Privacy Policy

At Syntch LLC, doing business as CoRATES ("Syntch LLC" or "we"), we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. By using or accessing our Services in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use and share your information as described in this Privacy Policy.

Remember that your use of the Services is at all times subject to our Terms of Service. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Service.

If you have a disability, you may access this Privacy Policy in an alternative format by contacting support@corates.org.

What this Privacy Policy Covers

This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. "Personal Data" means any information that identifies or relates to a particular individual and also includes information referred to as "personally identifiable information" or "personal information" under applicable data privacy laws, rules or regulations. This Privacy Policy does not cover the practices of companies we don't own or control or people we don't manage.

Personal Data

Categories of Personal Data We Collect

This list details the categories of Personal Data that we collect and have collected over the past 12 months:

Categories of Sources of Personal Data

We collect Personal Data about you from the following categories of sources:

• You
  • When you provide such information directly to us
  • When you create an account or use our interactive tools and Services
  • When you voluntarily provide information in free-form text boxes through the Services
  • When you send us an email or otherwise contact us
  • When you use the Services and such information is collected automatically
  • Through Cookies
• Third Parties
  • Vendors (we use Sentry for error monitoring to identify and fix technical issues with the Services)
  • Authentication providers (ORCID, Google) when you choose to connect your accounts

Our Purposes for Collecting Personal Data

• Providing, Customizing and Improving the Services
  • Creating and managing your account or other user profiles
  • Processing orders or other transactions; billing
  • Providing you with the products, services or information you request
  • Providing support and assistance for the Services
  • Improving the Services, including testing, research, internal analytics and product development
  • Doing fraud protection, security and debugging
• Marketing the Services
  • Marketing and selling the Services
• Corresponding with You
  • Responding to correspondence that we receive from you, contacting you when necessary or requested
  • Sending emails and other communications according to your preferences or that display content that we think will interest you
• Meeting Legal Requirements and Enforcing Legal Terms
  • Fulfilling our legal obligations under applicable law, regulation, court order or other legal process
  • Protecting the rights, property or safety of you, Syntch LLC or another party
  • Enforcing any agreements with you
  • Resolving disputes

We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated or incompatible purposes without providing you notice.

How We Share Your Personal Data

We disclose your Personal Data to the categories of service providers and other parties listed in this section.

• Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include:
  • Hosting, technology and communication providers (Cloudflare, Inc.)
  • Payment processors (Stripe, Inc.)
  • Email service providers (Postmark / ActiveCampaign, LLC)
  • Security and fraud prevention consultants
  • Error monitoring providers (Sentry)
  • Support and customer service vendors
• Parties You Authorize, Access or Authenticate
  • Third parties you access through the services (ORCID, Google Drive)
  • Project collaborators you invite

Legal Obligations

We may share any Personal Data that we collect with third parties in conjunction with any of the activities set forth under "Meeting Legal Requirements and Enforcing Legal Terms" above.

Business Transfers

All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business. Should one of these events occur, we will make reasonable efforts to notify you before your information becomes subject to different privacy and security policies and practices.

Data that is Not Personal Data

We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and share it with third parties for our lawful business purposes, provided that we will not share such data in a manner that could identify you.

Google OAuth and Google Drive

If you choose to sign in with Google or connect your Google account to use Google Drive features, Syntch LLC will process certain information from your Google account to provide the Services.

• Scopes requested. When you sign in with Google, we request standard OpenID Connect scopes (openid, email, profile). If you connect Google Drive, we additionally request per-file access (https://www.googleapis.com/auth/drive.file), which only covers the PDF files you explicitly select in the Google file picker. We cannot see or list any other files in your Google Drive.
• Tokens stored. When you connect Google, we store OAuth tokens (such as access tokens and, when provided by Google, refresh tokens) associated with your account so we can maintain the connection and retrieve a short-lived access token when needed (for example, for the Google Picker experience or when an access token expires).
• What we do with Drive data. When you initiate an import, we use the Google Drive API to fetch file metadata (for example file name, MIME type and size) and download the contents of the specific file you selected. We then copy that PDF into CoRATES storage (Cloudflare R2) so it can be attached to your project/study within the Service. We may store the Google Drive file ID and file name as part of import metadata to support the import and auditing.
• Disconnecting Google. If you disconnect Google, we remove the stored Google account link and tokens used to access Google APIs. Disconnecting Google does not automatically delete PDFs you previously imported into CoRATES; to remove those, you must delete them from within the Service (or delete your account, where applicable).

Syntch LLC's use of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google Drive data only to provide the user-requested functionality (such as importing a selected PDF into your project) and do not use Google Drive data for advertising.

Payment Processing (Stripe)

We use Stripe, Inc. as our payment processor to handle subscription payments and billing. When you subscribe to a paid plan or update your payment information:

• Data collected by Stripe. Stripe collects your payment card information (card number, expiration date, CVC), billing address, and email address directly. This payment information is processed and stored by Stripe and is subject to Stripe's Privacy Policy (https://stripe.com/privacy).
• Data we receive from Stripe. We receive limited information from Stripe, including the last four digits of your payment card, card type, billing address, and subscription status. We do not receive or store your full payment card number.
• Data we send to Stripe. We send your email address and account identifiers to Stripe to associate payments with your account and to enable Stripe to send payment-related communications (such as receipts and failed payment notifications).
• International transfers. Stripe may process your payment data in the United States or other countries where Stripe operates. Stripe is certified under the EU-U.S. Data Privacy Framework. For more information, see Stripe's privacy documentation.

Email Communications (Postmark)

We use Postmark (operated by ActiveCampaign, LLC) to send transactional emails, including account verification, password resets, project invitations, and other Service-related notifications.

• Data shared with Postmark. When we send you an email, we share your email address and name with Postmark. The email content may include information relevant to the notification (such as project names or invitation details).
• Data Postmark collects. Postmark may collect metadata about email delivery, such as whether an email was opened or bounced, to help us ensure reliable email delivery.
• Data retention. Postmark retains email logs and metadata in accordance with their data retention policies. For more information, see Postmark's Privacy Policy (https://postmarkapp.com/privacy-policy).
• International transfers. Postmark may process email data in the United States. ActiveCampaign participates in the EU-U.S. Data Privacy Framework.

Tracking Tools and Opt-Out

The Services use cookies and similar technologies (collectively, "Cookies") to enable our servers to recognize your web browser and operate and improve our Services. We also use Sentry, a third-party error monitoring service, to collect technical error reports (such as stack traces and browser metadata) when something goes wrong. Sentry does not track your browsing behavior or collect personally identifiable information.

We use the following types of Cookies:

• Essential Cookies. Essential Cookies are required for providing you with features or services that you have requested. For example, certain Cookies enable you to log into secure areas of our Services. Disabling these Cookies may make certain features and services unavailable.
• Functional Cookies. Functional Cookies are used to record your choices and settings regarding our Services, maintain your preferences over time and recognize you when you return to our Services.

You can decide whether or not to accept Cookies through your internet browser's settings. Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies. If you do this, however, you may have to manually adjust some preferences every time you visit our website and some of the Services and functionalities may not work.

Data Security and Retention

We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data. These measures include:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing
• Access controls and authentication
• Regular security assessments

You should also help protect your data by appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

We retain Personal Data about you for as long as you have an open account with us or as otherwise necessary to provide you with our Services. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation.

Personal Data of Children

As noted in the Terms of Service, we do not knowingly collect or solicit Personal Information from anyone under the age of 13. If you are under 13, please do not attempt to register for the Services or send any Personal Information about yourself to us. If we learn that we have collected Personal Information from a child under age 13, we will delete that information as quickly as possible. If you believe that a child under 13 may have provided us Personal Information, please contact us at support@corates.org.

State Law Privacy Rights

California Resident Rights

Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Data to third parties for such third parties' direct marketing purposes; in order to submit such a request, please contact us at support@corates.org.

Nevada Resident Rights

If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties who intend to license or sell that Personal Data. You can exercise this right by contacting us at support@corates.org with the subject line "Nevada Do Not Sell Request" and providing us with your name and the email address associated with your account.

European Union Data Subject Rights

EU Residents

If you are a resident of the European Union ("EU"), United Kingdom, Lichtenstein, Norway or Iceland, you may have additional rights under the EU General Data Protection Regulation (the "GDPR") with respect to your Personal Data.

For this section, we use the terms "Personal Data" and "processing" as they are defined in the GDPR, but "Personal Data" generally means information that can be used to individually identify a person, and "processing" generally covers actions that can be performed in connection with data such as collection, use, storage and disclosure. Syntch LLC will be the controller of your Personal Data processed in connection with the Services.

EU Data Subject Rights

You have certain rights with respect to your Personal Data, including those set forth below. For more information about these rights, or to submit a request, please email us at support@corates.org.

• Access: You can request more information about the Personal Data we hold about you and request a copy of such Personal Data.
• Rectification: If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data.
• Erasure: You can request that we erase some or all of your Personal Data from our systems.
• Withdrawal of Consent: If we are processing your Personal Data based on your consent, you have the right to withdraw your consent at any time.
• Portability: You can ask for a copy of your Personal Data in a machine-readable format.
• Objection: You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes.
• Restriction of Processing: You can ask us to restrict further processing of your Personal Data.
• Right to File Complaint: You have the right to lodge a complaint about Syntch LLC's practices with respect to your Personal Data with the supervisory authority of your country or EU Member State.

Transfers of Personal Data

The Services are hosted and operated in the United States ("U.S.") through Syntch LLC and its service providers, and if you do not reside in the U.S., laws in the U.S. may differ from the laws where you reside. By using the Services, you acknowledge that any Personal Data about you, regardless of whether provided by you or obtained from a third party, is being provided to Syntch LLC in the U.S. and will be hosted on U.S. servers, and you authorize Syntch LLC to transfer, store and process your information to and in the U.S., and possibly other countries.

Our service providers, including Cloudflare, Stripe, and Postmark, may process your data in the United States or other jurisdictions. These providers have committed to appropriate safeguards for international data transfers, including certification under the EU-U.S. Data Privacy Framework or implementation of Standard Contractual Clauses approved by the European Commission. You may contact us at support@corates.org to request more information about the safeguards we have in place for international data transfers.

Changes to this Privacy Policy

We're constantly trying to improve our Services, so we may need to change this Privacy Policy from time to time, but we will alert you to any such changes by placing a notice on the CoRATES website, by sending you an email and/or by some other means. Please note that if you've opted not to receive legal notice emails from us (or you haven't provided us with your email address), those legal notices will still govern your use of the Services, and you are still responsible for reading and understanding them. If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes.

Contact Information

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Data or your choices and rights regarding such collection and use, please do not hesitate to contact us at:

Email: support@corates.org