Privacy Policy

1. Controller

SYNCON Labs GmbH Adalbertstraße 56 80799 Munich Germany

Email: reach@theconsumer.ai

2. Scope

This privacy policy explains how we process personal data when you visit our website www.theconsumer.ai, contact us, request a demo, or subscribe to our newsletter, and when you use our app at app.theconsumer.ai. Sections 3 to 13 cover the website, sections 14 to 23 cover the app, and all other sections cover both.

We comply with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3. Hosting (Vercel)

Our website is hosted by Vercel Inc. (USA). Server-side processing, such as submitting forms, takes place in data centres in Frankfurt. Static content is delivered via Vercel's global content delivery network, usually from the location closest to you.

Vercel processes data on our behalf under a Data Processing Agreement (DPA) in compliance with Art. 28 GDPR. Where data is transferred to the USA, this is secured by EU Standard Contractual Clauses (SCCs).

Vercel may log technical data to ensure secure and efficient website delivery:

• IP address
• Browser type and version
• Operating system
• Date and time of access
• Referrer URL

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website functionality and security).

4. Fonts (Google Fonts)

This website uses Google Fonts, self-hosted via our own infrastructure. No connection to Google servers is established when you visit our website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in consistent visual presentation).

5. Web Analytics on the Website (PostHog)

We use PostHog for web analytics. The provider is PostHog Inc. (USA). Data is stored in PostHog's EU cloud in Frankfurt and transmitted via our own subdomain t.theconsumer.ai. We have a Data Processing Agreement (DPA) with PostHog in accordance with Art. 28 GDPR.

Data collected:

• Page URLs visited
• Clicks on the page
• Session data
• Browser and device information
• Web performance metrics

Data explicitly not collected:

• Form input values
• Session recordings (disabled)
• Keystroke data

PostHog sets session cookies (ph_*) to distinguish between visitors.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our website).

You can opt out by enabling Do-Not-Track in your browser settings or by contacting us at reach@theconsumer.ai.

6. Spam Protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect our forms against spam and abuse. When you submit a form, Turnstile may collect:

• IP address
• Browser user agent
• Behavioral and interaction data

Cloudflare is based in the USA. Data transfer is secured by EU Standard Contractual Clauses (SCCs).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fraud prevention and website security).

7. Contact Form

When you contact us via our online form, we collect:

• Name
• Email address
• Company (optional)
• Message content

We use this data solely to respond to your inquiry. Your message is delivered via Resend (see section 10) and our team is notified via Slack (see section 11).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual communication).

We delete your data 24 months after our last contact with you, or earlier if you ask us to.

8. Demo Request

When you request a demo, we collect:

• Name, email address, company, phone (optional)
• Your role
• Your goals and your first test idea

We use this data to prepare your demo. It is sent to our team by email via Resend (see section 10), and our team is notified via Slack (see section 11).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps).

We delete your data 24 months after our last contact with you, or earlier if you ask us to.

9. Event Request (/reach)

On theconsumer.ai/reach, which we link via QR code at events, you can leave us your contact details. We collect:

• Name, email address, company
• Your use case
• Your question for us (optional)

We use this data to contact you after the event. It is sent to our team by email via Resend (see section 10), and our team is notified via Slack (see section 11).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps).

We delete your data 24 months after our last contact with you, or earlier if you ask us to.

10. Email Delivery (Resend)

We use Resend Inc. to deliver emails for internal notifications about contact, demo and event requests, and for newsletter messages.

Resend processes the following data on our behalf:

• Email address
• Name
• Message content

Resend is based in the USA. Data transfer is secured by EU Standard Contractual Clauses (SCCs).

Legal basis: Art. 6(1)(b) GDPR (contract fulfilment) and Art. 6(1)(f) GDPR (legitimate interest in reliable email delivery).

11. Internal Notifications (Slack)

When you submit a contact, demo or event request, we send an internal notification to our team via Slack.

The notification contains the data you provided in the form. Only our team has access to these messages — no third parties.

Slack (Salesforce) is based in the USA. Data transfer is secured by EU Standard Contractual Clauses (SCCs).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient internal communication).

12. Newsletter (Double Opt-In)

When you subscribe to our newsletter, we collect your email address only.

We use a double opt-in process:

• You enter your email address
• We send a confirmation email with an encrypted link (AES-256-CBC)
• Your subscription is activated only after you click the confirmation link
• The confirmation link expires after 24 hours

Newsletter emails are delivered via Resend (see section 10). Your contact record is managed through Resend.

Legal basis: Art. 6(1)(a) GDPR (consent).

You can withdraw your consent at any time by contacting reach@theconsumer.ai.

For privacy protection, our system does not disclose whether an email address is already registered.

13. Cookies on the Website

Our website uses the following cookies:

• Cloudflare Turnstile (__cf_bm) — necessary for bot detection and spam prevention
• PostHog (ph_*) — analytics session tracking

We do not use a cookie consent banner. Analytics cookies are set based on our legitimate interest in improving our website (Art. 6(1)(f) GDPR).

You can block or delete cookies at any time through your browser settings.

14. App: Account, Team and Content

Our platform at app.theconsumer.ai (the "app") is used by our customers' employees in teams. Accounts are created by invitation only. We process:

• Account data: name, email address, password (stored only as a hash) or your Google account if you sign in with Google
• Team data: memberships, roles, invitations, your team's plan and billing status
• Content: threads and messages with our research agent Iris, study designs, uploaded materials, panels, reports and exports
• Technical data: IP address, browser and device information, access times, logs and error reports

We use this data to provide the app, run and analyse studies, bill your team's usage and operate the app securely.

Responsibility: we process a team's content on behalf of our customer under a data processing agreement (Art. 28 GDPR). The customer, usually your employer, is the controller for this content. We forward requests about this content to the customer. We are the controller for account and team data, technical data, billing and product analytics (section 21).

Legal basis: Art. 6(1)(b) GDPR where you are our contracting party yourself. If you use the app for your employer, Art. 6(1)(f) GDPR (legitimate interest in providing the service agreed with your employer). For operating the app securely, Art. 6(1)(f) GDPR.

Retention:

• We delete account data when your account is deleted.
• We delete content and team data 90 days after the end of the contract with our customer.
• We keep billing data for as long as statutory retention obligations apply, up to ten years (Section 257 HGB, Section 147 AO).
• Logs, error reports and AI processing monitoring data are deleted after 90 days at the latest.
• Deleted data disappears from backups when these are overwritten in the regular cycle.

15. App: Hosting, Database and Sign-in

Like the website, the app runs on Vercel (see section 3). Server-side processing takes place in data centers in Frankfurt.

Supabase operates the app's database, authentication and file storage on our behalf in data centers in Frankfurt (eu-central-1). Our contractual partner is Supabase Pte. Ltd. (Singapore). We have a data processing agreement (DPA) with Supabase in accordance with Art. 28 GDPR.

So that a running response from Iris continues after you reload the page, we pass parts of the response through a messaging service of Upstash Inc. (USA) in Frankfurt. Upstash only stores an identifier of the response and its status and deletes both after 24 hours. The response itself is stored only in our database. We have a DPA with Upstash.

If you sign in with Google, Google learns about the sign-in and we receive your name and email address from Google.

Legal basis: as described in section 14; for secure and reliable operation, Art. 6(1)(f) GDPR.

16. App: AI Processing

Iris, study analysis and other features of the app use AI models. For this we send the content each task needs, for example your messages, study designs, materials, your team's context and answers from studies. We use only Gemini models from Google for this, processed in data centers in the EU:

• Google Cloud Vertex AI (Google Cloud EMEA Ltd., Ireland): Iris, translations, quality checks, study analysis, naming threads and creating panels including images. We have a DPA with Google in accordance with Art. 28 GDPR.
• Vercel AI Gateway (Vercel Inc., USA): forwards some of these requests to Gemini at Google. The gateway may accept a request in any Vercel data center, including outside the EU. It deletes inputs and outputs once the request is complete and logs only technical details such as model, token counts and status. We send every request with the "Zero Data Retention" setting, under which the model provider does not store inputs and outputs either. Our DPA with Vercel (see section 3) also covers the AI Gateway.

Legal basis: as described in section 14.

17. App: Running Studies

Studies are run by our own study system. It creates panels of Dynamic Personas and Premium Twins and their answers. For this it receives your team's identifier, the study content and the stimuli, but not your name or email address.

The study system runs on Railway Corp. (USA) in data centers in the EU (region EU West). Its database is hosted by Supabase in Frankfurt (eu-central-1). It uses Google Cloud Vertex AI in the EU for the answers and stores stimuli in Google Cloud Storage in the EU for this purpose. It reports errors to Sentry in the EU and technical metrics of AI calls, without content, to Langfuse (see section 18). We have a DPA with Railway in accordance with Art. 28 GDPR.

Legal basis: as described in section 14.

18. App: Error and Quality Monitoring

Sentry (Functional Software Inc., USA): we record errors and load times in the app and on our servers to fix problems quickly. The data is stored in Sentry's EU region in Germany. Sending of default personal data is turned off, and session recordings (Session Replay) are disabled. Error reports may contain technical details about your browser and the page you visited. We have a DPA with Sentry in accordance with Art. 28 GDPR.

Langfuse (Langfuse GmbH, Germany): we monitor the quality, duration and cost of AI processing. Langfuse stores the data in the EU (Ireland). The app and our study system send only technical details (model, duration, token counts), no content. We have a DPA with Langfuse in accordance with Art. 28 GDPR.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure operation and reliable results).

19. App: Payments (Stripe)

We handle your team's subscriptions and payments through Stripe. At checkout you enter your payment details directly with Stripe; we do not receive complete payment details. We send Stripe the purchaser's email address and receive the status of the subscription and payments from Stripe.

Our contractual partner is Stripe Payments Europe, Limited (Ireland). Stripe acts as an independent controller for fraud prevention, statutory checks such as anti-money-laundering checks and the selection of payment routes; Stripe's privacy policy applies to these. Otherwise Stripe processes the data on our behalf. Stripe may transfer data to Stripe companies in the USA (see section 26).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

20. App: Emails (Resend)

We send emails from the app, such as invitations, sign-in and password emails and notifications, through Resend (see section 10). Resend processes your email address, your name and the content of the email.

If you have agreed to it, we occasionally inform you about new features of the app by email. For this we store your email address and language as a contact at Resend. You can unsubscribe from these emails at any time via the link in every email or at reach@theconsumer.ai.

Legal basis: Art. 6(1)(b) GDPR for emails related to using the app, Art. 6(1)(a) GDPR (consent) for emails about new features. You can withdraw your consent at any time with effect for the future.

21. App: Product Analytics (PostHog)

To understand how teams use the app, at which steps they get stuck and which features they use, we use PostHog (PostHog Inc., USA) in the app. We use a separate PostHog project for this, independent of the website analytics. The data is stored in PostHog's EU cloud in Frankfurt and transmitted via our own subdomain t.theconsumer.ai. Only the app's production environment sends data. Our DPA with PostHog (see section 5) also covers the app.

How product analytics works in the app:

• For analytics, the app sets no cookies and uses neither local storage nor session storage.
• You are recognised only by your user ID (pseudonymous). We do not send your name or email address. Email addresses in captured text are removed before sending.
• PostHog does not store IP addresses in the app project, and we do not derive a location from them.
• We analyse teams as a group, with the team name, plan and whether it is an internal team.
• From the addresses of visited pages we send only campaign parameters (utm_*) as parameters, and only the domain of the referrer.

Data collected:

• Page views and page leaves
• Clicks on elements of the app, including the visible text of the clicked element
• Browser and device information
• Events from our servers for business steps, for example team created, study started, report ready, export downloaded or subscription changed. They contain only identifiers, enumerated values and numbers, never free text, and state whether a member, Iris, an integration or the system triggered the step.

Data explicitly not collected:

• Answers of the Dynamic Personas and Premium Twins (raw answers) in the events we define
• Clicks in quotes and answers from studies, and in areas that show names or email addresses of people (invitations, member and invitation lists, profile)
• Input field values and keystrokes
• Session recordings (disabled)
• Events while one of our administrators is signed in as a user for support purposes, including studies they start during that time

If you click on text inside a chat message or on a thread preview, the visible text of that element may be captured.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving and developing the app). Because the app stores nothing on your device for analytics, we do not ask for consent.

Objection: if you enable Do-Not-Track or Global Privacy Control in your browser, no product analytics takes place in your browser. Events from our servers are still recorded. You can also object to product analytics at any time at reach@theconsumer.ai. After that you are permanently no longer recorded as a person, including by background processes or integrations, and we delete your existing data in PostHog. Steps you trigger for your team then count only for the team, without reference to you.

Retention: the data is kept for as long as your account exists. If your account is deleted, we delete your person including its events in PostHog within one month. At the latest, PostHog deletes events when the retention period of our plan expires.

22. App: Cookies and Local Storage

The app stores on your device only what is needed for sign-in and operation:

• Cookies for your sign-in (Supabase session)
• Cookies for the last selected team, the language and the state of the sidebar
• Local storage entries for view settings, such as the width of panes, open threads, the color scheme and the last used sign-in method

The app stores nothing on your device for product analytics. We therefore do not show a cookie banner.

Legal basis: Section 25(2) No. 2 TDDDG (strictly necessary) and Art. 6(1)(b) GDPR.

23. App: Integrations

Your team can connect the app to other applications, for example Claude or ChatGPT as a Connected App, or via a Team API Key. The app releases data that a connected application retrieves through these channels on your team's instructions. The provider of the application does not process it on our behalf but under its contract with your company or with you. Its privacy policy applies.

Legal basis: as described in section 14.

24. Your Rights under the GDPR

You have the following rights:

• Access to your personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure ("right to be forgotten", Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

To exercise your rights, please contact: reach@theconsumer.ai

If you believe we have processed your data unlawfully, you have the right to lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA) — https://www.lda.bayern.de

25. Data Security

We implement the following security measures to protect your data:

• SSL/TLS encryption for all data transmission
• AES-256 encryption for newsletter confirmation tokens
• Masked input fields in analytics (no form data recorded)
• Role-based access control for internal systems

26. International Data Transfers

Some of our service providers are based outside the EU, in the USA or in Singapore. We secure transfers there with EU Standard Contractual Clauses (SCCs) in accordance with Art. 46(2)(c) GDPR. Where a recipient in the USA is certified under the EU-US Data Privacy Framework (DPF), we additionally base the transfer on the European Commission's adequacy decision (Art. 45 GDPR). The table shows the safeguard for each service provider.

27. Changes to this Policy

We may update this privacy policy from time to time. The current version will always be available on our website.