Omakyn is operated by Vynix LLC. This page explains what happens to the information you give us —
the free assessments, the compliance briefing, the engagement intake, and any documents you send
during a paid engagement.
Part of this is contractually binding: Section 16 of our Privacy
Policy covers documents sent during a paid Assessment engagement. The rest is not a promise we
ask you to take on faith — it is how the code is built, and most of it you can check yourself in
about thirty seconds.
One design decision governs everything
There is nowhere to type a description of your device.
Both assessments are multiple choice. Your browser sends the index numbers of the options you
picked — never prose. The prompt is assembled on our server from a fixed question bank, so the model
receives the wording of our questions and of the options you chose, and nothing you wrote. You
cannot supply free text, choose the model, or change the instructions, because there is no field
that would carry them.
That is not a policy. It is the shape of the request, and it is visible in your own browser's
network tab.
What happens on every page
Before you give us anything: every page on this site loads fonts from Google and is served
through Cloudflare. Both receive your IP address, your browser's user agent, and the page you are
on. That includes this page.
The five ways you give us information
0. The CRA deadlines calculator
- What leaves your browser: nothing. That
page asks three questions and computes the dates in your browser. No request, no email field,
nothing stored. Disconnect from the internet and it still works.
- It is listed here because "we collect nothing" is the kind of claim that deserves to be
checkable — and on that page it is. Open your network tab and watch it stay empty.
1. The free FDA gap assessment
- What leaves your browser: the index of each option you selected, your readiness
score, and your email address.
- What reaches the AI model (Anthropic): the text of our questions and of the options
you chose, plus your score. Your email address is not part of that prompt — it is
used to send you the report.
- What we keep: nothing. The report email is the only record, on your side and on
ours.
2. The EU CRA readiness assessment
- What leaves your browser: the index of each option you selected and your email
address. Multiple choice, same as above — no free-text field.
- What reaches the AI model: the text of our questions and of your selected options,
your score, and the regulatory deadlines our own code computed. Not your email
address.
- What we keep: this is the one flow that stores something. Your
email, your selected options and your score go into a record that is deleted automatically after
90 days. It exists so that if you reply to your report, we can see what you answered. The FDA
assessment does not do this.
3. The compliance briefing PDF
- Same answers as the FDA assessment, rendered into a PDF by Cloudflare's Browser Rendering
service, which therefore sees the document: your email address, your answers, and the gaps we
identified.
- One thing we derive: if your email is at a company domain, we infer a company name
from that domain (
[email protected] → "Acme Medical") and it appears in the
briefing and in the prompt. You never typed it and we never asked for it. Use a
personal address if you would rather we did not.
- What we keep: a copy of the PDF is emailed to us. That is how we learn a briefing was
generated at all.
4. The engagement intake, after purchase
- What you provide: company, device description, FDA pathway, target date, current
stage, your team, and notes — in free text.
- Where it goes: two emails. One to us, one confirming back to you.
- What reaches an AI model: none of it. Intake data is never sent to
any AI model. It is validated and emailed. Nothing else.
- One thing we ask of you: the intake asks for the names, emails and roles of people on
your team. They are not our users and have not agreed to anything with us. Send only what you are
entitled to share.
5. Documents during a paid engagement
- How they reach us: by email. There is no upload portal — there is no file field
anywhere on this site.
- Who can access them: one person — Martin Maciel, founder.
- Used to train AI models: never. (Privacy Policy §16c)
- How long we keep them: 90 days after your report is delivered, then deleted.
(Privacy Policy §16d)
- Who owns them: you. You retain all intellectual property rights.
- Where they live: an encrypted container on one machine, not synced to any cloud
storage. It is mounted only while we are working on your engagement, and locked the rest of the
time.
What we store
Four things. None of them is a customer account.
- A fingerprint of your IP address, not the address itself. Rate limiting needs
to tell one visitor from another, not to know who you are, so what we hold is a truncated hash of
your address. It expires after five minutes.
- Your EU CRA assessment answers, for 90 days, as described above.
- Stripe event identifiers, for seven days, so a payment is never processed
twice.
- Nothing else. No account, no password, no tracking profile, no history of
who visited what.
Our report email includes our logo, loaded from our server — so opening it tells us the message
was opened. That is a side effect of putting an image in an email, not a tracking system we built,
and we are telling you because it is true, not because anyone asked.
Who else sees your data
Seven third parties, and what each one receives:
- Anthropic — the assessment questions and your selected options, your score,
and (in the briefing only) the company name inferred from your email domain. Anthropic's published
policy states that by default it does not use inputs or outputs from its commercial API to train
models, and that API inputs and outputs are deleted within 30 days of receipt. That 30-day
figure has published exceptions, including content flagged by their automated trust and
safety systems, which is retained for up to two years. We state the exception because quoting the
30 days without it would be misleading.
- Resend — every email we send, including its full content. Resend retains
email data for 30 days.
- Cloudflare — hosting, CAPTCHA and rate limiting for every request.
- Cloudflare Browser Rendering — the HTML of your compliance briefing, in order
to turn it into a PDF. Cloudflare's documentation states that it processes this content
ephemerally and does not retain the submitted HTML or the generated PDF.
- Cloudflare Workers KV — the storage behind the three items listed above.
- Google — fonts on every page, which means your IP address and user agent on
every page you open, including this one.
- Stripe — payment details, if you buy something. Stripe never receives your
assessment answers or any engagement document.
What this page does not claim
We are a one-person company. Saying so is more useful to you than implying otherwise:
- We do not have SOC 2, ISO 27001, or any third-party security certification.
If your procurement process requires one, we will not pass it, and we would rather you know that
before the conversation than after.
- We are not a zero-knowledge system. The people and services listed above see
what is listed above.
- This page describes today's code. If we change what is sent, stored, or to
whom, this page has to change in the same commit. The date at the top is when it was last checked
against the code, not when the file was last edited.
Questions
If something here does not match what you observe, tell us and we will fix the page or the code —
whichever one is wrong. Write to [email protected].