Privacy Policy

Effective October 28, 2026 · Version 2026-10-28

No anonymous visitor tracking. No advertising or analytics cookies. We use only the cookie needed to maintain authenticated user sessions.

1. Who we are

CynchTrays, LLC operates Cynch Trays. Contact: support@cynchtrays.com, 11757 W. Ken Caryl Ave, F272, Littleton, CO 80127, United States. This Policy covers our website, account setup, organization workspaces, onboarding submissions, and support.

2. Information you provide

We collect the email address and name you give us, email-verification status, organization names, memberships and roles, invitations, tray-list files or pasted email content, submission filenames and sizes, and support communications. If you choose a plan or payment preference, we store that preference and any PO reference you enter. This launch does not collect credit card numbers or process payments. Submissions may contain personal information if you include it; include only necessary professional contact and tray information.

3. Sessions, cookies, and technical data

We use one first-party cookie, ct_session, to keep authenticated users signed in. It is Secure, HttpOnly, and SameSite=Lax, expires after seven days, and is cleared when you sign out. It is not used for advertising, analytics, cross-site tracking, or anonymous visitor identification. You can remove it through your browser settings, which signs you out. No consent banner for optional cookies is used because we do not set optional tracking cookies.

We do not track anonymous visitors or build visitor behavior profiles. Cloudflare, our hosting and security provider, processes technical request information such as IP addresses, request headers, and error or security events to deliver and protect the site. We use short-lived hashed identifiers and request counts for signup abuse prevention, not visitor analytics. These anti-abuse records expire for enforcement after one hour. Operational and infrastructure logs may have separate provider retention periods. We do not load third-party advertising pixels, session replay, analytics SDKs, or external web fonts.

4. Why we use information

We use information to verify email addresses, authenticate users, create and administer organizations, enforce access permissions, store onboarding submissions, invite teammates, record plan preferences, respond to support and privacy requests, prevent abuse, troubleshoot errors, and meet legal obligations. We send transactional verification and invitation emails. Registering does not subscribe you to marketing.

5. Who can access it

Users and admins in your organization can access its tray-list submission information. Organization admins can manage membership and plan preferences. Authorized Cynch Trays super admins may access all organizations for administration and support. Cloudflare provides hosting, database storage, object storage, security, and transactional email infrastructure. We may use professional advisers as necessary, disclose data where legally required or to protect rights and security, or transfer data in a business reorganization subject to applicable safeguards. We do not sell personal information or share it for cross-context behavioral advertising. The current launch does not send tray lists to an AI model for processing.

6. Your organization’s responsibilities

If your organization controls your account or submits information about you, it may make decisions about that information. Contact its admin for organization-managed access and content requests; you may also contact us. Upload tray and instrument information only. Do not submit protected health information, patient identifiers, health records, or other sensitive personal information. This launch is not offered for handling PHI under a business associate agreement.

7. Retention and deletion

We retain account, organization, and submission records while needed to provide onboarding and the service, resolve support requests, maintain security, and meet legal requirements. Verification links expire after twenty minutes and are single-use. Sessions expire after seven days. Expired authentication and anti-abuse records are removed through routine cleanup. Uploaded files remain until deleted through an authorized request or applicable service lifecycle process; no fixed automatic upload-deletion period is promised in this launch. Contact support to request export or deletion. We verify your authority before acting and explain applicable legal or organization-managed restrictions. Backup, security, and legally required records may persist for their applicable retention periods.

8. Security and processing locations

We use HTTPS, access controls, hashed verification and session tokens, and private object storage. No method of storage or transmission is completely secure. Cloudflare infrastructure may process information in the United States and other countries; we do not promise US-only or EU-only processing or residency. Do not upload information requiring a residency commitment we have not agreed to in writing.

9. Adults only; no marketing to minors

The service is intended only for professional users age 18 or older. We do not market to minors or knowingly collect personal information from children. If you believe a minor has provided information, contact support@cynchtrays.com so we can investigate and delete it where appropriate.

10. No EU targeting

Cynch Trays does not market to, direct advertising toward, or intentionally target individuals in the European Union, and does not monitor their behavior for advertising or visitor analytics. Website accessibility from the EU does not indicate an intent to target EU users. This disclosure does not itself determine whether any law applies and does not remove privacy rights or obligations that apply by law.

11. Your choices and rights

You may request access, correction, export, deletion, or closure of your account by emailing support@cynchtrays.com. Depending on applicable law, you may have additional rights, including restrictions or objections to certain processing and an appeal of a denied request. We will assess and respond within applicable legal deadlines, verify identity as needed, and explain any permitted denial. To appeal, reply to our decision with “Privacy appeal.” We do not discriminate for exercising applicable privacy rights. We do not sell data, use targeted advertising, or conduct cross-context advertising sharing; no sale or targeted-advertising opt-out is needed for those activities in this launch. Browser signals do not change our no-tracking practice.

12. Policy updates

We will post updates here with a revised effective date and provide additional notice of material changes where appropriate. If future features introduce payment processing, AI processing, analytics, new providers, or new uses of information, we will update the relevant disclosures before those changes take effect.