Privacy Policy

Syntax Industries, Inc. ("Syntax Industries," "we," "our," or "us") operates this website, the Identity sign-in service, My Market, the Business Console and Side Kick (together, the "Services"). This policy explains what information the Services collect, how we use and share it, how long we keep it, and your choices. It applies together with our Terms of Use.

The Services are built for businesses and government agencies. Most of the information we handle is business contact information about the people who work for our customers, suppliers and partners. Where we handle information on behalf of a government customer under a contract, that contract governs it and prevails over this policy if the two differ.

• Forms and email. When you send us a form or email us, we receive what you provide: typically your name, work email, phone number, organization, the subject of your inquiry and your message. We keep it in our ticketing and contact records.
• Accounts. When an account is created for you, we keep your name, work email, organization, office or department, and the roles you hold. Government buyers who sign up with a .gov or .mil address provide their name, email and agency or office.
• My Market. We keep the quote requests, quotes, purchase order numbers, orders, shipping and delivery details, invoices, support requests and pricing submissions you make or receive, and the account they belong to.

Please do not send us classified information, controlled unclassified information or payment card numbers through the Services.

External users sign in with a one-time link or code we email to them. We store only a protected (hashed) form of each link and code, and they expire after ten minutes. Our employees sign in with their Microsoft work account. There are no passwords to store.

When you sign in, we record the session's IP address and browser so that you and we can recognise and end sessions that are not yours. You can see and sign out of your sessions in Identity. Session records are kept for the life of the session.

We do not use advertising cookies or cross-site tracking. The Services use:

• Sign-in cookies (such as better-auth.session_token and better-auth.session_data), which keep you signed in across our applications for up to seven days, plus short-lived cookies used while you sign in with Microsoft. These are strictly necessary; without them you cannot sign in.
• A preference cookie (bcs-theme) that remembers whether you chose the light or dark appearance, for up to one year.
• Browser storage (not cookies) for your appearance and accessibility settings, and for the random analytics identifiers described below.

You can block or delete cookies and site data in your browser. If you block sign-in cookies, you will not be able to sign in.

We run our own analytics. There is no third-party analytics or advertising script on the Services, and the analytics set no cookies. Everything is collected by our own code and stored in our own Microsoft Azure environment.

When a page loads, our code records:

• the pages you view, the page you came from, campaign tags in the link (such as utm_source), and when you arrived and left;
• how long the page was actually in use (time stops while the tab is hidden or you are idle), how far you scrolled, and which marked sections of a page you viewed and for how long;
• which links and buttons you select, whether you copied an email address or phone number from the page (not what you copied), the words you search for on the site, and when a video is played or finished;
• for forms: that you started a form, the names of the fields you filled in, and whether you sent or left it. We never record what you type into a form field through analytics, other than the words you enter in the site's search box. Everything else is only what you choose to send us;
• technical details: device type, browser, operating system, browser window size, language and time zone; page-load speed; the error message and technical trace when the page runs into an error; and requests to our servers that fail.

To recognise a returning browser we store a random identifier in your browser's local storage, and a separate random identifier for the current visit in session storage. Neither is a cookie, and neither contains anything about you. Clearing your browser's site data removes them.

Our analytics never store your IP address. When a page reports activity, our server keeps only a one-way keyed fingerprint of the address (which cannot be turned back into the address) and the address's network block with the last part removed (for example 203.0.113.0/24).

We look up who operates that network block in the public regional internet registry records (RDAP). When the network belongs to an organization rather than a consumer internet provider or a cloud host, we may note that someone from that organization visited. This is how we understand which agencies and companies are interested in our work. The country of the network also comes from these public records. We do not buy or use third-party location or identity databases.

Separately from analytics, our network edge and web application firewall (Microsoft Azure Front Door) log the IP address of each request to protect the Services against attack and abuse. These security logs are kept for no more than 90 days. Sign-in sessions also record an IP address, as described above.

If you are signed in to one of the Services, or you send us a form, or you open a link in an email we sent you, we connect your visits to that identity — including earlier visits from the same browser — so the team helping you has the context of what you have looked at. This is also how we connect a visit to an organization in our contact records.

Sign-in links, account notices and email from our ticketing and correspondence system are sent through Microsoft Azure Communication Services. For ticketing and correspondence email, we record whether each message was delivered and opened. Links in these emails pass through our own website (/r/…) so we can record that a link was followed before sending you on. Email you exchange with an individual employee's own mailbox is not tracked.

If your browser sends a Global Privacy Control signal, we honor it: your visit is still counted in totals, but it is never connected to your identity or account, even if you are signed in or send us a form. Because we do not sell personal information or use it for targeted advertising, a Global Privacy Control signal is also treated as an opt-out of any sale or sharing. There is no common standard for "Do Not Track" signals, so we rely on Global Privacy Control instead.

• to provide the Services, including sign-in, quotes, orders, delivery, invoicing and support;
• to respond to inquiries and correspond with you;
• to understand what is useful on our website and applications, and fix what is slow or broken;
• to understand which organizations are interested in our capabilities and contracts;
• to keep the Services secure, verify eligibility for government accounts, and detect fraud and automated abuse;
• to comply with law, our contracts and our obligations as a government contractor, and to establish or defend legal claims.

Our staff use artificial intelligence tools to help sort incoming email and requests, draft replies and documents, and find information in our records. These tools run on Anthropic's Claude models, which we use through Microsoft Foundry under commercial terms. Under those terms the provider processes this information only to return results to us and does not use it to train its models. A person on our staff remains responsible for every decision about you. We do not use AI to make decisions that have legal or similarly significant effects on you.

We do not sell, rent or trade personal information. We do not share it for targeted advertising, and we do not share analytics with advertisers or data brokers. We share information only as follows:

• Service providers that process it for us under contract: Microsoft (hosting, databases, security, email and employee sign-in) and Anthropic, through Microsoft Foundry (the AI tools described above).
• Content providers your browser contacts directly. Our pages load typefaces from Adobe Fonts, and some pages on this website load images from icons8 and Brandfetch. Your browser sends these companies your IP address and browser details when it fetches those files. We send them nothing else. Their own privacy policies apply.
• Suppliers and carriers, such as manufacturers, distributors and shipping companies, receive the delivery and order details needed to price, fulfil, ship, warrant or return the products you order.
• Government customers and contracting authorities, where a contract, audit or regulation requires us to report or disclose information.
• Legal and safety. To comply with law or legal process, to enforce our terms, or to protect the rights, property or safety of you, us or others.
• Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
• Business transfers. In connection with a merger, acquisition, financing or sale of assets, subject to this policy.

We store and process information in the United States, in Microsoft Azure data centers. If you use the Services from outside the United States, your information is transferred to and processed in the United States.

Analytics events are kept for up to two years in our working systems and up to seven years in archive. Per-person activity summaries are kept for up to two years after the last activity. Network-to-organization lookups are refreshed every 30 days. The link between your visits and your contact record — including any contact record created from them — is kept for as long as that contact record exists.

Account information is kept while your account is active and for a reasonable period afterward. Quotes, orders, invoices and related correspondence are kept for as long as our record-keeping obligations require, including the periods required by government contracts and tax law. Other messages and records are kept as long as needed to serve you and meet our obligations.

Our employees' use of our own applications is measured the same way, by name, to improve our tools. Employees are told this in our internal handbook, and per-person detail is available only to designated administrators.

We protect information with encryption in transit, access controls, sign-in without passwords, a web application firewall, and secrets held in a managed key vault. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires.

• Turn on Global Privacy Control in your browser to keep visits from being connected to you.
• Clear this site's data in your browser to remove its random identifiers.
• Ask us for access to, a copy of, correction of or deletion of information about you, by email to legal@syntaxindustries.com or through our contact form.

Depending on where you live, privacy laws (such as those of California, Virginia, Colorado, Connecticut and other states) may give you rights to know what personal information we hold about you, to receive a copy, to correct or delete it, and to opt out of its sale, sharing for targeted advertising or use for profiling. We do not sell or share personal information for those purposes, and we do not knowingly collect sensitive personal information through the Services. We will honor these rights wherever they apply.

We will verify your request by confirming that you control the email address on our records. You may use an authorized agent, who must show us your written permission. If we decline your request, you may appeal by replying to our decision or writing to legal@syntaxindustries.com; if we deny your appeal, you may contact your state attorney general. We will not discriminate against you for using any of these rights.

Some information cannot be deleted while we have a legal or contractual duty to keep it, such as order and invoice records. Information that belongs to a government customer is handled as that customer directs.

The Services are for businesses and government agencies and are not directed to anyone under 16. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

The Services link to websites we do not operate, such as manufacturer, agency and social media sites. Their own privacy practices apply, and we are not responsible for them.

We may update this policy. We will post the updated policy here and change the effective date above. If we make a material change to how we use personal information we already hold, we will tell account holders before it takes effect.

Questions or requests about this policy: email legal@syntaxindustries.com, use our contact form, or write to Syntax Industries, Inc., Attn: Privacy, Latrobe, Pennsylvania, United States.