Privacy Policy

Last updated: 10 November 2026.

This page says what we collect, who else handles it, how long we keep it and what you can ask of us. One thing to know up front: when you remove something, its heavy files go after 30 days, and a record of the work stays unless you ask us to remove it.

Przedsiębiorstwo Produkcyjno-Handlowo-Usługowe "POL-MED" Spółka z ograniczoną odpowiedzialnością, ul. Leśna 38, 86-031 Osielsko, Poland, decides how your data is used for running Syndcast. For anything about your data, write to support@syndcast.com.

A channel decides what goes into its own content. If your script or video holds other people's names, faces or voices, your channel is responsible for having the right to use them.

Waitlist: your email, an optional name, and when you were invited and joined.

Account: name, email, username, display name, picture, how you sign in, and the accounts you linked (Google, GitHub). Passwords are stored by our sign-in system as hashes, not as text. If you turn on two-factor sign-in or passkeys, we keep what those need.

Sessions: IP address, browser details and the session's end date.

Billing: your plan and its status, your Stripe customer number, and a ledger of every credit spent or added. Stripe holds your card, billing address and any VAT number. We do not see full card numbers.

Your work: channels, members, invitations, projects, scripts, timelines, clips, uploaded and generated files, renders, styles, brand kits, review notes and knowledge notes.

Agents: chats with agents, their tasks, transcripts, memories and notes, what they chose, what they looked at, and tokens (stored as hashes).

Activity logs: each edit in the workspace, who or what made it and when, plus counts per person and per channel.

Connections: sign-in tokens for your publishing accounts, your own AI keys and storage details, and stats those platforms give us.

Reports: what you send with the Early access · Report an issue button, with your email, name, the page you were on, browser details and app version.

To run Syndcast for you (accounts, your work, agents, renders, publishing, mail): to perform our contract with you.

To take payment, keep invoices and meet tax rules: contract and legal duty.

To keep Syndcast safe (rate limits, bot checks, sign-in records, audit trails): our legitimate interest in security.

To make Syndcast better (see "Machine learning" below, and the records we keep after a removal): our legitimate interest.

To answer your reports: our legitimate interest in fixing what you tell us about.

Where we rely on legitimate interest, you can object. See "Your rights".

We train one kind of model: a reward model that learns which settings work. It learns from numbers only, and it learns from every channel.

What it learns from

When any hand sets a value, such as the volume of a sound effect, we record a number: what it was, what it became, and who set it (a person, an internal agent, an external agent or the system). We also record what happened next, for example a person turning it down.

There is no free text and no media in these records. Names, emails and real ids are replaced with keyed hashes, and the key stays inside Syndcast. The training system runs on our own computer and reads daily files of these numbers.

What it does not learn from

We do not train on your images, video, audio, voice or written text. We keep those, and our logs, as described on this page. If we ever want to train on them, we will change this page first and say what choice you have.

The switch

Each channel has a switch called Spider Intelligence, with the line "Suggestions from Syndcast's machine learning, for your channel's agents." It decides only whether that channel's agents get hints from the model once hints reach production. It does not stop your channel's numbers from training the model. Today no channel gets hints in production.

Why we may do this

These numbers still count as personal data, because they are hashed and not anonymous. We use them on the ground of our legitimate interest in making Syndcast's agents better. You can object by writing to support@syndcast.com. If you or your channel are erased, your hashed id goes on a list that every later training run leaves out.

Your channel's own agents

Internal agents can also keep notes, memories and skills for your channel. That is a separate thing from the model above, and the Spider Intelligence switch does not control it.

We use outside companies to run Syndcast. We send them what each job needs.

To run the service

Vercel: hosts the app, stores your files (Vercel Blob) and routes AI requests (AI Gateway).

Neon: the database that holds nearly everything listed above.

Upstash: short-lived live activity and limits on how much runs at once, through Vercel.

Stripe: payments, tax, invoices and the billing portal.

Resend: the mail we send you, such as invites, sign-in codes, billing notices and storage warnings.

Cloudflare Turnstile: a bot check on the waitlist and some account forms.

Our render computer: a computer we run at our own premises in Poland makes your final videos. It collects each job over an encrypted connection and does not hold the production database.

AI, when you pay with credits

When your channel pays with credits, your prompts, scripts, text, images and video frames go to the provider that does the work. By default, new uploads are also described by an AI vision model so you can search them. A channel can turn that off.

Anthropic, OpenAI and Google: AI models for agents and chat, directly or through the Vercel AI Gateway.

OpenAI and Pollinations: image generation.

Luma: video generation.

ElevenLabs: voice, sound effects, music, voice cloning and speech to text.

AI and storage you link yourself

If you link your own account, the data goes to that provider under your agreement with them. This can include xAI (Grok), OpenAI, Anthropic, Google, ElevenLabs, Luma, your own S3-compatible bucket, Google Drive, Dropbox and OneDrive.

Stock libraries

Pixabay, Freesound and Openverse get the search words and the file requests. Do not put personal details in a stock search.

Sign-in and publishing

Google and GitHub take part if you sign in with them. YouTube (Google), Instagram and Facebook (Meta) and Discord get what you publish and return stats.

If you connect YouTube, we use YouTube API Services, and the Google Privacy Policy applies. You can remove our access in your Google account settings as well as in Syndcast. After you revoke access, YouTube stats and captions go within 7 days. A short reference note about a past video can stay in your channel's knowledge.

Our own alerts

Healthchecks.io and Pushover get service alerts that go to us. GitHub may hold a copy of the words in a report you send, without your email, name or user id.

This is what the code does today. When a channel, project or piece is removed, it is hidden from you right away and waits 30 days.

Gone after the 30 days

Main, proxy and playback files of your media, and the output files of your renders.

Publishing tokens, your own provider keys and storage details.

Channel memberships, invitations and lapsed subscription rows.

Kept after the 30 days, with no end date

Scripts, timelines, clip positions, styles, brand kits and knowledge notes.

Chats with agents, transcripts, tasks, memories and what agents looked at and chose.

Workspace logs, and the record of each file: its description, poster picture and sound waveform.

Credit and storage ledgers.

We keep these to improve Syndcast. Ask us and we remove them (see "Your rights").

Other periods

Your account: we wait 30 days after you ask, so you can change your mind. Then your login, sessions, passkeys and two-factor data end, your name, email, username and picture are removed, and you leave every channel. Channels only you are in are deleted with it, and any plan on them ends at the end of the paid period. If other people are in a channel you own, you first hand it over to one of them or delete it. A deleted channel's files are removed after 30 days. We keep a record of the work to improve Syndcast; ask us and we remove it.

Sessions: they end after 7 days without use, and expired ones are cleared daily.

Stats from platforms: day numbers go at the platform's deadline, 30 days after a token stops refreshing or 7 days after you revoke.

Waitlist rows and your reports: kept with no end date.

Invoices: kept for 5 years from the end of the tax year, as tax law requires.

Backups: the database keeps recovery history for up to 30 days.

Machine learning files: the daily number files are kept for as long as we use them to improve Syndcast's agents.

You can ask us for a copy of your data, to correct it, to erase it, to restrict how we use it, or to send it to you in a portable form. You can object to any use based on our legitimate interest. To do any of this, write to support@syndcast.com. We answer within one month.

If you think we got it wrong, you can complain to a data protection authority, for example the Personal Data Protection Office in Poland (UODO), or the one where you live.

Erasure

If you ask us to erase a channel, a person on our side checks it and removes the channel and everything it owns, files and records included. This cannot be undone.

What you can do yourself

You can download your library files, export your channel's knowledge notes, change your account details, and delete your channel or account. There is no one-button export of all your data yet. Ask us and we will prepare it.

The people in your channel see its work, according to their roles. Your channel's data does not cross to another channel's agents.

Your profile page needs a sign-in. Anyone signed in can see your name, username, picture and lifetime counts, such as projects created. Of your channels and projects, they see only the ones they can already reach, and there is no switch to show more. Your email is shown only to you.

A share link opens one file for anyone who has the link, with no account. We count how often it is opened, and you can stop it at any time.

Our staff can see data through the admin panel when they need to help you, fix a fault or handle a legal request. An administrator can also sign in as you to fix a fault, and that is recorded.

Traffic is encrypted. Agent tokens are stored as hashes. AI keys you link are sealed with AES-256-GCM. Publishing tokens are protected by the database's disk encryption, not sealed one by one. Two-factor sign-in and passkeys are available.

No system is perfect. If a breach puts you at risk, we will tell you and the authority as the law requires.

We use cookies to keep you signed in, and your browser stores settings such as your layout and sounds. Cloudflare Turnstile may use its own storage to tell people from bots.

We do not use analytics or advertising trackers.

Syndcast is not for anyone under 18. If you think a child has given us personal data, write to support@syndcast.com and we will remove it.

Agents make choices inside your channel, and you decide what stays. We do not make decisions about you by automated means that have a legal or similar effect on you.

If we change this page in a way that matters, we tell you before it takes effect. The date at the top says when it last changed. Our Terms of Service are a separate page.