California Privacy Notice - CCPA/CPRA Disclosures

This California Privacy Notice supplements the Genaya Privacy Policy and applies to California residents whose personal information Genaya LLC ("Genaya", "we", "us") collects as a business under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ("CCPA"). It does not apply to Customer Data that we process as a service provider on behalf of an organization using Genaya; if a business you dealt with uses Genaya, direct requests about your information to that business, and we will support it in responding.

1Categories of personal information we collect

In the last 12 months we have collected the following categories of personal information, as described in more detail in our Privacy Policy:

Identifiers: name, email address, phone number, postal address, IP address, account identifiers.
Customer records (Cal. Civ. Code 1798.80(e)): contact details, business information, payment card metadata (brand and last four digits), bank-link information (bank name, routing information, masked account details, and payment references), and, for GenayaPay identity verification and tax features, government identifiers processed by our payment processor or stored encrypted.
Commercial information: subscriptions, add-ons, purchases, usage records, and billing history.
Internet or other electronic network activity: pages viewed, features used, device and browser information, log data, and analytics events.
Geolocation data: approximate (city-level) location derived from IP address.
Audio, electronic, visual, or similar information: profile photos; support screenshots you attach; and, when you communicate with us, recordings or transcripts of those interactions.
Professional or employment-related information: organization, role, and team details you or your organization provide.
Inferences: limited product-usage inferences used to improve and support the Services.
Sensitive personal information: account log-in credentials; and government identifiers collected for payment identity verification (processed by Stripe) or tax reporting (stored encrypted). We use sensitive personal information only for the purposes permitted by the CCPA (providing the Services, security, and legal compliance), and we do not use it to infer characteristics.

2Sources of personal information

We collect personal information directly from you (account signup, onboarding, forms, support), automatically from your devices (cookies, log data, analytics), from your organization when it adds you as a team member, from sign-in providers you choose (Google, Apple, Facebook), from integrations you connect, and from our service providers (for example payment and verification results from Stripe).

3Purposes for collection and use

We collect and use personal information for the business purposes described in the "How we use information" section of our Privacy Policy: providing and operating the Services, security and fraud prevention, billing and account management, support, product improvement and analytics, our own marketing (with opt-outs), and legal compliance.

4Disclosure of personal information

We disclose the categories above to service providers and contractors for business purposes under written contracts that restrict their use of the information - including cloud infrastructure and analytics (Google), payment processing (Stripe), communications carriers (Telnyx, with Deepgram transcription), AI model providers (OpenAI, Anthropic), email delivery (Resend), search hosting (Meilisearch), affiliate program administration (FirstPromoter), and the other providers listed in our Privacy Policy. Separately, our public marketing and signup pages disclose identifiers and internet activity (cookie identifiers, device and browser information, pages viewed, ad click identifiers, and hashed contact information entered in forms on those pages) to Meta Platforms for advertising measurement, as described in section 5. We also disclose information to comply with law, to protect rights and safety, and in corporate transactions, as described in our Privacy Policy.

6Retention

We retain each category of personal information for as long as needed for the purposes described above - generally for the life of your account plus a limited wind-down period - and longer where required for legal, tax, accounting, dispute-resolution, or security purposes, as described in the Data retention section of our Privacy Policy.

7Your California rights

Subject to the CCPA's conditions and exceptions, California residents have the right to:

Know and access: request the categories and specific pieces of personal information we have collected about you, the sources, purposes, and the categories of recipients.
Delete: request deletion of personal information we collected from you.
Correct: request correction of inaccurate personal information.
Portability: receive your information in a portable format.
Opt out of sale or sharing: opt out of the advertising "sharing" described in section 5 at genaya.com/privacy-choices, or by using an opt-out preference signal such as Global Privacy Control.
Limit use of sensitive personal information: we already use sensitive personal information only for permitted purposes, so no separate limit right is required; you may still contact us with concerns.
Non-discrimination: we will not discriminate against you for exercising your rights.

8How to exercise your rights

Submit requests by emailing help@genaya.com with the subject "California privacy request", or through your account settings where available. We will verify your identity - typically by confirming control of the email address associated with your account and, where necessary, requesting additional information - and respond within 45 days, with one 45-day extension where reasonably necessary. You may use an authorized agent to submit a request; we will require proof of the agent's authority and may still verify your identity directly. If we deny a request, you may appeal by replying to our response, and we will explain the outcome of the appeal.

9Opt-out preference signals and Do Not Track

We honor opt-out preference signals such as Global Privacy Control as a valid request to opt out of the "sharing" described in section 5: when your browser sends the signal, the advertising pixel does not load and no information is shared with our advertising partner from that browser. The signal applies to the browser or device that sends it. You can make the same choice manually at genaya.com/privacy-choices. Our sites do not respond to legacy Do Not Track browser signals.

10Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for those parties' direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

11Customer Data

When we process Customer Data for an organization that uses Genaya, we act as a service provider under the CCPA: we process that information only to provide the Services under our agreement with the organization, and we do not sell it, share it, or use it for our own purposes except as permitted for service providers (such as security and service improvement). Direct requests about Customer Data to the organization you dealt with.

12Contact

Questions about this notice or your California rights? Email help@genaya.com. This notice is reviewed and updated at least once every 12 months; the effective date above reflects the latest revision.