Employee Privacy Notice

1.Who Collects Your Data

Cynserus.com operates the digital incident reporting platform used by your employer. When you submit an incident report through the platform (including via QR code), Cynserus.com collects and processes that data on behalf of your employer as part of their obligations under California SB 553 (Labor Code Section 6401.9).

2.What We Collect

2.1 Report Content

Information you voluntarily provide in your incident report, including incident descriptions, dates, locations, injury details, names of persons involved, and any other information you choose to include.

2.2 Technical Metadata

We do not collect IP addresses, device information, or browser information from employees who submit incident reports. The only technical data recorded is the submission timestamp. However, the details of your report (including time, location, and description) are visible to your employer's designated safety administrators. In workplaces with few employees, these details may make it possible to identify the reporter even without a name attached. We encourage you to consider this before submitting an anonymous report.

3.Anonymous Reports

Selecting anonymous submission means your name will not be included in the report shared with your employer's designated administrators. It does not prevent collection of the technical metadata described in Section 2.2. If you are concerned about technical identification, you may wish to consult with an attorney before submitting.

4.How Your Data Is Used

Your report data is used to:

• (a) Record and store your incident report on behalf of your employer as required under California Labor Code Section 6401.9
• (b) Make your report available to your employer's designated WVPP administrators for review and response
• (c) Generate AI-assisted severity classifications for platform administrative purposes via Anthropic's Claude AI
• (d) Maintain your employer's violent incident log as required by SB 553
• (e) Comply with applicable law, including responding to valid legal process

We do not use your incident report data to train AI models. We do not use your information for advertising, marketing, or any purpose unrelated to your employer's compliance program.

5.Data Sharing and Disclosure

We share your data with:

• (a) Your employer — designated account administrators can access reports submitted through their portal. For anonymous reports, your name is not included.
• (b) Anthropic, Inc. — incident data is processed by Anthropic's Claude AI for automated severity classification. Anthropic does not use this data to train models.
• (c) Supabase — secure database storage for incident records
• (d) Resend — transactional email notifications to administrators

We do not sell your personal information.

Legal Process

Cynserus.com may be compelled by a valid court order, subpoena, regulatory demand, or other legally required process to disclose incident report data — including reports submitted anonymously. If we receive such a demand, we will provide prompt written notice to your employer to the extent permitted by law.

6.Data Retention

Incident report data — including report content and technical metadata — is retained for five (5) years following submission, consistent with California Cal/OSHA recordkeeping requirements under California Labor Code Section 6401.9. You may request deletion of your personal information; however, if the data is part of a record your employer is legally required to maintain, we may be unable to fulfill a deletion request.

7.Your CCPA Rights

As a California resident, you have the right to:

• Know what personal information is collected about you
• Request correction of inaccurate personal information
• Request deletion of your personal information (subject to legal retention requirements)
• Opt out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising your rights

To exercise your rights, contact: privacy@cynserus.com (use subject line: "Employee Privacy Rights Request"). We will respond to verified requests within 45 days.

8.Anti-Retaliation

California SB 553 prohibits employers from retaliating against employees for reporting workplace violence incidents. This is your employer's legal obligation. If you believe you have been retaliated against, contact the California Labor Commissioner's Office (www.dir.ca.gov/dlse) or Cal/OSHA (www.dir.ca.gov/dosh).

9.Contact

Privacy inquiries: privacy@cynserus.com

Cynserus.com

Santa Clara County, California

10.Effective Date

Effective: March 17, 2026

This notice may be updated from time to time. Material changes will be effective 30 days after posting.