Version 2.0 / 4 November 2026

Privacy statement

Hibou/x B.V., trading as The Synths

1. Introduction

This privacy statement describes how Hibou/x B.V., trading as The Synths (hereinafter: “we” or “us”), handles the personal data of visitors to thesynths.studio and of people who use Lara, our digital human (hereinafter: “Lara”). We consider the protection of your privacy important and handle your data with care.

Lara is an interactive digital human with whom you can have a conversation via speech and/or text. We develop and manage Lara ourselves. This statement covers your visit to thesynths.studio, the forms on the site, a conversation with Lara, the recap you ask her for, a meeting you book through her and the feedback you give after a conversation.

If your organisation works with us as a client, the data processing agreement governs how we process data on that organisation’s behalf. That falls outside this statement.

We recommend that you read this statement carefully before you start a conversation with Lara.

2. What is personal data?

Personal data is any data that can be traced back, directly or indirectly, to you as a person. This includes obvious data such as a name or email address, but also indirectly identifying data such as an IP address, an access code or a session identifier (a randomly generated code that technically distinguishes your conversation from other conversations).

Some of the data we process in connection with Lara can be regarded as pseudonymised: it cannot be traced back to you directly, but in combination with other information it could become possible to trace it back to you. We therefore treat that data as personal data and apply the safeguards of the GDPR to it. Pseudonymisation is different from anonymisation: with anonymisation it is no longer reasonably possible to trace the data back to you, and the rules of the GDPR no longer apply.

3. You are having a conversation with an AI system

Lara is an AI system. The avatar you see and the voice you hear are generated by software; it is not a human. The answers are generated by an underlying language model. We also make this known before the conversation, as required by the European AI Act.

Answers from an AI system are not always factually correct. Lara may give an answer that is incomplete, inaccurate or out of date. This also applies to a recap or proposal drafted with the help of AI (see section 5.8). Lara provides general information about digital humans and our services. A proposal or meeting through Lara is non-binding and is not a commitment on our behalf. The rules for the conversation itself are in the terms of use for Lara.

We ask you not to share sensitive or special categories of personal data with Lara, such as information about your health, religion, political views, sex life, race or criminal record, and not to share data about anyone other than yourself, such as the names of colleagues or clients. Do not share passwords, payment details or other confidential information either. The less data you share, the better your privacy is protected.

You are not obliged to share personal data. If you do not enter any text or speech, Lara cannot answer your question, but otherwise not providing data has no consequences for you.

4. About us

The controller for the processing described in this statement is:

Hibou/x B.V., trading as The Synths
Generaal Vetterstraat 82-2
1059 BW Amsterdam
Chamber of Commerce (KvK) number: 96276215
Email address for privacy questions: hello@thesynths.studio

We have not appointed a data protection officer.

5. For what purposes do we process personal data?

We process your personal data only for the purposes described below. For each purpose we explain what the purpose involves, what data we process, how long we keep the data and what legal basis we rely on.

5.1 Having a conversation with Lara

What does this purpose involve? When you start a conversation with Lara, we process your input (speech and/or text) so that Lara can give you an appropriate answer. If you use speech, your speech is converted into text in real time. For the operation of the avatar, the voice and the interaction, we use processors (see section 7). If you have provided your name and company name beforehand (section 5.7), these are passed to the language model during the conversation, so that Lara can address you personally. The provider of the language model does not store this data. Because Lara can address you by name, your name and company name may, however, appear in the content of the conversation.

Lara only uses your microphone after you have given permission for this in your browser, and only during the conversation. Your camera is not used.

What personal data do we process for this?

• The text you speak or type (conversation content), and Lara’s answers.
• If speech is enabled: the speech input that is converted into text (the speech recording itself is not kept).
• The avatar images and the generated audio that are sent back to you.
• A session identifier: a randomly generated code that technically distinguishes your conversation from other conversations.
• The time at which the conversation starts and ends.
• The duration of the conversation.
• If provided: your name and the name of your company (see section 5.7).

How long do we keep this data? We keep conversation content (transcripts) for a maximum of six months, after which it is deleted automatically. After that, we keep the time and duration of the conversation without your name, for our statistics. Real-time speech and video streams are not stored; they are only used to make the conversation possible. The service providers that process the conversation in real time do not store the conversation content.

What is the legal basis? The legal basis is our legitimate interest (Article 6(1)(f) GDPR). Our specific interest is: letting you experience how a digital human works and being able to follow up on the conversation. We have weighed this interest against your privacy interests and have taken appropriate safeguards, such as limited retention periods, separation between conversation content and technical data, and the exclusions described in this statement. By starting the conversation, you choose to use Lara. This is not consent within the meaning of the GDPR. You have the right to object to this processing at any time; see section 11.

Special categories of personal data: We do not intend to process special categories of personal data within the meaning of Article 9(1) GDPR through Lara, such as data about your health, religion, philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation, race or ethnic origin, or criminal record. In the notice before the conversation and in section 3, we ask you not to share such data with Lara.

If, despite this, you yourself actively and of your own accord share special categories of personal data with Lara (for example by speaking or typing them), the following applies. Since you enter this data voluntarily, knowing that Lara records, stores and can analyse your input as described in this statement, we regard that data as manifestly made public by you to us and to the processors referred to in section 7. We base the processing of such data on the exception in Article 9(2)(e) GDPR.

We do not use this data for purposes other than those described in section 5, and we delete or anonymise it in accordance with the retention periods in section 9. We have taken appropriate safeguards to limit the risks of unintended processing of special categories of data: the warnings beforehand, the strict restriction of access to transcripts, the short retention periods and the prohibition on use for profiling or marketing.

5.2 Technical operation and troubleshooting

What does this purpose involve? We process technical data to keep the site and Lara working properly, to detect and resolve faults, and to monitor the stability and availability of the service.

What personal data do we process for this?

• IP address, in the server logs of our hosting provider. We do not store IP addresses ourselves.
• Browser type, operating system and device type (user agent).
• Time of visit.
• Interaction logs and error messages. Reports of a failed start of the conversation contain only the step, the reason, the language and the browser, without name or email address.

How long do we keep this data? Server log files are kept for seven days.

What is the legal basis? Our legitimate interest in a properly functioning, secure and stable service (Article 6(1)(f) GDPR).

5.3 Quality assurance, analysis and reporting

What does this purpose involve? We analyse conversation content and interaction data to monitor the quality of Lara’s answers, to understand what questions you and other users ask, and to improve the knowledge base, the instructions and the functioning of Lara over time. In addition, on the basis of all conversations together, we prepare analyses and periodic reports, for example weekly, on which topics are coming up and what could be improved. For these analyses and reports, we use AI language models (see sections 7 and 8). This analysis is not intended to track you as an individual or to build a personal profile.

What personal data do we process for this? Conversation content, session identifiers, time and interaction logs as described in sections 5.1 and 5.2. Only the conversation content is provided to the AI language model; your name, company name and email address are not passed on separately.

How long do we keep this data? Conversation content for a maximum of six months, as in section 5.1. We keep analyses and reports for a maximum of six months.

What is the legal basis? Our legitimate interest in improving the quality and usability of Lara (Article 6(1)(f) GDPR). We have carried out an assessment in which this interest was weighed against your privacy interests, and have taken appropriate safeguards such as limited access, short retention periods and no use for profiling or marketing.

5.4 Security and logging

What does this purpose involve? We process certain data to protect the site and Lara against misuse, fraud and unauthorised access, and to be able to detect and investigate any security incidents. Automated content filtering may also take place to prevent misuse and unlawful output.

What personal data do we process for this? IP address, session identifier, access code, time, technical data about your device and (where relevant) conversation content that triggers security filters.

How long do we keep this data? For as long as necessary for the security purpose. Server logs are kept for seven days; for conversation content, the period in section 5.1 applies.

What is the legal basis? Our legitimate interest in securing the service and protecting our rights and those of others (Article 6(1)(f) GDPR).

5.5 Anonymisation

What does this purpose involve? When personal data is no longer needed for the purposes in this statement, and at the latest at the end of the applicable retention period, we delete or anonymise it. Anonymisation means that the data is processed in such a way that you can no longer be identified from it, not even in combination with other information. For example, after the retention period has ended, we keep only the time and duration of conversations, without name or other data that can be traced back to you, for our statistics.

Only once the data has actually become anonymous is it no longer personal data within the meaning of the GDPR. From that moment, it falls outside the scope of this statement. We do not sell anonymised data and do not pass it on to third parties.

What is the legal basis? Our legitimate interest in efficient deletion and in keeping statistics on the use of Lara (Article 6(1)(f) GDPR). The anonymisation meets the three criteria applied by the European Data Protection Board: it must no longer be possible to single out individuals, to link data together or to infer identifying characteristics.

5.6 Cookies and similar technologies

We do not place cookies for analytics or advertising and we do not use trackers. Your browser only stores a few functional settings of the site, such as whether you have already seen the notice before the conversation with Lara. These are necessary for the site and the conversation to work properly; no consent is required for them. Our fonts are hosted on our own server, so your IP address is not sent to Google. The services behind the conversation do not place cookies either.

5.7 Data you provide beforehand and access

What does this purpose involve? Before you start a conversation with Lara, we ask you to provide your name, the name of your company and your email address and, if you have been given access via an access code, that code. We use this data to give you access to Lara, to address you personally in the conversation, to be able to send you a recap and to be able to follow up on the conversation.

What personal data do we process for this?

• Your name.
• The name of your company.
• Your email address.
• Where applicable: your access code and the conversation time used per access code.

How long do we keep this data? We keep your name, the name of your company and your email address for a maximum of twelve months, after which they are deleted automatically. After that, only the time and duration of the conversation remain, without data that can be traced back to you. We keep access codes and the conversation time used for as long as the access code is valid, and for a maximum of twelve months after that.

What is the legal basis? Our legitimate interest (Article 6(1)(f) GDPR) in providing access, enabling a personal conversation and being able to follow up on the conversation.

5.8 Recap by email

What does this purpose involve? After the conversation, you can ask Lara for a recap: a summary of the conversation and, where needed, a non-binding proposal. The recap is drafted with the help of an AI language model on the basis of the conversation content. You receive the recap by email, sent via an email delivery service, with a link where you can read the recap again.

What personal data do we process for this?

• Your name and email address.
• The conversation content.
• The summary and, where applicable, the proposal.

Only the conversation content is provided to the AI language model. Your email address is used solely to send the recap and to be able to follow up with you, and is never shared with a provider of AI language models.

How long do we keep this data? The recap and the link in the email remain available for six months; the text is then deleted. For your name and email address, the period in section 5.7 applies.

What is the legal basis? The processing is necessary to carry out your request, as a step prior to a possible contract (Article 6(1)(b) GDPR).

5.9 A meeting through Lara

What does this purpose involve? You can request a meeting with us through Lara. We use your data to schedule the meeting and follow up on it.

What personal data do we process for this? Your name, the name of your company, your email address and the conversation with Lara.

How long do we keep this data? A maximum of twelve months; we then delete it.

What is the legal basis? The processing is necessary to carry out your request (Article 6(1)(b) GDPR).

5.10 Contact, demo or meeting via a form

What does this purpose involve? Via the forms on thesynths.studio, you can contact us, request a demo or book a meeting. We use your data to answer your question and follow up on your request.

What personal data do we process for this? Your name, the name of your company, your email address, your message and the language of the site.

How long do we keep this data? A maximum of twelve months; we then delete it.

What is the legal basis? The processing is necessary to carry out your request (Article 6(1)(b) GDPR), or our legitimate interest in answering your question (Article 6(1)(f) GDPR).

5.11 Feedback

What does this purpose involve? After a conversation, you can give feedback on Lara. We use your feedback to improve Lara.

What personal data do we process for this? Your score, your message, the session identifier, your name and the name of your company. Your email address is not linked to your feedback.

How long do we keep this data? A maximum of twelve months; we then delete it.

What is the legal basis? Our legitimate interest in improving Lara (Article 6(1)(f) GDPR).

5.12 Personal follow-up

What does this purpose involve? After a conversation with Lara, we may email you personally about your questions or a possible next step. If you do not want this, let us know; we will then not do so. We only send a newsletter or other marketing email with your consent.

What personal data do we process for this? Your name, the name of your company, your email address and the conversation with Lara.

How long do we keep this data? Within the periods in sections 5.1 and 5.7.

What is the legal basis? Our legitimate interest in following up on your interest in our services (Article 6(1)(f) GDPR).

6. Automated decision-making and profiling

Lara generates answers automatically on the basis of an AI system and can prepare a recap or meeting. These answers do not constitute decisions that produce legal effects or similarly significant effects for you within the meaning of Article 22 GDPR. We do not use Lara to make automated decisions about you, to build profiles or to make predictions about your behaviour. The recap and the analyses and reports are not decisions about you either; analyses and reports concern all conversations together.

7. Who do we share your data with?

We share your personal data only with the following categories of recipients, and only to the extent necessary for the purposes described above.

Processors. For the operation of the site and Lara, we use processors. They fall into the following functional categories:

• Providers of avatar and speech processing, for generating the avatar and the voice.
• Providers of speech recognition and AI language models, for converting your speech into text and formulating answers during the conversation.
• Providers of AI language models, for drafting recaps, proposals, analyses and reports.
• Providers of real-time audio and video communication, for enabling the real-time conversation.
• Providers of database technology, for storing transcripts and session data.
• Providers of hosting and server infrastructure, for the site, the forms and the server functions.
• Providers of email services, for sending a recap you have requested yourself.
• Providers of email and office software, for our mailbox and the follow-up of contact and meetings.

We have made agreements with all these parties in accordance with Article 28 GDPR. An up-to-date list of the names of the processors, their function, their country of establishment and the applicable transfer safeguard is available on request via hello@thesynths.studio.

Other recipients. In addition, we may share your data, to the extent necessary and legally required, with government bodies, regulators, law enforcement agencies or (legal) advisers.

We never sell your data to third parties.

8. Transfers outside the European Economic Area

Transcripts, session data, the data you provide beforehand and reports are stored on servers within the European Economic Area (EEA — the EU member states plus Iceland, Norway and Liechtenstein), in Frankfurt (Germany). For specific components, your data may be processed temporarily by service providers outside the EEA, including in the United States. This concerns:

• the real-time speech and avatar processing during the conversation;
• the processing by AI language models for the conversation itself, the drafting of a recap or proposal, and the analyses and reports (sections 5.1, 5.3 and 5.8);
• the hosting of the site, the forms and the server functions (sections 5.2 and 5.10);
• our mailbox, for the follow-up of contact and meetings (sections 5.9, 5.10 and 5.12).

These service providers process your data solely to provide their service to us and do not keep it for longer than necessary for that purpose. They may not use your data to train their AI models. This is laid down in the data processing agreements concluded with them. Providers of AI language models receive only the data needed for their task: the conversation content and, to address you personally during the conversation, your name and the name of your company. Your name and company name are only used during the conversation and are not stored by the provider. Your email address is never shared with them.

For this transfer, we use the following safeguards:

• An adequacy decision of the European Commission, including the EU–US Data Privacy Framework (Article 45 GDPR), to the extent that the receiving party participates in it.
• The standard contractual clauses adopted by the European Commission — these are European model contracts that ensure an adequate level of protection where there is no adequacy decision (Article 46(2)(c) GDPR).

9. How long do we keep your data?

The retention periods per category of personal data are stated with the individual purposes in section 5. In summary:

• Conversation content (transcripts): a maximum of six months, after which it is deleted automatically.
• Recap and the link in the email: six months, after which the text is deleted.
• Your name, the name of your company and your email address: a maximum of twelve months, after which they are deleted automatically.
• Access codes and conversation time used: for as long as the access code is valid, and for a maximum of twelve months after that.
• Meetings, forms and feedback: a maximum of twelve months.
• Analyses and reports: a maximum of six months.
• Server log files: seven days.
• At service providers that process the conversation in real time: no storage of conversation content.
• Time and duration of conversations, without data that can be traced back to you: without limit (no longer personal data).

If we are legally obliged to keep data for longer, we do so in accordance with that obligation and with appropriate security measures.

10. How do we protect your data?

We have taken appropriate technical and organisational measures to protect your data against loss, unauthorised access, alteration or disclosure, in accordance with Article 32 GDPR. The main measures are:

• Encrypted connections (HTTPS/TLS) between your device and our systems.
• Encryption of stored data (“encryption at rest”).
• Logical separation between conversation content and technical visitor data, so that IP addresses and transcripts are not linked to each other.
• Access control at the database layer (Row Level Security — a technique that enforces access per row in the database): the database can only be reached through our own server functions.
• Access only for staff authorised to have it, bound by confidentiality.
• Automatic deletion of data at the end of the retention periods.

Should a data breach nevertheless occur, we act in accordance with our internal procedure and, where required by law, notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and you.

11. Your rights

Under the GDPR, you have various rights with regard to your personal data. We explain them below.

• Right of access: you can ask what data we process about you.
• Right to rectification: you can have incorrect data corrected.
• Right to erasure: in certain cases, you can ask for your data to be deleted.
• Right to restriction of processing: in certain cases, you can ask for the processing to be temporarily stopped.
• Right to data portability: to the extent that this right applies in your situation, you can ask to receive your data in a commonly used electronic format or to have it transferred directly to another party. This right only applies when the processing is based on consent or a contract and is carried out by automated means.
• Right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects.

Right to object. You have the right to object to processing that we base on legitimate interest. If you object, we will stop the processing, unless we have compelling legitimate grounds that override your interests, rights and freedoms. You can always object to personal follow-up by email (section 5.12); we will then stop doing so. You can send an objection to hello@thesynths.studio. This right is also brought to your attention separately before the conversation.

Right to withdraw consent. To the extent that we process your data on the basis of consent, such as for a newsletter, you can withdraw this consent at any time. Withdrawing consent does not have retroactive effect: processing that took place before the withdrawal remains lawful.

How do you exercise your rights? You can exercise your rights by sending a request to hello@thesynths.studio. We respond within one month of receiving your request. In exceptional cases, we may extend this period by two months; in that case, we will inform you of this within the first month. To find your data, we may ask you for the date and time of your conversation and the email address you provided. To be able to handle your request, we may also ask you for additional information to verify your identity.

Right to lodge a complaint with the Dutch Data Protection Authority. If you believe we are not handling your data with care, you can lodge a complaint with the Dutch Data Protection Authority. We would appreciate it if you contacted us first, so that we can find a solution together.

12. How do we obtain your data?

In principle, we receive your data directly from you: you decide what you fill in, what you say or type to Lara and whether you request a recap or meeting. Your device automatically provides some technical data (such as IP address and browser information) to make the connection possible. You received an access code from us or from your organisation.

13. Minors

The site and Lara are not aimed at children under the age of 16. If we know or suspect that a user is under 16, we only process their data if we have the consent of a parent or legal representative, or on the basis of another appropriate legal basis under the GDPR.

14. Changes to this statement

We may amend this privacy statement from time to time, for example if the site, Lara or the law changes. In the event of material changes, we will inform users via our website. At the top of this statement you will find the version and the date of the most recent change.

15. Contact

Do you have questions about this privacy statement or about the way we handle your data? Please contact us via:

Hibou/x B.V., trading as The Synths
Generaal Vetterstraat 82-2, 1059 BW Amsterdam
hello@thesynths.studio

This is a translation of the Dutch text. If they differ, the Dutch version prevails.