Privacy Policy

Version: October 1, 2026

Effective Date: This Privacy Policy is effective when published on cuspo.com.

Cuspo LLC ("Cuspo," "we," "us," or "our") provides compliance-record software for U.S. dental practices. This Privacy Policy explains how Cuspo collects, uses, discloses, retains, and protects personal information in connection with cuspo.com, subscription administration, support channels, and the Cuspo application (collectively, the "Services").

This Privacy Policy is not a dental practice's Notice of Privacy Practices under HIPAA. The Services are not launched as a patient-record system and Customers must not intentionally submit patient-identifiable information or Protected Health Information ("PHI"). Cuspo does process practice records and employee compliance records on behalf of Customers, including confidential employee medical information used for workplace-safety and employment recordkeeping. Unstructured uploads and ordinary support email are not content-inspected and may receive prohibited patient information accidentally; Section 7 explains how Cuspo handles that situation.

1. WHEN THIS POLICY APPLIES

This Policy applies to information Cuspo handles in connection with:

(a) visits to cuspo.com, including waitlist signups and Vercel Analytics; (b) Customer accounts and subscription administration; (c) Customer use of the application, including compliance records, generated documents, uploads, mobile-capture links, and exports; (d) support, security, and service administration; and (e) billing and other business communications.

The Services use one shared practice sign-in and are not designed for patient accounts or direct patient use. A Customer controls which workforce members may use its practice credential. If a patient contacts Cuspo about information held by a dental practice, Cuspo may direct the person to that practice.

2. CUSPO'S ROLE FOR DIFFERENT TYPES OF INFORMATION

2.1 Cuspo Business Information. Cuspo determines how it uses information for its own business operations, such as website and waitlist information, business-contact information, subscription records, support communications, security information, and Service Data.

2.2 Customer Data. Customer controls the practice, employee, compliance, and file content it submits to the Services. Cuspo processes Customer Data on Customer's behalf to provide, secure, support, maintain, and administer the Services, subject to the Terms of Service and Data Processing Addendum ("DPA").

2.3 Employer and Records-Custodian Role. Customer remains the employer, dental-practice operator, and records custodian responsible for determining what employee and compliance records it may collect, how those records may be used or disclosed, how long they must be kept, and who may access them. Cuspo provides storage and processing functionality and does not assume Customer's employer, OSHA, professional, or records-custodian duties.

3. INFORMATION WE COLLECT

3.1 Business and Contact Information. We may collect a person's name, work email address, job title, practice name, business address, state, timezone, and information submitted through sales, waitlist, onboarding, support, or other business communications.

3.2 Practice Account Information. We collect the practice owner's email address and authentication information needed for one-time-code sign-in, together with practice name, state, timezone, subscription status, account settings, and related security and authentication events. The current product does not create separate per-person application accounts or maintain a role-based membership directory.

3.3 Customer Content. We process Customer Data that a Customer creates, uploads, enters, captures, generates, or stores through the Services. Depending on the features used, this includes employee roster information; sterilization cycles and spore-test records; equipment, safety, waterline, amalgam, nitrous, x-ray, DEA, emergency-kit, waste-manifest, training, document-review, chemical-inventory, BAA-registry, and structured breach-log records; generated compliance documents and their input snapshots; readiness answers; vault files and SDS files; proof photos; mobile-capture images and readings; and records in the confidential drawer.

3.4 Employee and Confidential Records. Customer Content may include employee display name, role, hire date, trainer-of-record status, active or terminated status, training attendance, hepatitis B vaccination or declination status, post-exposure follow-up information, and sharps-injury-log information. The confidential drawer is designed to separate designated employee medical and sharps records from ordinary application views. The sharps-injury-log structure does not include an employee-identity field.

3.5 Technical and Usage Information. We may collect IP address, browser and device information, timestamps, authentication events, application activity, feature usage, error and diagnostic information, security events, rate-limit information, and similar data needed to operate, secure, troubleshoot, and improve the Services. Vercel Analytics provides cookieless page analytics; Cuspo scrubs URLs containing access tokens before analytics events are sent.

3.6 Support Information. If a Customer contacts support, we collect the information provided with the request and information reasonably needed to investigate or resolve it. The support mailbox is ordinary email and is not content-inspected for patient information. Customers must not send patient-identifiable information or PHI through support email or other support channels.

3.7 Subscription and Billing Information. We collect Stripe customer and subscription identifiers, plan selection, invoice and payment status, billing cadence, and related business billing information. Payment-card information is entered on Stripe-hosted surfaces and does not pass through Cuspo's systems.

3.8 Waitlist Information. Before paid signup, Cuspo may collect email addresses and related signup information from people who join the marketing waitlist.

4. HOW WE COLLECT INFORMATION

We collect information:

(a) directly from Customers, Customer workforce members, website visitors, and people who communicate with us; (b) automatically when people use cuspo.com or the application; (c) from a Customer's configuration and use of the Services, including generated records and mobile-capture links; (d) from service providers that help us operate, secure, host, communicate, analyze, and bill for the Services; and (e) as otherwise directed or authorized by Customer or permitted by law.

5. HOW WE USE INFORMATION

Cuspo may use information to:

(a) provide, host, operate, maintain, and support the Services; (b) authenticate the shared practice account and administer subscriptions; (c) process business billing; (d) provide compliance logging, document, recordkeeping, reminder, export, and related functionality requested by Customer; (e) respond to support and business communications; (f) protect the security, integrity, reliability, and availability of the Services; (g) detect, investigate, and prevent misuse, fraud, unauthorized access, and security incidents; (h) troubleshoot errors and improve service performance and usability using Service Data and information Cuspo controls for its own business purposes; (i) maintain audit and version history; (j) comply with law, valid legal process, contractual duties, and retention requirements; (k) enforce applicable agreements and protect legal rights; and (l) create and use aggregated or non-identifying Service Data for security, reliability, analytics, capacity planning, and product improvement.

Cuspo does not sell Customer Data or use Customer Data for cross-context behavioral advertising, data-broker activities, or unrelated marketing.

6. CUSTOMER DATA AND EMPLOYEE RECORDS

6.1 Customer-Controlled Processing. Cuspo processes Customer Data to provide the Services to the Customer that supplied or authorized the information. Customer determines the purposes for which it uses the Services and remains responsible for its practice, workforce, recordkeeping, and legal obligations.

6.2 Data Processing Addendum. The DPA governs Cuspo's processing of Customer Data on Customer's behalf, including confidentiality, security, subprocessors, assistance, incident handling, export, retention, and deletion. Customer Data may be subject to legal retention periods that continue after a subscription ends or after a deletion request.

6.3 Employee Medical and Workplace Records. The Services may store employer-held hepatitis B vaccination or declination records, post-exposure follow-up records, and other workplace-safety information that Customer treats as employee records. Customer remains responsible for determining applicable confidentiality, access, retention, and disclosure requirements. Cuspo processes those records only to provide the Services, on Customer's instructions, and subject to the Terms and DPA.

7. PROHIBITED PATIENT DATA

7.1 No Intended Patient-Data Service. The Services are designed so that structured application fields do not capture patient-identifiable information, and Customer must not intentionally enter, upload, photograph, email, or otherwise submit patient-identifiable information or PHI. Cuspo does not intentionally provide a patient-PHI service under the current launch configuration. A later feature that intentionally supports PHI would require a separate written launch decision and any Business Associate Agreement required by law before activation.

7.2 Incidental Ingress and Removal. Unstructured vault uploads, confidential-drawer attachments, mobile-capture photos, and ordinary support email are validated or transmitted without automated inspection of file or message content for patient information. If Customer discovers that prohibited patient information was submitted, Customer must notify Cuspo promptly and identify the affected item. On Customer's report, Cuspo will remove the identified item from active storage and void associated application metadata within five business days, subject to legal preservation requirements, and will confirm completion to Customer. If Cuspo independently discovers prohibited patient information, Cuspo will notify Customer and remove the identified item from active storage as soon as reasonably practicable, subject to legal preservation requirements.

8. HOW WE DISCLOSE INFORMATION

Cuspo may disclose information as described below:

8.1 To the Customer. We make Customer Data and account information available through Customer's shared practice account and through export and support functions. Customer controls who may use its practice credential and is responsible for the people to whom it gives access.

8.2 To Service Providers. Cuspo currently uses Supabase for database, authentication, and file storage; Vercel for application hosting and Vercel Analytics; Stripe for subscription billing; Resend for authentication and reminder email; Upstash for rate-limit counters; and Google Workspace for the hello@cuspo.com support mailbox. These providers process information only as needed for the services they provide to Cuspo, subject to applicable contractual and legal requirements. Cuspo may change providers as the Services evolve and will update material disclosures as appropriate.

8.3 For Legal, Security, and Safety Reasons. We may disclose information if reasonably necessary to comply with law or valid legal process, respond to lawful governmental requests, protect the rights, security, or safety of Cuspo, Customers, or others, investigate misuse or security incidents, enforce agreements, or establish or defend legal claims.

8.4 Business Transactions. Information may be disclosed as part of due diligence for, or transferred in connection with, a merger, financing, acquisition, reorganization, sale of assets, or similar business transaction, subject to appropriate confidentiality and applicable legal requirements.

8.5 At Customer Direction. We may disclose Customer Data when Customer directs us to do so and the disclosure is consistent with applicable law and Cuspo's agreements.

9. COOKIES AND SIMILAR TECHNOLOGIES

Cuspo uses technologies needed to authenticate the practice account, maintain sessions, protect security, and operate the website and application. Cuspo also uses Vercel Analytics for cookieless page analytics to understand website use and diagnose performance. URLs containing access tokens are scrubbed before analytics events are sent. Cuspo does not use Customer Data for cross-context behavioral advertising.

Browser or device controls may allow a person to limit certain storage or similar technologies, but disabling technologies needed for authentication or security may prevent parts of the Services from functioning.

10. DATA RETENTION, EXPORT, AND DELETION

10.1 Retention. During an active account, compliance records are maintained on an append-only basis: corrections void or supersede prior entries rather than silently overwriting history. After account closure, Cuspo generally retains Customer Data for at least twelve months to support reactivation and post-closure audit needs, but records subject to a longer legal, regulatory, contractual, dispute-preservation, or Customer-instruction retention period, including applicable OSHA retention requirements for employee medical, training, and other workplace-safety records, are kept for the longer applicable period. Service Data, business records, security records, and waitlist information may be retained for the periods reasonably necessary for the purposes described in this Policy or as required by law.

10.2 Export and Deletion. Customer may request a complete export through Cuspo's support channel, and Cuspo will provide the complete export within thirty days after verifying the request. Customer may request earlier deletion, but Cuspo will honor deletion only to the extent permitted by applicable legal, regulatory, contractual, security, and preservation requirements. When deletion is permitted, Customer Data may remain in protected backups until overwritten through ordinary backup cycles and will not be restored except for continuity, security, recovery, or legal purposes.

11. SECURITY

Cuspo uses administrative and technical safeguards appropriate to the current Services and data model, including per-practice row-level database security, one-time-code authentication, rate limiting, restricted production access, feature-specific access controls, and audit logging where the product provides it. The shared practice credential is not per-person access control, and Customer is responsible for limiting and protecting that credential and for using any feature-specific gate as intended.

No method of internet transmission, electronic storage, email, or software operation can be guaranteed to be completely secure. Customers are also responsible for protecting credentials, email accounts, devices, networks, uploaded content, and access under their control.

12. PRIVACY CHOICES AND REQUESTS

12.1 Customer Account Information. Customer may review or update certain practice and account information through the Services. Additional requests may be submitted through Cuspo's support or privacy contact.

12.2 Requests Concerning Prohibited Patient Information. If a request concerns patient information submitted to Cuspo contrary to the Terms, the requester should ordinarily contact the dental practice that supplied the information. Cuspo may refer the request to the practice and will address the information consistent with Section 7.2, applicable law, and any legal preservation requirement.

12.3 Legal Privacy Rights. Depending on the person, jurisdiction, and information involved, applicable law may provide rights to request access, correction, deletion, or other treatment of personal information. Cuspo will respond to properly submitted requests as required by applicable law, subject to lawful exceptions and to the distinction between information Cuspo controls for its own business purposes and Customer Data Cuspo processes on a Customer's behalf.

13. CHILDREN AND PATIENTS

The Cuspo application is a business service for dental-practice personnel and is not intended for use by children or patients as application users. Customer must not intentionally submit patient-identifiable information, including information about minor patients, through the Services.

14. SALES AND ADVERTISING USES

Cuspo does not sell Customer Data, does not use Customer Data for cross-context behavioral advertising, and does not permit service providers to use Customer Data for their independent advertising purposes.

15. CHANGES TO THIS POLICY

Cuspo may update this Privacy Policy to reflect changes in the Services, legal requirements, subprocessors, or data practices. Cuspo will post the revised Policy with a new effective date and will provide additional notice if required by law or if a change materially affects Customer's contractual data-protection rights.

16. CONTACT

Privacy questions or requests may be submitted through the support or privacy contact Cuspo publishes in the Services or on its website, or by mail to:

Cuspo LLC

270 Montgomery Drive

Spartanburg, South Carolina 29302 United States