Cyncidentity workspace privacy notice

Last updated: 21 October 2026

Who is responsible

Cyncidentity provides workspaces that organisations use for staff identity, onboarding, learning, policies and related HR work. This notice is for the people an organisation invites to its workspace, and for its administrators.

Your organisation (usually your employer) decides why and how information in its workspace is used. In data-protection terms it is normally the controller. cyncidentity processes the information on your organisation’s behalf, under an agreement with it, to run the service. Questions about how your organisation uses your information are best sent to your HR team first. You can also contact support@cyncidentity.com.

Cync Cards, the separate business card service for individuals, has its own privacy notice.

Information in a workspace

• Your employee record: name and preferred name, employee number, job title, department, location, manager, employment type, start date, status, work and contact email, and any photo, skills or team details your organisation adds.
• Your account: sign-in email, a protected (hashed) password, sign-in sessions, last sign-in time, your role, and password reset and invitation records.
• Onboarding and HR work: onboarding journeys and tasks, documents you upload for them, check-ins (including outcomes and notes recorded by HR, which are not shown to you), tasks HR assigns you and their due dates.
• Learning and policies: course enrolments, progress, quiz results and certificates; policies you are asked to read and when you acknowledged them.
• Knowledge and documents: unit guides, policy files and other documents your organisation uploads, including text read from them so they can be searched and used by Cync’s AI features.
• AI features: questions you ask Ask Cync and its answers, and suggestions the HR assistant prepares for an administrator to approve or dismiss.
• Sharing features you or your organisation switch on: your digital ID or contact QR (the fields you choose are visible to anyone with the link until you revoke it); your staff business card, if your organisation turns cards on (your name, job title, work email, company details and anything you add are visible to anyone with the card’s link or QR code); and contact details that people choose to share with you through your card.
• Emails: records of the emails Cync sends you (such as invitations, password resets, policy notices and Monday summaries) and whether you unsubscribed from the summaries.
• Security records: audit logs of important actions (who did what, and when), and technical request records that our hosting providers process to run and protect the service, which can include IP addresses.

How it is used

To run your organisation’s workspace: setting up your account and signing you in; tracking onboarding, learning and policy acknowledgement; showing reports to the people your organisation authorises; sending the emails described above; answering questions with AI; keeping the service secure, preventing misuse and fixing problems; and meeting legal obligations. Cync does not sell your information, use it for advertising, or show it to other organisations.

Your organisation decides the legal basis for its own use of your information, for example managing your employment or meeting its legal duties.

Who can see it

• Within your organisation: Company and HR Admins can see and manage employee records, progress, reports and HR work. Managers and unit leads see what their role allows. Colleagues may see directory details such as your name, job title and department.
• Contacts shared through your staff card are visible to you only. Your organisation sees totals, not the details.
• Cyncidentity: our platform administrators see organisation-level information (such as the organisation’s name, its first administrator and the number of accounts), not employee records. Our staff access workspace content only where needed to support, secure or maintain the service, at your organisation’s request, or where the law requires.
• Service providers that run parts of Cync for us: Render (application hosting), Neon (database), Cloudflare (file storage), Resend (email delivery) and Anthropic (AI). They process information only to provide their service to us.
• Others only where the law requires it, or to protect people, the service or our rights.

AI features

When you use Ask Cync, the course builder or the HR assistant, your question and the relevant records and documents you are allowed to see are sent to Anthropic’s Claude models to produce the answer. Answers cite their sources and can be wrong, so check them before relying on them. The HR assistant never changes anything until an administrator approves it. Anthropic’s commercial terms say it does not train its models on this information.

Where it is processed

Our providers may process information outside your country, including in the United Kingdom, the European Union and the United States, where privacy laws may differ. Where the law requires safeguards for these transfers, we rely on our providers’ contractual commitments. Ask support for current details.

How long it is kept

Workspace information is kept while your organisation uses Cync and as its administrators decide (for example, when someone leaves, their account can be suspended and their staff card turns off automatically). When an organisation’s agreement with cyncidentity ends, its information is returned or deleted as that agreement sets out. Backups and security logs are kept for a limited time and then removed.

Cookies and storage

Cync uses only cookies needed to sign you in: cync_access (15 minutes) and cync_refresh (up to 30 days) for workspace users, and cync_platform (up to 8 hours) for Cync platform administrators. They are HttpOnly, Secure and SameSite=Lax. Signing out ends the session. Cync does not use advertising or third-party analytics cookies, so there is no cookie banner. Fonts and scripts are served by Cync itself.

Security

Each organisation’s information is kept separate by database rules as well as by the application. The service uses encrypted connections, protected passwords, limits on repeated sign-in attempts, short-lived sign-in sessions, a restricted database account for the running service, and audit logs. No online service can promise perfect security. Report anything suspicious to your administrator or to support@cyncidentity.com.

Your rights

Depending on the law that applies to you, you may ask to see the information held about you, to correct it, to have it deleted or restricted, to object to some uses, or to get a copy. Because your organisation controls its workspace, send these requests to your HR team first; cyncidentity will help your organisation respond. If you are in Ghana, you can also complain to the Data Protection Commission; elsewhere, to your local data protection authority.

Changes

We will update this notice when the service changes and show the date of the latest version at the top. Your organisation will be told about important changes.