which case we will notify you.

6. International transfers

Some of our providers may process data outside the UK/European Economic Area. Where this happens, we rely on appropriate safeguards recognised under UK GDPR (such as UK adequacy regulations or Standard Contractual Clauses with the UK addendum) to ensure your data receives an equivalent level of protection.

7. How long we keep your data

We keep your personal data for as long as your account is active. If you delete your account, or ask us to delete your data, we will remove your personal data and learning content within a reasonable period, except where we are required to retain certain records (for example, billing records) to meet legal obligations.

8. Cookies

We use only the cookies strictly necessary to operate the Service securely — principally to keep you signed in (authentication/session cookies). We do not use advertising cookies. You can control cookies through your browser settings, but disabling essential cookies may prevent you from using the Service.

9. Your rights

Under UK data protection law you have the right to:

  • access a copy of the personal data we hold about you;
  • have inaccurate data corrected (rectification);
  • have your data erased (“right to be forgotten”);
  • restrict or object to certain processing;
  • data portability — receive your data in a portable format;
  • withdraw consent at any time (for example, unsubscribe from marketing emails); and
  • lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise any of these rights, please email us at [email protected].

10. Security

We take reasonable technical and organisational measures to protect your data, including encryption of passwords, encrypted connections (HTTPS) and access controls. No online service can be guaranteed to be completely secure, but we work to protect your data and to notify you and the relevant authority of any breach where required by law.

11. Children

The Service is intended for users aged 16 and over. We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you within the Service or by email.

13. Contact us

If you have any questions, requests or complaints about this policy or how we handle your data, please contact us at [email protected].

See also our Terms of Service.