CtxfyCtxfy

PRIVACY POLICY

Last Updated: February 2, 2026

This Privacy Policy explains how Synecto, LLC (“Company”, “we”, “us”, “our”) collects, uses, discloses, and protects information when you use Ctxfy (the “Service”). This Policy should be read together with our Terms of Service.

1) Scope

This Policy applies to information we process when you:

  • visit our website,
  • create an account or use the Service,
  • communicate with us (support, sales, feedback).

It does not cover third-party websites, services, or integrations you access through the Service.

2) Roles: Controller vs. Processor (Important for Business Accounts)

Depending on how you use the Service, we may act as a:

  • Controller for information such as account registration details, billing, website analytics/marketing, and communications.
  • Processor / Service Provider for User Content you (or your organization) upload or create in the Service, when you use the Service on behalf of an organization (e.g., a workspace). In that case, the workspace owner or organization is typically the Controller, and we process User Content on their instructions to provide the Service.

If you are a business customer and need a Data Processing Addendum (DPA), contact us at [email protected].

3) The Information We Collect

3.1 Information you provide

  • Account information: name, email, password (hashed), organization/workspace details.
  • Billing information: billing contact details and limited payment metadata (e.g., last 4 digits, card brand, expiration). Full payment card details are handled by our payment processors.
  • User Content: context snapshots, conversation text/JSON, project information, files, prompts, inputs, outputs, or other content you upload or generate in the Service.
  • Communications: messages to support, survey responses, feedback.

3.2 Information collected automatically

  • Usage data: features used, actions taken, session duration, interaction patterns.
  • Device and network data: IP address, browser type, OS, approximate location (derived from IP), device identifiers.
  • Log data: API calls, errors, system events, timestamps, and security-relevant signals.
  • Analytics data: page views, click events, performance metrics (e.g., via PostHog/Mixpanel or similar providers).

3.3 Cookies, pixels, and similar technologies

We use cookies, SDKs, and marketing pixels to maintain sessions, remember preferences, analyze usage, and measure marketing effectiveness (and, where enabled, deliver and measure advertising). See Section 10.

4) How We Use Information

We use information to:

  • Provide and operate the Service (account creation, authentication, workspace features, data storage, exports).
  • Process transactions and send billing notices.
  • Improve and maintain the Service, including debugging, performance monitoring, product analytics, and feature development.
  • Provide customer support and communicate with you about the Service (including service notices and security alerts).
  • Security and abuse prevention, including detecting fraud, enforcing rate limits/quotas, preventing misuse, investigating suspicious activity, and protecting the Service and users.
  • Marketing and advertising measurement (where permitted): understanding how users discover the Service, measuring campaign effectiveness, and (where enabled) supporting marketing activities.
  • Compliance and enforcement, including complying with legal obligations and enforcing our Terms.

5) AI Processing and “No Training”

The Service may process User Content to generate outputs and optimize token usage (e.g., compression/structuring).

We do not use your User Content to train general-purpose AI foundation models, and we do not share your User Content with AI providers for their model training.

We may use User Content and related metadata as necessary to provide the Service and for security/abuse prevention, debugging, and quality improvements consistent with this Policy.

6) Legal Bases for Processing (EEA/UK/Switzerland)

If GDPR applies, we rely on the following legal bases (Article 6), depending on the context:

  • Contract: to provide the Service you request (account, authentication, processing User Content, billing, support).
  • Legitimate interests: to secure the Service, prevent abuse/fraud, improve reliability, conduct product analytics, and understand how our website and Service are used (balanced against your rights).
  • Legal obligation: to comply with applicable laws and lawful requests.
  • Consent: where required (e.g., non-essential cookies/marketing pixels, certain marketing communications).

7) How We Share Information

We do not sell your personal information.

We share information only as needed:

7.1 Service providers (subprocessors)

We share information with trusted vendors who help us operate the Service, such as:

  • cloud hosting/infrastructure providers,
  • payment processors,
  • analytics providers (e.g., PostHog/Mixpanel),
  • marketing and advertising measurement providers (marketing pixels),
  • customer support and email service providers,
  • security and fraud-prevention providers.

These providers are contractually required to protect data and use it only to provide services to us (or, where applicable, to you on our behalf).

We may maintain a current list of subprocessors upon request or via a dedicated “Subprocessors” page, and we may notify workspace owners of material changes where required.

7.2 Legal requirements

We may disclose information if required by law, court order, or government request, or to protect rights, safety, and security.

7.3 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction.

8) Token Usage, Metering, and Logs

We process certain usage signals (including token and feature usage) to operate the Service, support billing (where applicable), enforce limits, and prevent abuse. These measurements may be delayed, estimated, rounded, or reconciled due to technical and provider-billing reasons. Welcome token amounts and plan-included tokens (e.g., 1M monthly non-expiring for Pro) are described in our Terms of Service and on the pricing page.

9) Automated Decisions / Profiling (Limited)

We may use automated signals to detect and prevent fraud, spam, and abuse (for example, to enforce rate limits, prevent automated signups, or temporarily restrict suspicious activity). These measures are intended to protect the Service and typically do not produce legal effects. If you believe an account restriction was applied in error, you can contact us at [email protected].

10) Data Retention and Deletion

We retain information as long as your account is active or as needed to provide the Service.

If you cancel your account, we provide a 30-day period for you to export your data, and then delete User Content from active systems within up to 90 days, except where retention is required for legal, accounting, security, dispute-resolution, or fraud-prevention purposes.

Residual copies may persist in backups for a limited time consistent with our backup and security practices, and we may retain data subject to legal holds.

11) Your Rights and Choices

11.1 General rights

You may:

  • Access: request a copy of personal information we hold.
  • Correction: update inaccurate data (via settings or request).
  • Deletion: request deletion, subject to lawful exceptions.
  • Export: download your data (e.g., JSON export where available).
  • Marketing opt-out: unsubscribe via links in marketing emails (service/transactional emails may still be sent).

We respond to verified requests within 30 days (or as required by law).

11.2 EEA/UK/Switzerland (GDPR)

If GDPR applies, you may have rights to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may lodge a complaint with your supervisory authority.

11.3 California (CCPA/CPRA)

If you are a California resident, you may have rights to know, access, delete, correct, and opt-out of “sale” or “sharing” of personal information (as defined by law), as well as rights related to Sensitive Personal Information.

  • No sale / no sharing for cross-context behavioral advertising: We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
  • Sensitive Personal Information: We do not use Sensitive Personal Information to infer characteristics about you. We use it only as needed to provide the Service, ensure security, prevent fraud/abuse, and comply with law.
  • Authorized agents & verification: You may use an authorized agent to submit a request. We will verify your identity (and the agent’s authority) before processing requests.
  • Global Privacy Control (GPC): If we ever engage in “sale” or “sharing” as defined by California law, we will treat GPC signals as an opt-out where applicable. Today, because we do not sell or share for cross-context behavioral advertising, GPC does not change our practices.
  • Non-discrimination: We will not discriminate against you for exercising privacy rights.

11.4 Additional U.S. State Privacy Rights

Depending on your state (e.g., Virginia, Colorado, Connecticut, Utah and others), you may have rights similar to those described above, including access, deletion, correction, portability, and opting out of certain processing (such as targeted advertising). Where required, you may also have a right to appeal our decision regarding a rights request. You can submit requests via [email protected].

12) Cookies, Marketing Pixels, and Analytics

We use cookies/SDKs/pixels that may fall into these categories:

  • Strictly Necessary: required for core functionality (e.g., authentication, session management, security).
  • Analytics: help us understand usage and improve the Service (e.g., PostHog/Mixpanel).
  • Marketing / Advertising Measurement: help measure marketing performance and, where enabled, support advertising-related functions (marketing pixels).

Your choices

  • You can control cookies via browser settings; disabling cookies may impact features.
  • Where required (e.g., EEA/UK), we will obtain consent for non-essential cookies/pixels and provide cookie controls (e.g., a banner or preference center).
  • Some analytics/marketing providers offer opt-out mechanisms; you can also limit ad tracking via your device or browser settings.

13) International Data Transfers

Your information may be processed in countries other than your country of residence. Where required, we rely on appropriate safeguards such as EU Standard Contractual Clauses (SCCs) for international transfers.

14) Security

We use measures designed to protect information, including encryption in transit and at rest, access controls, and incident response processes. However, no security system is 100% secure, and we cannot guarantee absolute security.

Where required by law, we will notify affected individuals and/or regulators of certain personal data breaches.

15) Children

The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13.

16) Changes to This Policy

We may update this Policy to reflect changes in practices or legal requirements. We will notify you of material changes by email or through the Service.

17) Contact Us

Synecto, LLC 131 Continental Dr, Suite 305 Newark, DE 19713 United States Email: [email protected]