Synth Antispam

Terms of Use — Synth Antispam for WordPress

Last updated: 15 September 2026

Scope: the WordPress service only. These terms cover the Synth Antispam plugin for WordPress and the classification service it talks to. They do not replace or cancel the general Synth service documents, which continue to govern the Telegram service: general Terms of Use and general Privacy Policy.

Companion document: Privacy Policy — Synth Antispam for WordPress.

Who is agreeing with whom

This agreement is between LightApps OÜ, registry code 16712872, Vesivärava tn 50-201, Kesklinna linnaosa, Tallinn 10152, Estonia (support@synth.locker), trading as Synth Antispam, and the owner of the site that installs the plugin.

Your site's commenters are not parties to these terms and take on no obligation towards Synth.

What the service does

The service accepts a comment submitted by your site and returns a verdict — whether it is spam, together with a confidence value.

The moderation action is performed by your own site, using WordPress, not by us. We do not delete, publish or modify anything on your site. You choose how a verdict is applied.

Access and your site key

Access is granted by a key bound to a domain. The key is issued by self-service and can be reissued on proof that you hold the current one.

The volume of checks is limited by a quota. When the quota is used up, the service answers with a distinguishable error code; what your site then does with a comment is decided by the plugin, according to the settings you chose.

These terms deliberately state no pricing, plan names or quota figures. Those values are part of the service configuration and can change without a new release of the plugin; publishing them in a document that ships inside the plugin would make them false the day they change. See the pricing page for current figures.

Your obligations

Send only the data the plugin collects as shipped. Do not extend what is sent by your own means.
Meet your own obligations as controller: tell your commenters about the processing, and have a legal basis for it.
Do not use the service to sidestep your own moderation duties. A verdict is a hint, not a legal decision.

Data processing terms (GDPR Article 28)

For personal data contained in the comments your site sends us, you are the controller and we are the processor. This section is the written processing agreement that Article 28(3) of the GDPR requires between us — there is no separate document to request or sign. The subject matter is spam classification of comment submissions; the duration is for as long as your key is active; the nature and purpose is producing a verdict; the categories of data and of data subjects are those set out in the Privacy Policy.

What this section does not cover. We also keep a copy of the comment data and use it to train and improve the Synth spam-classification models, as described under Training our own model in the Privacy Policy. That is a purpose of ours, not an instruction of yours, so for it we act as a controller in our own right and this processing agreement does not govern it. The undertakings below apply to the verdict processing we carry out for you; they are not to be read as a promise that no other processing happens.

We undertake the following:

Only on your instructions. When acting as your processor, we process the data only to produce a verdict and only to the extent your installation sends it, including as regards transfers to a third country. We do not process it for any further purpose on your behalf; the separate use for training our own model, noted above, is carried out on our own account and is not covered by this undertaking. If we ever consider that an instruction of yours infringes data protection law, we will tell you instead of carrying it out silently.
Confidentiality. Everyone we allow to access the data is bound to confidentiality and only has access where their work requires it.
Security. We maintain technical and organisational measures appropriate to the risk, as required by Article 32. What they are, in concrete terms, is described in the Privacy Policy.
Sub-processors. You give us general authorisation to engage the sub-processor identified in the Privacy Policy. We impose on any sub-processor the same data protection obligations we owe you, and we remain answerable to you for its performance. Any intended change to that list is published on that page before it takes effect, so that you have the opportunity to object; if you object, your remedy is to stop the processing as described under Termination.
Helping you answer your commenters. We assist you, so far as we are able and taking into account the nature of the processing, in responding to requests from data subjects exercising their rights.
Helping you meet Articles 32 to 36. We assist you in ensuring security, in handling personal data breaches and in any impact assessment you have to carry out. If a personal data breach affects data we process for you, we will notify you without undue delay after becoming aware of it, with the information you need in order to meet your own notification duties.
Deletion at the end of processing. The verdict record is deleted by the automatic 24-hour expiry described in the Privacy Policy. Deleting your key or the plugin ends the verdict processing. The training copies described above are not covered by that expiry and are not deleted when you stop using the service: they have no expiry date. We delete them on request — write to support@synth.locker naming your site, and every copy taken from it is deleted.
Demonstrating compliance. On your request we make available the information necessary to demonstrate that we meet the obligations in this section, and we allow for audits and inspections on reasonable notice, conducted so as not to compromise the security or the data of other sites.

Where anything in this section conflicts with another part of these terms, this section governs for personal data.

Limits of liability

The service is provided "as is", with no warranty that classification is free of error. A verdict is probabilistic, and false positives are possible.
We are not liable for moderation decisions your site takes on the basis of a verdict, nor for the content of comments.
We are not liable for the service being unavailable. The plugin is required to behave predictably when it is, and the choice of that behaviour — publish or hold — remains yours.

No quantitative claim about classification quality is made in these terms, and none can be: a one-sided recall figure is not a measure of quality, and our measured false-positive figure rests on too small a held-out sample to be stated as a guarantee.

Rights in your content

We claim no ownership of the content of your site's comments. It remains yours, and your site's.

We do, however, keep a copy of it and use that copy to train and improve the Synth spam-classification models, as described under Training our own model in the Privacy Policy. The copies are kept indefinitely, the use applies to every site, and there is no setting that turns it off. You may have the copies taken from your site deleted at any time by writing to support@synth.locker.

This clause was reversed on 15 September 2026. It previously stated that comment content from WordPress sites did not enter any training flow, and that this document governed over the general Synth Terms of Use on that point. That reservation is withdrawn: on the question of training, the WordPress service is now aligned with the general Synth Terms of Use rather than excepted from them. Nothing else in the relationship between the two documents changes, and the data-minimisation guarantees stated elsewhere — the full email address, the IP address and the User-Agent string never reaching us at all — are unaffected.

Termination

You can stop the processing at any time by deleting the plugin or the key. Deleting the plugin destroys your site's salt, after which a previously sent pseudonym cannot be linked back to an address by anyone, including you.

We may suspend a key's access in case of abuse.

Changes to these terms

When the service changes, this page changes with it. The date at the top is the date of the last substantive change.