Synthesia — privacy & data policy

Provider: Synthesia. PromptPrivacy score: 61/100. Last verified October 18, 2026.

What happens to your data?

Synthesia processes the scripts, audio, and video files you upload to generate AI avatar videos based on your or your employer's instructions. Account details and platform usage patterns are collected to operate the service and improve underlying AI models and safety. Biometric data captured during custom avatar creation is authenticated, used for avatar generation, and verification recordings are deleted shortly after processing.

Does it train on your data?

Synthesia processes usage information and other user-provided interactions under legitimate interest to research underlying technologies, improve the platform, and enhance model capabilities and safety. Additionally, biometric sample uploads are used to fine-tune AI models to generate customized avatars performing user-provided inputs.

Can you opt out?

Users can withdraw consent for consent-based processing, manage cookie preferences, or object to legitimate interest processing by emailing support@synthesia.io. For avatar creation, users can choose not to consent to automated biometric processing and opt for manual studio avatar verification instead.

Data retention

Customer Data (including scripts, uploaded media, and generated videos) is retained according to the customer's instructions, contract terms, and platform settings. Biometric verification recordings used during avatar creation are stored only until comparison results are confirmed (usually within minutes) and then permanently deleted. Other information, such as account and technical logs, is retained as long as necessary to deliver services, meet legal obligations, resolve disputes, and pursue legitimate business interests.

Encryption & security

Synthesia states that it implements security measures and procedures to protect personal data against misuse, unauthorized access, disclosure, or modification. However, specific encryption protocols (such as TLS in transit or AES at rest) and compliance certifications are not detailed in the policy text itself, referring users to a separate Security Practices page.

Is it safe for work?

Yes, Synthesia is designed for business and enterprise use, acting as a data processor under a Master Subscription Agreement and Data Processing Addendum (DPA) where the customer retains control over Customer Data. Organizations should ensure their agreement terms clearly reflect their preferences regarding platform usage data and model improvement.

Source policy: https://www.synthesia.io/legal/privacy-policy