Privacy Policy

This Privacy Policy explains how SynthBridge Consulting LLC (“SynthBridge,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal information when you visit synthbridge.net, contact us, or engage us for services. We built this site to hold the same privacy bar we build for our clients.

1. Who we are

SynthBridge Consulting LLC is a single-member limited liability company formed in the State of New Jersey, USA. For the personal information described in this policy that we collect through this website and our own business operations, SynthBridge is the data controller. When we process data on behalf of a client under a services agreement, the client is the controller and SynthBridge acts as a processor / business associate (see Section 7).

2. Information we collect

Information you give us

• Contact & enquiry data — name, email address, phone number, company, the service you’re interested in, and the contents of any message you submit through a contact, quote, or consultation form. Submissions are handled on our own infrastructure and delivered to us by email; we do not use a third-party form-tracking service.
• Account data — if you create an account or use a client, product, or partner portal on this site, the credentials and profile details needed to sign you in and provide the service.
• Application data — if you apply for a role posted on this site (including roles we host on behalf of a client), the information in your application, such as contact details, work history, references, and any assessment responses.
• Engagement data — information you share with us while scoping or delivering a project.

Information collected automatically

• Technical & log data — IP address, browser and device type, referring page, and timestamps, processed by our edge/CDN provider to deliver and secure the site.
• Essential cookies — a small number of strictly necessary cookies used for sign-in sessions and security (see Section 5).

We do not use third-party advertising trackers, and we do not sell or rent personal information to anyone.

3. How we use your information

• To respond to your enquiries and provide the consultation, quote, or services you request.
• To deliver, maintain, and secure this website and any portal you access.
• To administer contracts, invoicing, and our business records.
• To send service or transactional messages, and — only where permitted — occasional updates you can opt out of at any time.
• To comply with legal, tax, and regulatory obligations, and to detect and prevent fraud or abuse.

4. Legal bases for processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on: consent (e.g. optional marketing email); performance of a contract (delivering requested services); legitimate interests (running and securing our business and website, provided your rights do not override them); and legal obligation (tax, accounting, and compliance record-keeping).

5. Cookies

This site uses only strictly necessary cookies — for example, a session cookie that keeps you signed in to a portal and cookies our edge provider uses for security and abuse prevention. These are required for the site to function and do not track you across other websites. You can block cookies in your browser, but portal sign-in may stop working.

6. Sharing & sub-processors

We share personal information only with vetted service providers that help us operate, and only as needed. We choose providers that hold recognized security certifications, and we describe them by category rather than by brand:

Category	Purpose	Minimum standard
Cloud infrastructure & CDN	Hosting, edge delivery, DDoS/WAF protection	SOC 2 Type II
Payment processor	Card checkout via hosted fields — card data never touches our systems	PCI DSS Level 1
Email delivery	Transactional and notification email	SOC 2 Type II
AI / ML services	Optional features that assist with content and automation	SOC 2 Type II

The specific named list of sub-processors is available to clients under a Data Processing Agreement (DPA) or NDA. We may also disclose information where required by law, or to protect the rights, safety, and property of SynthBridge, our clients, or the public.

International transfers. Our providers may process data in the United States and other countries. Where required, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.

7. Client & health-related data

When we deliver a project, we may process data on behalf of a client. In that role we are a processor, we act on the client’s documented instructions, and our handling is governed by the engagement contract and, where applicable, a DPA.

For healthcare clients, SynthBridge may act as a HIPAA Business Associate and will sign a Business Associate Agreement (BAA) before any Protected Health Information (PHI) is processed. This public website is not intended for the submission of PHI — please do not send medical or health information through our web forms.

Where this site hosts a client’s application, recruitment, or product forms, information you submit through them is processed on that client’s behalf and governed by their instructions and the applicable agreement.

8. Data retention

We keep personal information only as long as necessary for the purpose it was collected, to meet contractual, tax, and legal obligations, or to resolve disputes. Enquiry data is retained for a limited period and then deleted or anonymized; contract and financial records are kept for the period required by law.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, to object to processing, and to withdraw consent. If you are in the EEA/UK you may also lodge a complaint with your supervisory authority. California residents have rights under the CCPA/CPRA, including the right to know and delete — and we do not sell personal information. To exercise any right, contact us using Section 13; we will respond within the time required by applicable law.

10. How we protect your information

We encrypt data in transit (TLS 1.2+/1.3), host on certified infrastructure with edge WAF and DDoS protection, hash credentials, apply least-privilege access, and keep audit trails of administrative actions. More detail is on our Security page.

11. Children’s privacy

This site and our services are intended for businesses and adults. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will delete it.

12. Changes to this policy

We may update this policy as our practices or the law change. We will revise the “Last updated” date above and, for material changes, provide a more prominent notice.