Privacy policy

Synodic Studio ("Synodic", "we", "us") operates www.synodicstudio.com and is the data controller for the personal data described in this policy. That means we decide why and how your data is processed and we are responsible for it.

Synodic Studio is a trade name, not yet a registered company, so there is no company registration number to give. Until there is one, the controller is the studio's two founders, Nicklaz Lentz and Kian Nikolaj, acting jointly. We will state the registered name and CVR number here as soon as the company exists.

As joint controllers we have agreed in writing how we share responsibility under Article 26 GDPR. That arrangement covers all four Synodic services: www.synodicstudio.com, SynodicAC, Synodic Store and Synodic Support. Nicklaz Lentz is the point of contact for questions and requests about personal data and makes sure they are answered, but you may exercise your rights against either of us.

The studio is based in Aarhus, Denmark. You can reach us about anything in this policy at contact@synodicstudio.com, and that address is also the fastest way to reach the people who handle data here. We have not appointed a data protection officer, because the scale and nature of our processing does not require one under Article 37.

This policy applies only to www.synodicstudio.com and to email or other correspondence you have with us through it. Synodic Studio also runs three other services, and each has its own privacy policy in the tabs at the top of this page: SynodicAC, our anticheat, with its status page at ac.synodicstudio.com; Synodic Store at store.synodicstudio.com; and Synodic Support at support.synodicstudio.com. The same joint controllers are responsible for all four. When you follow a link from this site to one of them, that service's own policy applies to what happens there.

It does not cover the products we build or run together with partners, such as MineClub and MCCatalog. Those are separate services with their own privacy notices, and when you leave this site through a link to one of them, their terms take over.

It also does not cover data we process for clients as part of a project. In those engagements we usually act as a data processor on the client's instructions, and the client's own privacy notice is the one that applies to their users.

We collect personal data in a few narrow situations.

When you email us directly

Your email address, your name if it is in the message, and whatever you choose to include. Email threads about a possible project are kept together so we can follow the conversation.

When you write to us about working with us

Whatever you send: your name, your email address, your CV or portfolio if you attach one, and anything else in the message. This covers a job, an internship or student placement, freelance work, or simply asking whether there is room for you. We treat it as an application even when there is no open role.

When your browser requests the site

Like every website, the servers that deliver www.synodicstudio.com see technical data with each request: your IP address, the browser and device type, the page requested, the time, and the address of the page that linked to us. This is standard server log data, and we keep it for no more than 30 days.

When the homepage shows SynodicAC's live status

The status panel on the homepage is filled in by our server when the page is built. After that, while the page is open, your browser asks ac.synodicstudio.com for an update about once a minute. That address is our own SynodicAC service, run on the same Hetzner servers in the EU, not a third party. Each request carries only what any browser request does (your IP address, browser type and the time), sends no cookie or identifier, and is logged like any other request to our servers. The answer contains only the service's health figures, nothing about you. The status badge in the footer is a plain link to the same service.

When you ask Orbit a question

Orbit, the assistant on this site, sends what you type to our server so it can look up an answer in the site's own content. Nothing is passed to an AI provider or any other third party, and we do not save your questions. Please do not type personal details into it.

We do not ask for, and would rather not receive, sensitive categories of data such as health information, political opinions or government identifiers. Please leave them out of your messages.

www.synodicstudio.com sets no cookies, first-party or third-party. It stores nothing in your browser's local storage, session storage or any other browser storage. Your language is carried in the page address (for example /da), and small things such as a skipped intro or a closed help button are kept only in the open page's memory and forgotten when you reload or leave. It does not run analytics, session recording, heat maps, advertising pixels or social media plugins, and it does not fingerprint your device. Because of that there is no cookie banner: there is nothing to consent to.

Fonts, video and images, including the team's Roblox avatars, are served from our own domain rather than from a third-party network, so opening a page does not send your address to a font or media provider. The community figures on the homepage are fetched by our server, not by your browser, from Discord's and Roblox's public APIs, and they are totals only, such as member and visit counts, with no personal data. Apart from our own SynodicAC status service described above, your browser contacts no other site unless you follow a link. If we ever add a service that changes this, we will update this policy first and, where the law requires it, ask for your consent before it runs.

GDPR requires a legal basis for each purpose. Ours are these.

Answering your enquiry and scoping a project

We use the details in your email to reply, ask follow-up questions, prepare a proposal and, if we go ahead, set up the engagement. Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). Where you contact us on behalf of a company, our legitimate interest in responding to business enquiries also applies (Article 6(1)(f)).

Keeping the site secure and available

Server logs help us detect abuse, diagnose faults and defend against attacks. Legal basis: our legitimate interest in running a secure, reliable website (Article 6(1)(f)). We have weighed this against your interests and consider the impact minimal, given how little is kept and for how short a time.

Showing live status and answering Orbit questions

The browser-side status refresh and Orbit's replies are features you see or ask for on the page. Legal basis: our legitimate interest in keeping the site useful and up to date (Article 6(1)(f)). The status refresh shares no more than an ordinary page request, and Orbit questions are not stored.

Considering you for work with the studio

If you write to us about a job, an internship, freelance work or another way of working with us, we read and discuss your application internally and reply. Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b)), and our legitimate interest in finding people to work with (Article 6(1)(f)). We do not run automated screening and no decision about you is made by a machine.

Meeting legal obligations

If a project goes ahead, invoicing and accounting records are kept for as long as tax and bookkeeping law requires. Legal basis: compliance with a legal obligation (Article 6(1)(c)).

Defending our rights

We may keep correspondence where it is needed to establish, exercise or defend a legal claim. Legal basis: legitimate interest (Article 6(1)(f)).

We do not use your data for marketing emails, we do not build profiles, and we do not make decisions about you by automated means.

We keep the circle small. Your data is seen by the people at Synodic who need it to reply to you, and by a limited set of service providers that act as processors on our behalf under written data processing agreements.

• Simply.com, a Danish provider that hosts our mailbox. Messages are stored on their servers in the EU for as long as we keep them under the retention periods below.
• Hetzner, our hosting provider, which provides the servers in the EU that we use to run www.synodicstudio.com and our other services, including SynodicAC's status service. The server logs described above are stored on those servers.

We do not sell personal data, we do not share it with advertisers or data brokers, and we do not pass it to partners without your knowledge. If a project involves introducing you to a partner, we will say so and ask first.

We may disclose data where the law requires it, for example in response to a valid request from a public authority, or where it is necessary to protect our rights or someone's safety.

The servers that deliver www.synodicstudio.com are run by Hetzner in the EU, and our mailbox is hosted by Simply.com in the EU. Visiting the site and emailing us therefore involve no transfer of personal data outside the EU and EEA. The requests our server makes to Discord and Roblox for the homepage's community figures carry no personal data.

If that changes, for example because we start using a provider based outside the EEA, we will update this policy first and rely only on safeguards recognised by GDPR: an adequacy decision by the European Commission, including the EU-US Data Privacy Framework for certified companies, or the Commission's Standard Contractual Clauses together with an assessment of the destination country's laws.

We keep personal data only as long as it serves the purpose it was collected for, then delete or anonymise it. Our default periods are these.

Enquiries that do not lead to a project

Deleted no later than 12 months after our last exchange, so that we can pick the conversation up if you come back within a reasonable time.

Enquiries that lead to a project

Kept for the length of the engagement and afterwards as part of the project record, for up to 5 years after the work ends, unless a longer period is required by law.

Invoices and accounting records

Kept for the period required by applicable bookkeeping and tax law, which in Denmark is currently 5 years from the end of the financial year they concern.

Applications to work with us

Covers jobs, internships, student placements and freelance work alike. Deleted within 6 months of our last exchange if it does not lead to working together. If we would like to keep yours on file beyond that, we will ask you first, and you can say no without it counting against you.

Server logs

Rotated and deleted automatically on our own servers after no more than 30 days, unless a specific log entry is needed to investigate a security incident.

Under GDPR you have a set of rights over your personal data. You can exercise any of them by writing to contact@synodicstudio.com. We will respond within one month, and we will tell you if we need longer for a complex request.

Access

Ask whether we hold data about you and receive a copy of it, along with the information in this policy.

Rectification

Have inaccurate data corrected and incomplete data completed.

Erasure

Have your data deleted where there is no longer a good reason for us to keep it, for example when an enquiry has gone nowhere.

Restriction

Ask us to stop using your data, while keeping it, in certain situations such as while a dispute about accuracy is resolved.

Portability

Receive the data you gave us in a structured, commonly used, machine-readable format, where we process it by automated means on the basis of contract or consent.

Objection

Object to processing based on legitimate interest. We will stop unless we can show compelling grounds that override your interests.

Withdrawal of consent

Where we rely on consent, withdraw it at any time. This does not affect processing that happened before you withdrew.

We may need to confirm your identity before acting on a request, so that we do not hand your data to someone else. We will not charge for a request unless it is clearly unfounded or excessive.

If you believe we have handled your data unlawfully, you have the right to complain to a supervisory authority. Our lead authority is Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk. You may also complain to the authority in the EU country where you live or work. We would appreciate the chance to resolve the matter directly first, but you are not obliged to contact us before going to an authority.

The site is served over HTTPS only, with security headers that limit how it can be embedded or misused. Access to our inboxes and tools is protected by strong authentication, and only the people who need a given piece of data have access to it. Our providers are chosen for, and contractually bound to, appropriate technical and organisational security measures.

No system is perfectly secure. If a breach were to affect your data in a way that is likely to put you at risk, we would notify you and the supervisory authority as GDPR requires.

www.synodicstudio.com is a business site aimed at companies and adults. We do not knowingly collect data from anyone under 16. If you think a child has sent us personal data, write to contact@synodicstudio.com and we will delete it.

We will change this policy when our practices change or the law requires it. The date at the top tells you when it was last revised. Substantial changes, for example adding a new category of processing, will be highlighted on this page for a period after they take effect. Continued use of the site after a change does not amount to consent where consent is required; in those cases we will ask separately.

Questions, requests and complaints about personal data: contact@synodicstudio.com. Please put "Privacy" in the subject line so it reaches the right person quickly.