What you share is used to simulate the person. Nothing more.
Effective date: June 27, 2026 · ArenaSynth, operated by Ereace
This policy explains exactly what data we process, what we store, and what we never store. It is written to be read, not to cover us.
A note on how ArenaSynth works: many counterparts require no personal data at all — you design the profile (role, sector, traits) and the engine generates the person. Providing source material is only needed when you want to simulate a specific real person, and that material can be anything you choose to share — a CV, a professional bio, your own notes. The rules below apply whenever you do.
The short version
- ArenaSynth never stores the profile material you provide. Whether a CV, a professional bio, or any other source text, it is processed in memory to derive a psychometric profile, then discarded. It does not enter our database and it is excluded from our application logs.
- Only the derived profile exists in our system — a numeric psychometric vector and a small set of profile attributes. You can delete it at any time.
- We never train models on your data. The inference step is performed by third-party AI model providers acting on our instructions; ArenaSynth retains nothing from that step except the derived profile.
- Our infrastructure runs in the EU (Ireland). AI inference requests are processed by external model providers, which may operate outside the EU.
- Analytics only with your consent. We use Google Analytics for aggregate usage. Analytics cookies are off by default and load only if you accept — you can change or revoke that anytime. No ad pixels, no retargeting. See our Cookie Policy.
What we process, and what happens to it
1. Profile text (CV, LinkedIn text, professional bio)
When you create a counterpart from a CV, the text you paste is sent — over TLS, in memory — to an AI language model that infers a psychometric profile (Big Five, Schwartz values, attachment style). On our side the text is then discarded: it is not written to our database, not retained in logs, and not sent to our persona simulation engine.
The inference step is performed by third-party AI model providers, which process the text to return the profile and may operate outside the EU under their own API terms. We may change the specific provider at any time. If you prefer not to have a given text processed this way, do not paste it — the archetype-based counterpart flow does not require any profile text.
2. The derived profile (what we actually store)
From the text we keep only: the psychometric vector (numeric scores), an inference confidence summary, and basic profile attributes the text states explicitly (such as name, age, gender, profession). These form the synthetic counterpart you practice against.
The vector and demographic attributes — never the original text — are sent to our persona simulation engine (StrataSynth, also EU-hosted, operated by Ereace) to generate the counterpart. Counterparts expire automatically (default: 30 days) and you can delete them at any time from the app.
3. Business context (optional)
If you provide situational context for a counterpart (deal background, role pressures), we store it with the counterpart so the simulation can use it. Delete the counterpart and it goes with it.
4. Simulation sessions
Conversation transcripts of your practice sessions and the post-session analysis are stored so you can review and compare sessions. They belong to your account and are not shared with other users.
5. Account data
Your API key identity and usage data needed to operate the service. Authentication tokens live only in your browser's memory — never in localStorage or cookies.
Your responsibility when pasting someone else's CV
You may use ArenaSynth to simulate a real counterpart — for example, a person you will negotiate with. If you paste text about another person, you confirm you are lawfully entitled to use it (for instance, publicly available professional information used for legitimate preparation). The same guarantees apply: the text is never stored, only the derived profile, which you can delete.
What we never do
- Sell or share your data with third parties for their own purposes.
- Train our own models on your CVs, profiles, or conversations.
- Store your CV or profile text — in any form, anywhere in our systems.
- Use advertising pixels, ad retargeting, or sell data to data brokers. (We do use Google Analytics for aggregate usage, only with your consent — see the Cookie Policy.)
Who we are (data controller)
ArenaSynth is operated by Ereace (a company in formation; full registered details will be published once incorporated). Infrastructure hosted in the EU (Ireland). Contact: hello@arenasynth.com.
Legal bases (GDPR art. 6)
- Account, authentication, running the service — performance of the contract (6.1.b).
- Inferring a profile from text you provide — contract + your consent to AI processing (6.1.b / 6.1.a).
- Third-party data you provide — you are the controller, with your own legal basis (typically legitimate interest in B2B preparation, 6.1.f); we act as processor.
- Session transcripts and analysis — performance of the contract (6.1.b).
- Analytics cookies — your consent (6.1.a).
How long we keep data
- Source text (CV / evidence): not kept — processed in memory and discarded.
- Derived profile (vector + attributes): until you delete it; counterparts expire by default at 30 days.
- Business context: stored with the counterpart; deleted with it.
- Session transcripts + analysis: while your account exists; removed when you delete the account.
- Account data: for the duration of the relationship plus any legally required retention.
International transfers
Our core infrastructure is in the EU. Some processing — AI inference and analytics — may involve providers outside the EEA; those transfers rely on Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. We are working to move AI inference to EU-hosted models to remove the transfer.
Processors we rely on
- AWS — infrastructure (EU, Ireland).
- AI model provider(s) — profile inference (may operate outside the EU).
- DossierSynth — evidence synthesis for the "From dossier" flow (operated by Ereace, EU).
- Google (Google Analytics) — aggregate usage analytics, only with your consent (US transfer under SCC + EU-US DPF).
Cookies
We use only necessary cookies plus Google Analytics, and analytics loads only after you consent. You can change or revoke your choice anytime via “Cookie settings” in the footer. Full detail in our Cookie Policy.
Your rights (GDPR)
You have the right to access, rectification, erasure (“right to be forgotten”), objection, restriction and portability, and to withdraw consent at any time. In practice: deleting a counterpart removes its derived profile; deleting your account removes everything tied to it. You can also request erasure by email. Contact: hello@arenasynth.com (we respond within the legal time limit, one month, extendable).
If you believe the processing is not lawful, you may lodge a complaint with your data protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD, www.aepd.es).
Changes
If we change how data is processed — a new provider category, a new stored field — we update this policy and its effective date before the change goes live.