Privacy Notice

Version 1.0 · Effective 2026-10-02

1. Who is responsible for your information?

This Privacy Notice explains how NATURESYNTH LTD, trading as NatureSynth ("NatureSynth", "we", "us"), handles personal information through https://naturesynth.com/, including the public website, NatureSynth AI Agent and our enquiry form. Our business contact address is 9, Race Course Road, Kaduna, Nigeria. Registration details: 8385248. Contact us about privacy at info@naturesynth.com. The NatureSynth OS application is a separate service. This notice does not replace the notice, terms or contractual arrangements presented inside that application. This website chatbot cannot access your application account, assessment answers, uploaded evidence, payments or other private application records.

2. Information you choose to provide

When you start a chat, you may provide your preferred name, email address, whether you are enquiring as an individual or for an organisation, and your organisation name. Those introduction fields are optional. An email address is needed only if you ask us to contact you. We also receive your messages, the assistant's responses, any links recommended, the conversation time and your recorded privacy and contact choices. For enquiries, we collect your name, email address, enquiry topic and message so that our team can respond. Organisation, audience type and any additional fields shown on the form are optional unless clearly marked. Please provide only relevant business information. Do not submit passwords, payment-card details, identity documents, medical records, confidential assessment evidence or information about another person that you are not authorised to share. Public chat is not an emergency or confidential professional-advice channel. Contact details entered here are self-reported. Providing an email address does not establish a verified account or prove the identity of the sender. We may request proportionate identity checks before discussing private records or acting on a rights request.

3. Technical information and browser storage

After you choose to open chat or start the enquiry form, we create a first-party security session. An HTTP-only cookie associates requests with that session, protects access to its messages and helps prevent forged requests. It is not used to track you across unrelated websites. It is a browser-session cookie, and the server-side access session expires after 24 hours. Your browser may preserve session cookies when restoring tabs; using "End session" removes the current cookie. This does not itself delete the retained conversation. Our anti-abuse controls use short-lived keyed hashes derived from the connecting IP address and time window, request counts, message status and API-usage metadata. These are pseudonymous safeguards, not anonymous data. The plugin does not retain raw IP addresses in its conversation records. Hosting, security and delivery providers may separately process IP addresses and technical logs as described below. No advertising cookie, cross-site tracking pixel or third-party chatbot script is added by this chat feature. Other website cookies, analytics, embedded content and connected tools: WordPress uses cookies to support authorised sign-in, account security and interface preferences for logged-in users. Where relevant features are enabled, additional cookies may support selected language or comment preferences. NatureSynth’s chat and enquiry features use a first-party security-session cookie to associate requests with the current session and protect access to its records. The server-side access session expires after 24 hours. This cookie is not used by NatureSynth Site Kit for advertising or tracking across unrelated websites.

4. Why we use information and our legal bases

We use enquiry details to respond, discuss a requested service and take steps at your request before any contract. Depending on the enquiry and applicable law, this is based on steps towards a contract or our legitimate interest in responding to communications. We use technical safeguards and limited administrative records for our legitimate interests in securing the service, preventing misuse, managing delivery and maintaining accountability, subject to your rights. The AI chat is optional. Before it begins, we ask you to agree to AI processing and the retention of the conversation for the purposes explained here. With that consent, we use the conversation to provide replies, maintain continuity and review how our information and service can be improved. You can choose the contact form instead, end the session, or withdraw consent and request deletion. Withdrawing consent does not make earlier lawful processing unlawful. We use separately recorded permission for optional follow-up about an enquiry or a conversation. Neither providing an email address nor acknowledging this notice automatically subscribes you to marketing. We do not add chat visitors to a mailing list through this feature. A later newsletter or marketing service would require its own appropriate information and lawful basis. We may also process information to meet a specific legal obligation or respond to a lawful request. We do not treat a general agreement to this notice as permission for every possible future use. Where a use needs a different legal basis or additional consent, that must be established before it begins.

5. How NatureSynth AI Agent uses your messages

The assistant uses OpenAI's API to help explain sustainability topics, answer questions about NatureSynth and suggest relevant public pages. Selected messages from the current conversation and relevant approved public website excerpts are sent from our server to OpenAI. The introduction form's name and email fields are not intentionally included in the model prompt. We remove common email and telephone patterns from prompt text where practical, but this is not complete anonymisation. Personal or sensitive information you type in a message may still be transmitted. We request responses with storage disabled (store:false). This does not eliminate all provider retention. OpenAI states that API data is not used to train its models by default unless the customer opts in, and that abuse-monitoring logs may be retained for up to 30 days by default, subject to its applicable arrangements and exceptions. NatureSynth does not enable model-training or conversation-sharing opt-ins through this plugin. This website does not claim approved Zero Data Retention status. The assistant receives selected, relevant public website information; it does not know everything about NatureSynth. Website content updates can refresh its available reference material. Visitor conversations are not automatically added to that knowledge or used to retrain a model. Authorised staff may examine questions and recurring themes to improve public content. New public facts are published through the website's editorial process. AI replies can be incomplete or wrong. They do not determine assessment scores, certify an organisation, confirm regulatory acceptance, create an account, take payment or enter into a contract. No decision producing legal or similarly significant effects is made solely through this website chatbot. Please request human assistance before relying on an answer for an important decision.

6. Who can receive information?

Authorised NatureSynth website administrators can access saved enquiries and chats for the purposes above. Access is not public and is not granted merely because someone is listed as an advisor, team member or assessor on the website. Our hosting and technical-maintenance providers support the website; our email provider processes enquiry notifications and replies; OpenAI processes the selected chat input. Relevant providers and operating locations: Website hosting: Namecheap hosts the NatureSynth website and its database. This service supports the delivery of website content and the storage of enquiries, chat records and related administrative information. The primary hosting location is the United States of America. Email delivery: Resend delivers website enquiry notifications and related service messages. Depending on the notification settings, this may involve recipient addresses, message content and delivery information. Business email: Our support mailbox, support@naturesynth.com, is operated through Google. It receives enquiries and supports our correspondence with you. Additional processing and transfer information: NatureSynth AI Agent uses OpenAI’s API to answer questions about sustainability, explain NatureSynth’s services and help you find relevant website pages. To generate a response, selected conversation messages and relevant public website information are transmitted securely from our website server to OpenAI. The name and email address supplied in the chat introduction are not intentionally included in the AI prompt. However, personal information that you type directly into a message may still be processed by OpenAI. Our integration requests responses with storage disabled using the store:false setting. OpenAI’s separate security and abuse-monitoring retention arrangements may still apply. This setting does not provide Zero Data Retention. The OpenAI project used for this website has optional sharing of API inputs and outputs for model improvement disabled and no region-specific processing restriction configured for this integration. Processing may take place outside Nigeria, including in countries where OpenAI and its relevant subprocessors operate. Further information is available through our privacy contact. Our enquiry notifications include the contact details and message you submit and are delivered through the configured email provider. Do not include confidential evidence. If we subsequently reply by email, the resulting correspondence is also handled by the email systems involved. We do not sell chat transcripts or contact details. Any disclosure required by law, or necessary to establish or protect legal rights, is assessed for lawfulness and proportionality.

7. International processing

Providers may process information outside your country, including where OpenAI or its subprocessors operate. When a transfer is subject to legal safeguards, we assess the relevant transfer conditions and establish an appropriate mechanism, such as an adequacy basis or suitable contractual safeguards. The applicable safeguards and provider information can be requested through our privacy contact. Accepting chat is not a substitute for our own duties concerning transfers. Do not use chat for information that must remain within a particular country unless a separately agreed service confirms that requirement can be met.

8. Retention and deletion

Under the configuration issued with this notice, chat introduction details, messages and consent receipts are scheduled for deletion 90 days after the chat’s initial consent; enquiries and their consent receipts are scheduled for deletion 180 days after submission. A shortened retention setting may bring deletion forward; a later increase is not automatically applied to existing records. Technical usage and administrator-access records are retained for up to 90 days; short-term request-limit buckets expire within two days and are then removed by scheduled cleanup. Automated deletion depends on scheduled tasks running on the website. Records may remain until the next successful cleanup. Our operational process is to monitor this schedule and correct delayed cleanup. Email correspondence is handled under a 180-day routine retention schedule and backups under a 30-day rotation, subject to any separately documented necessary retention. Database deletion does not instantly remove provider logs or offline backups. Information in backups is restricted, is not used for routine contact and should not be reintroduced without applying relevant deletion requests after a restore. The "Delete this chat" control removes the current conversation and its introduction details from this website's active chat store. It does not remove a separate enquiry you submitted, delivery-provider records or a separate application's records. We retain detached, limited usage records to prevent deletion being used to reset API-abuse controls. Ask the privacy contact about broader deletion or withdrawal. Where particular information must be retained for a legal obligation, an active dispute or a separately agreed service, we assess and document the minimum necessary records and period. Retention for a later contract is described in that service's arrangements rather than silently extending every website chat.

9. Your choices and rights

You can leave optional identity fields blank, decline follow-up, stop chatting, withdraw follow-up permission in the chat, delete the current conversation, or contact us for human help. Subject to applicable law and any relevant exceptions, you may request information about processing, access, correction, deletion, restriction, portability, or object to processing based on legitimate interests or direct marketing. You may withdraw consent at any time without affecting earlier lawful processing. Send requests to info@naturesynth.com, identifying the relevant enquiry or conversation reference where available. We may ask for information reasonably necessary to locate the record and verify the request; we will not disclose a transcript simply because someone supplies another person's email address. We aim to respond without undue delay and within the applicable legal period. We will explain a refusal or lawful limitation and the routes available to challenge it. You may complain to the Nigeria Data Protection Commission at ndpc.gov.ng, or to the appropriate authority where another applicable law gives you that right. You do not have to contact us first to exercise a right to complain to an authority.

10. Age, security and policy changes

The website's conversational and enquiry services are intended for adults aged 18 or over. We do not knowingly solicit children's personal information through them. General public reading resources do not require a chat profile. Contact us if a child has submitted information so we can take appropriate action. We use access controls, HTTPS requirements for the new forms, protected server-side API credentials and restricted records. No internet service can promise absolute security. Hosting administrators and authorised database operators may have technical access; this plugin does not provide end-to-end encrypted messaging. Please report suspected misuse through our privacy contact. We publish the version and effective date of this notice and retain the accepted notice identity with relevant records. Material changes to the active notices require renewed acknowledgement before an existing chat continues. Changes do not retrospectively authorise a new use of old data. This notice should be read with the Website Terms and any notice for the specific service you choose.