Privacy policy

01Who we are

Sycamore Analytical is an independent analytical testing laboratory at Alamo Plaza, 2796 Sycamore Drive #204, Simi Valley, CA 93065. This policy covers sycamoreanalytical.com, the client portal, and the certificates we publish.

02What we collect

What you give us

• Account details — your name, email address, and the password you set. We never see your password itself; our authentication provider stores a hash of it.
• Company and billing details — company name, billing address, contact information for invoicing.
• Sample details — what you tell us you are sending: compound, lot code, declared amount, and any notes.
• Certificate branding — the company name, logo, website and address you want printed on your certificates.
• Anything you write to us — emails, support requests, and the notes attached to an order.

What we generate

• Analytical results — the figures our instruments produce from your sample, and the certificates built from them. See section 04.
• Chain of custody — when a sample arrived, who handled it, and when its status changed.

What is collected automatically

• Server logs — IP address, browser and operating system, pages requested, and the time of the request. These are how a hosting service works; every site has them.
• Session data — a token that keeps you signed in to the portal between page loads.

03How we use it

We use what we collect to run the laboratory and nothing else:

• To receive, track and test your samples.
• To produce certificates and make them available in your portal account.
• To answer a public verification request for a certificate you have chosen to publish.
• To invoice you and record payment.
• To reply when you contact us.
• To keep the service secure, diagnose faults, and meet our legal obligations.

04Your analytical results

The results of a test belong to the client who commissioned it. How they are treated is the most important thing in this policy, so it is stated plainly.

Every certificate starts unpublished. Publishing is a decision you make, one certificate at a time, from your portal account — and you can reverse it. We will not publish a result for public verification without that.

A published certificate is public by design: verification only works if a stranger holding the report ID can check it. Before publishing, consider that a report ID printed on a product label can be checked by anyone who reads the label. That is the point of it.

There is no page anywhere on this site that lists certificates. Verification takes an exact ID you already hold and returns that one record. Nobody can browse or enumerate what we have issued, to you or to anyone else.

We do not publish, aggregate or sell results across clients. We may report figures about the laboratory itself — how many samples we ran in a month, average turnaround — but never in a form that identifies a client, a lot, or a result.

05Who else sees it

We share personal information only in these circumstances:

• Service providers who run parts of the service for us — hosting, database and authentication, email delivery, and payment processing. They act on our instructions, may use the data only to provide that service, and may not use it for their own purposes.
• Anyone you tell us to — including publishing a certificate, and linking a colleague's login to your company account.
• When the law requires it — a valid subpoena, court order, or lawful request. Where we are legally permitted to tell you first, we will.
• To protect people — where disclosure is genuinely necessary to prevent harm, fraud, or a serious threat to safety.
• In a business transfer — if the laboratory is sold or merged, records may pass to the acquirer, who would be bound by this policy until you were notified of any change.

That is the complete list. Nobody else receives your information.

06How it is protected

Two things do most of the work here, and both are structural rather than promises:

• Separation is enforced by the database, not by the website. Every table carries row-level security, so a query for another client's samples returns nothing — their rows are never read, never assembled, never sent to a browser. This is not a filter applied after the fact in JavaScript, which could be bypassed; it is applied inside the database before a response exists.
• Certificate files are stored privately. Uploaded certificates live in private storage under a path belonging to one account. There is no permanent public URL for any of them. Each download is a link that expires within minutes.

Alongside those: traffic is encrypted in transit with TLS; passwords are stored hashed by our authentication provider and are never visible to us; staff access is granted individually and can be revoked immediately; and changes to samples, orders, certificates and access are recorded in an audit trail that the dashboard cannot edit or delete.

07Cookies and tracking

We use the minimum a portal needs to function:

• Session storage — keeps you signed in as you move between pages. Without it you would sign in on every page load.
• Local preferences — small things stored in your own browser, such as a remembered filter or an unsent draft. These never leave your device and we cannot read them.

We do not use advertising cookies, third-party trackers, cross-site pixels, or analytics that follow you elsewhere on the internet. Clearing your browser storage signs you out and loses those preferences; nothing else breaks.

08Do Not Track

Some browsers send a Do Not Track signal. There is no agreed standard for how a site should respond, so we do not respond to it differently — but that is because there is nothing to switch off. We do not track you across other websites at all, whether or not the signal is sent. California law requires us to state our practice on this, and that is it.

09How long we keep it

Closing your account does not erase issued certificates. A certificate someone else is relying on has to stay verifiable, and withdrawing it — which we can do — is a different act from deleting the record that it existed.

10Your rights

Whoever you are and wherever you live, you can ask us to:

• Tell you what personal information we hold about you and where it came from.
• Give you a copy of it.
• Correct anything inaccurate — much of it you can edit yourself under Account details in the portal.
• Delete it, subject to the retention periods above and to any legal obligation to keep it.
• Stop marketing — we send very little, and every message has an unsubscribe link.

We will not treat you differently for asking. No worse price, no worse service, no delay.

To make a request, email support@sycamoreanalytical.com from the address on your account, or write to the postal address in section 14. We aim to respond within 45 days. We may need to verify who you are first — we are not going to hand over one client's information to someone who has learned their email address.

If you are in California

California residents have specific rights under the California Consumer Privacy Act, as amended, where it applies to a business. Whether or not those thresholds apply to a laboratory of our size, we honour the requests above from any California resident, and we do not sell or share personal information as those terms are defined in that Act. You may use an authorised agent to make a request on your behalf; we will ask for proof that you authorised them.

11Children

This is a business-to-business laboratory service. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child has given us personal information, write to support@sycamoreanalytical.com and we will delete it.

12Other sites

Our pages sometimes link elsewhere — a carrier's tracking page, a client's own website printed on their certificate. Those sites have their own privacy policies and we have no control over them. This policy covers only what we do.

13Changes

We may update this policy. The effective date at the top always reflects the current version. If a change materially affects how we handle your information, we will email account holders rather than change the page quietly and hope you re-read it.

14Contact us

If you are unhappy with how we have handled a request, say so and we will look at it again. California residents may also contact the California Privacy Protection Agency or the California Attorney General's office.