This California Privacy Notice supplements the Genaya Privacy Policy and applies to California residents whose personal information Genaya, Inc. ("Genaya", "we", "us") collects as a business under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ("CCPA"). It does not apply to Customer Data that we process as a service provider on behalf of an organization using Genaya; if a business you dealt with uses Genaya, direct requests about your information to that business, and we will support it in responding.
1Categories of personal information we collect
In the last 12 months we have collected the following categories of personal information, as described in more detail in our Privacy Policy:
- Identifiers: name, email address, phone number, postal address, IP address, account identifiers.
- Customer records (Cal. Civ. Code 1798.80(e)): contact details, business information, payment card metadata (brand and last four digits), and, for GenayaPay identity verification and tax features, government identifiers processed by our payment processor or stored encrypted.
- Commercial information: subscriptions, add-ons, purchases, usage records, and billing history.
- Internet or other electronic network activity: pages viewed, features used, device and browser information, log data, and analytics events.
- Geolocation data: approximate (city-level) location derived from IP address.
- Audio, electronic, visual, or similar information: profile photos; support screenshots you attach; and, when you communicate with us, recordings or transcripts of those interactions.
- Professional or employment-related information: organization, role, and team details you or your organization provide.
- Inferences: limited product-usage inferences used to improve and support the Services.
- Sensitive personal information: account log-in credentials; and government identifiers collected for payment identity verification (processed by Stripe) or tax reporting (stored encrypted). We use sensitive personal information only for the purposes permitted by the CCPA (providing the Services, security, and legal compliance), and we do not use it to infer characteristics.
2Sources of personal information
We collect personal information directly from you (account signup, onboarding, forms, support), automatically from your devices (cookies, log data, analytics), from your organization when it adds you as a team member, from sign-in providers you choose (Google, Apple, Facebook), from integrations you connect, and from our service providers (for example payment and verification results from Stripe).
3Purposes for collection and use
We collect and use personal information for the business purposes described in the "How we use information" section of our Privacy Policy: providing and operating the Services, security and fraud prevention, billing and account management, support, product improvement and analytics, our own marketing (with opt-outs), and legal compliance.
4Disclosure of personal information
We disclose the categories above to service providers and contractors for business purposes under written contracts that restrict their use of the information - including cloud infrastructure and analytics (Google), payment processing (Stripe), communications carriers (Telnyx, with Deepgram transcription), AI model providers (OpenAI, Anthropic), email delivery (Resend), search hosting (Meilisearch), affiliate program administration (FirstPromoter), and the other providers listed in our Privacy Policy. We also disclose information to comply with law, to protect rights and safety, and in corporate transactions, as described there.
5No sale or sharing
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined by the CCPA. We have not done either in the preceding 12 months, and we have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. Because we do not sell or share personal information, there is no need for a "Do Not Sell or Share My Personal Information" link; if our practices change, we will update this notice and provide the required opt-out first.
6Retention
We retain each category of personal information for as long as needed for the purposes described above - generally for the life of your account plus a limited wind-down period - and longer where required for legal, tax, accounting, dispute-resolution, or security purposes, as described in the Data retention section of our Privacy Policy.
7Your California rights
Subject to the CCPA's conditions and exceptions, California residents have the right to:
- Know and access: request the categories and specific pieces of personal information we have collected about you, the sources, purposes, and the categories of recipients.
- Delete: request deletion of personal information we collected from you.
- Correct: request correction of inaccurate personal information.
- Portability: receive your information in a portable format.
- Opt out of sale or sharing: not applicable, because we do not sell or share personal information.
- Limit use of sensitive personal information: we already use sensitive personal information only for permitted purposes, so no separate limit right is required; you may still contact us with concerns.
- Non-discrimination: we will not discriminate against you for exercising your rights.
8How to exercise your rights
Submit requests by emailing help@genaya.com with the subject "California privacy request", or through your account settings where available. We will verify your identity - typically by confirming control of the email address associated with your account and, where necessary, requesting additional information - and respond within 45 days, with one 45-day extension where reasonably necessary. You may use an authorized agent to submit a request; we will require proof of the agent's authority and may still verify your identity directly. If we deny a request, you may appeal by replying to our response, and we will explain the outcome of the appeal.
9Opt-out preference signals and Do Not Track
Because we do not sell or share personal information, opt-out preference signals such as Global Privacy Control do not change how we process your data; if our practices ever change, we will honor such signals as required by law. Our sites do not respond to legacy Do Not Track browser signals.
10Shine the Light
California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for those parties' direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.
11Customer Data
When we process Customer Data for an organization that uses Genaya, we act as a service provider under the CCPA: we process that information only to provide the Services under our agreement with the organization, and we do not sell it, share it, or use it for our own purposes except as permitted for service providers (such as security and service improvement). Direct requests about Customer Data to the organization you dealt with.
12Contact
Questions about this notice or your California rights? Email help@genaya.com. This notice is reviewed and updated at least once every 12 months; the effective date above reflects the latest revision.