Privacy and data handling

Product-specific operational notice · Reviewed October 24, 2026. This page describes Persona by Syrava, not the separate Syrava company website policy. The Syrava product operator's legal entity and registered address have not been confirmed for this deployment; this notice is therefore not a complete statutory privacy notice or legal-compliance certification.

Contact

Privacy and account questions: hello@syrava.com. Support: support@syrava.com. The public Syrava company site lists these contacts, but its privacy policy expressly does not cover product-specific data practices.

Information Persona handles

Account and security data includes your email address, salted password hash, one-time recovery-code hash, workspace identifier, sign-in sessions, OAuth grants and token records. Product data can include app URLs you authorize, study goals and settings, synthetic profile assignments and opinions, browser-visible text, screenshots, page timings, interaction outcomes, reports and permissioned research sources you upload. Billing records include credit balances and provider transaction references when billing is configured. Persona does not ask for or store payment-card numbers.

How it is used and shared

Persona uses this information to provide sign-in, private workspaces, authorized product testing, reports, credit accounting, account recovery, support and service security. The app runs on an OVHcloud-hosted VPS behind HTTPS. When you connect a ChatGPT or other MCP client, it receives the tool inputs and results you request under that service's own policies. Browser evidence is processed to perform the test you requested. Payment providers are only involved when an operator enables them. Do not submit passwords, sensitive personal records or information you lack permission to use.

Retention and deletion

Research sources, field studies and simulations have expiry dates. Expiration cleanup runs during later workspace operations, so removal may not occur at the exact expiry time. Account, product-test and credit-ledger data remain in the workspace until you delete the account or the operator deletes the workspace. The sign-in cookie expires after seven days; OAuth credentials have their own expiry and can be revoked. Account deletion removes the workspace and revokes its credentials. Copies already exported by you and encrypted backups are not automatically erased by account deletion; backup retention and purge timing are controlled by the operator and are not currently published.

Security and limits

Persona separates customer workspaces and uses HTTPS, scoped OAuth and access checks. These controls reduce risk but do not guarantee that every personal detail is removed from uploaded content or browser evidence. Server and reverse-proxy log retention periods have not been documented for this deployment. Synthetic opinions are fictional hypotheses, not real customer evidence or a representative human sample.

Your choices

You can delete your account and its active workspace from the signed-in workspace page, revoke the connected assistant's access, and contact us about access, correction or deletion requests. Email verification is not currently enabled. Response procedures, legal response times, the controlling legal entity and registered address still need operator confirmation before this notice can be considered complete.

Children and sensitive information

Do not upload actual children's data, health, biometric, financial, identity or other sensitive records. Persona does not currently operate a verified human research panel. Any real participant study needs its own consent, notice and withdrawal process.

General Syrava company information is at syrava.com/privacy; it does not replace this product notice.