Privacy & AI Policy

Last updated: October 2026

Synthagma ("Synthagma", "we", "us") respects your privacy and is committed to protecting the personal data of everyone who visits this website, contacts us, or works with us. This policy explains what data we collect, why we collect it, how long we keep it, and what rights you have over it.

The page has two parts. Part A is our privacy policy. Sections 1 to 7 describe how we handle personal data as a data controller — that is, data about visitors to this website and people who get in touch with us. Section 8 describes how we handle personal data as a data processor, when that data reaches us inside material entrusted to us by a client. Section 9 explains how AI affects the handling of data in both situations, and sections 10 to 12 set out your rights and how to reach us, whichever situation applies to you. Part B sets out the principles and commitments that govern how we use AI in our work.

Part A — Privacy Policy

1. Who we are

Synthagma is a marketing, localization, and technology consultancy operated by Vladislav Strestian, based in Chișinău, Republic of Moldova. We are the data controller for the personal data described in sections 2 to 7 of this policy. For any question about this policy or your data, you can reach us at contact@synthagma.net.

As an organisation established in Moldova, we process personal data in accordance with Law No. 195/2024 on the Protection of Personal Data, which has been in force since 23 August 2026 and brings Moldovan data protection law into alignment with the European Union's General Data Protection Regulation (GDPR). Where we offer services to, or process data about, individuals located in the European Economic Area, we also apply the standards of the GDPR itself. Our supervisory authority is the National Centre for Personal Data Protection of the Republic of Moldova.

2. Data we collect through this website

We collect personal data through this website in the following ways:

Contact form. When you submit our contact form, we collect the name, email address, and any message content you choose to provide. We use this solely to respond to your inquiry and, if a working relationship follows, to manage that relationship.

Third-party analytics. We use Plausible Analytics and Vercel Analytics to understand how visitors use this site. Both tools are privacy-focused by design: they do not use cookies, do not track individuals across sites, and do not collect or store personal identifiers such as IP addresses in raw form. The data they provide us is aggregated — for example, page view counts, referral sources, and general geographic region derived from an anonymized IP.

Our own analytics. We also operate analytics software that we built ourselves, running on a private server we rent from Hetzner Online GmbH in Germany. It records only three things about a visit: the country it came from, which pages on this site were opened, and the type of device used. It sets no cookies, assigns no visitor ID, and creates no fingerprint or other identifier, so repeat visits cannot be linked to one another. The country is determined at the moment of the request and the IP address is not stored. Because we host this tool ourselves, what it records stays on infrastructure we control and is not shared with any analytics vendor.

Server logs. Our hosting providers automatically generate technical access logs as a necessary part of delivering this website. These may include IP addresses, timestamps, and requested pages. We use them only for security, abuse prevention, and diagnosing technical faults, and they are retained for a short period in line with each provider's standard settings.

3. Why we process your data

Our legal basis for processing depends on the data in question:

• Contact form submissions are processed based on our legitimate interest in responding to inquiries, and where a contract or engagement follows, based on the performance of that contract.
• Analytics data is processed based on our legitimate interest in understanding and improving the website. Because the analytics tools we use are cookieless and do not process personal data in identifiable form, this does not require cookie consent under applicable law.
• Server logs are processed based on our legitimate interest in keeping this website secure, available, and functioning correctly.

4. Cookies

This website does not use cookies for analytics or advertising. If that changes in the future, we will update this policy and, where required, request your consent first.

5. Who we share data with

We do not sell or rent your personal data. We share it only with:

• Plausible Analytics and Vercel Analytics, as processors providing the aggregated site statistics described above.
• Vercel Inc., as our website hosting provider.
• Hetzner Online GmbH, as the infrastructure provider for the analytics software we host ourselves.
• Proton AG, as our email service provider, for messages sent via the contact form or directly to us.

We do not otherwise disclose your data to third parties, except where required by law.

6. International data transfers

We are based in Moldova, and some of the providers listed above process data elsewhere, including in the European Union and the United States. Where a transfer involves personal data originating in the European Economic Area, those providers rely on recognized safeguards such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. Transfers of personal data out of Moldova are carried out in accordance with the conditions set out in Law No. 195/2024.

7. How long we keep your data

Contact form submissions are retained only as long as needed to handle your inquiry or, if a working relationship begins, for the duration of that relationship plus any period required by applicable tax or accounting law. Records from the analytics software we host ourselves are kept for twelve months and then deleted. Data held by Plausible Analytics and Vercel Analytics is retained according to those providers' own standard settings. None of this analytics data contains personal identifiers. Server logs are kept only for as long as they are useful for security and diagnostics.

8. Client data: our role as a processor

Our work frequently involves handling material supplied by clients — source files, website and product content, support tickets, marketing copy, spreadsheets, exports from internal systems — and that material sometimes contains personal data about our clients' own customers, employees, or users. This section explains how we handle it.

Roles. Where personal data reaches us inside client material, the client is the data controller and Synthagma acts as a data processor on their behalf. We process such data only on the client's documented instructions, and only for the purposes of the engagement we have been contracted to deliver. We never use client material for our own purposes, and we do not sell, rent, or otherwise commercialise it.

Data processing agreements. Where an engagement involves personal data and a data processing agreement is required, we will agree one with the client — setting out the subject matter and duration of processing, the categories of data and data subjects involved, and the obligations of both parties. We are equally happy to work from a client's own standard agreement. Clients can raise this with us at contact@synthagma.net.

Sub-processors. Delivering our work sometimes requires involving others: linguists, editors, and specialist contractors; infrastructure and storage providers; and, where an engagement calls for it, machine translation or other AI services. Everyone we engage is bound by written confidentiality obligations, and we only involve sub-processors with access to the data a given task actually requires. We will tell any client which sub-processors are involved in their engagement on request, and give notice before making a material change to them.

Security. We apply technical and organisational measures appropriate to the material we handle, including access controls scoped to the minimum each person needs, encryption of data in transit and at rest, separation of client material between engagements, and prompt revocation of access when a contributor's involvement ends.

Incidents. If we become aware of a personal data breach affecting client material, we will notify the affected client without undue delay, with the information they need to assess the incident and meet their own notification obligations, and we will cooperate fully in investigating and containing it.

Return and deletion. At the end of an engagement, we return or delete client material at the client's choice, except where we are required to retain something by law. Linguistic assets such as translation memories and terminology bases belong to the client and are handed over in a usable format on request.

If you are an individual whose data was handled this way. Because the client is the controller of that data, requests to access, correct, or delete it should be directed to them. If you contact us instead, we will pass your request on to the relevant client and assist them in responding to it.

9. AI and automated processing

AI-assisted workflows are part of how we work, so we want to be direct about what that means for data. We do not use client material to train, fine-tune, or customise any AI model, and we do not contribute it to the training of publicly available models. Where an engagement involves a third-party AI or machine translation service, we use business or enterprise plans under terms that exclude submitted content from being retained or used for model training — never free or consumer tiers, whose terms often permit exactly that. Clients can ask which services are involved in their own engagement at any time, as described in section 8.

We do not make decisions producing legal or similarly significant effects about any individual on the basis of automated processing alone, and we do not carry out profiling of visitors to this website.

How AI is used in the work itself — including human review, transparency, and what we will not do with AI — is set out in Part B.

10. Your rights

Under Law No. 195/2024, and under the GDPR where it applies to you, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data
• Object to or request restriction of processing
• Request a portable copy of your data
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise any of these rights, email contact@synthagma.net. We will respond within the period required by applicable law, and at the latest within one month of receiving your request. There is no charge for making a request.

If you believe we have handled your data improperly, you can complain to the National Centre for Personal Data Protection of the Republic of Moldova. If you are located in the European Economic Area, you may also complain to the supervisory authority of the country where you live or work.

11. Policy updates

We may update this policy to reflect changes in our practices or in applicable law. The "last updated" date at the top of this page will always reflect the most recent revision.

12. Contact

Questions about this policy or how your data is handled can be sent to contact@synthagma.net.

Part B — AI Governance

AI is part of how Synthagma works across localization, marketing, workflow automation and consultancy. This part sets out the principles that govern that use and the commitments we make to clients. It applies to every engagement and to everyone who works on Synthagma projects, including contractors.

How we handle personal data and client material when AI is involved is covered in Part A (sections 8 and 9). This part covers how AI is used in the work itself.

B1. Our principles

Seven principles guide every use of AI at Synthagma.

1. People decide, AI assists. A named person is accountable for every piece of work. Responsibility never sits with a tool.
2. Confidential by default. Client material is used only for the engagement it was provided for, and never to train AI models.
3. Quality before speed. AI output is a draft until a qualified person has reviewed and approved it.
4. Honest about AI. We tell clients how AI is used in their work and never present machine output as something it is not.
5. Used where it helps. We use AI where it improves the result, the turnaround or the cost for the client, not by default.
6. Fair and culturally aware. We check output for bias, stereotypes and cultural missteps, especially across languages and markets.
7. Kept under review. We revisit our tools, practices and this policy as technology and law change.

B2. Human oversight and quality

Every AI-assisted deliverable is reviewed, edited and approved by a person before it reaches a client. How that review works depends on the service:

• Localization. A linguist fluent in the target language checks meaning, terminology, tone and cultural fit. Client glossaries and style guides take precedence over AI suggestions.
• Marketing. Facts, figures and product claims are checked against sources the client has provided. AI is never used to invent statistics, testimonials or claims.
• Workflow automation. Automations we build include a human checkpoint wherever a decision affects people, money or legal rights. They are tested before handover, and we document where AI is involved.
• Consultancy. AI may support research and analysis, but our recommendations are our own professional judgment, checked and owned by us.

If an error is found in a deliverable after delivery, we correct it promptly.

B3. Confidentiality and client material

Client material stays confidential when AI is involved, under the rules in Part A (sections 8 and 9). In practice:

• No training. Client material is never used to train, fine-tune or improve any AI model, ours or a provider's.
• Business-grade services only. For client work we use only business or enterprise AI services whose terms exclude training on, and limit retention of, submitted content. We never use free or consumer AI tools for client work.
• Only what the task needs. We put into AI tools only the material a task requires. Where practical, we remove or mask personal data and sensitive details first.
• Restricted material. Material a client marks as restricted, such as unreleased products or legal, financial or health information, is never processed with AI tools. It is handled by people only.
• Controlled access. Access is limited per engagement. Everyone who works on Synthagma projects is bound by written confidentiality obligations and by this policy.

B4. How we select and manage AI tools

We keep an internal register of approved AI tools, and only approved tools may be used for client work. A tool is approved only after we check:

• that its terms exclude training on submitted content and limit how long that content is retained
• where it processes data, and that transfers are safeguarded as described in Part A (section 6)
• its security, including encryption, access controls and the provider's track record
• its quality for the specific task and language pairs

We review the register at least every six months, and whenever a provider materially changes its terms. Contractors may use only approved tools for Synthagma work.

We do not publish the names of the tools we use, because our tool choices and workflows are commercially confidential. Clients can request the current list of sub-processors, including AI services, as described in Part A (section 8), and we give notice before any material change.

B5. Transparency about AI use

Clients always know whether, and how, AI is used in their work.

• Before work starts. Our proposal or statement of work says whether AI will be used in the engagement and for which tasks.
• On request. We tell clients which parts of a deliverable were AI-assisted.
• No misrepresentation. We never present AI-assisted work as produced without AI.
• Labelling support. Where clients need to label AI-generated content they publish, for example under the EU AI Act's transparency rules or platform policies, we help them do so.
• AI that talks to people. Chatbots, assistants or automated messages we build for clients are designed to make clear that people are dealing with AI.

B6. What we will not do with AI

We will not use AI to:

• create synthetic images, video or voices of real people without their documented consent
• write fake reviews, testimonials or endorsements, or impersonate real people or organisations
• produce misleading claims, invented statistics or content designed to deceive
• profile or manipulate people, or make decisions with legal or similarly significant effects on individuals without human involvement
• reproduce copyrighted material, trademarks or third-party branding without permission
• process data we are not authorised to process

We decline work that would require any of the above.

B7. Ownership of AI-assisted work

Clients own the final deliverables they pay for, including AI-assisted parts, as set out in their engagement agreement.

• Deliverables. Once paid in full, final deliverables belong to the client, to the extent the law allows. Copyright protection for content generated purely by AI may be limited in some jurisdictions. Our human editing and review strengthen the client's position.
• Client assets. Translation memories, glossaries and terminology bases built for a client remain the client's, as described in Part A (section 8).
• Third-party rights. Human review, and originality checks where appropriate, reduce the risk that AI output reproduces someone else's protected material.
• Our methods. Our methods, templates, prompts and workflows remain Synthagma's.

B8. Your choices

Clients decide how much AI is used in their work.

• Opt out. A client can ask us not to use AI in their engagement, or for specific materials. We confirm this in writing and agree any change to timeline or price before work starts.
• Limit it. A client can restrict AI to certain tasks, for example machine translation with full human post-editing but no generative AI.
• Ask anytime. Questions about how AI is used in a project can be raised at any point.

B9. Accountability, review and contact

Vladislav Strestian, founder of Synthagma, is accountable for this policy and for how AI is used in our work.

• Contractors. Everyone who works on Synthagma projects is briefed on this policy and bound by it.
• Legal framework. We follow Moldova's Law No. 195/2024 on the Protection of Personal Data. Where our work reaches people in the EU, we also follow the EU AI Act's obligations as they apply to us.
• Review. We review this policy at least once a year, and whenever relevant law or our tools change materially. The "last updated" date at the top of this page reflects the latest revision.
• Questions or concerns. Write to contact@synthagma.net. We aim to respond within five business days.