# CCPA Notice

_Effective 1 September 2026. Last updated 1 September 2026._

This notice is provided by **Yin Yang, Inc.** (dba Elaichi) under the
California Consumer Privacy Act, as amended by the CPRA. It supplements the
[Privacy Policy](/privacy/). Terms used here have their CCPA meanings.

## 1. The two roles — read this first

**For data inside a customer's Elaichi workspace, we are a _service provider_,
not a business.** Our customers decide what to connect and why; we process on
their documented instructions under the [DPA](/dpa/). If your personal
information is in an organization's Elaichi workspace and you want to exercise
a right over it, **contact that organization.** We will forward your request
and assist them, but we cannot act on it ourselves.

**We are a _business_ only for the personal information we collect for our own
purposes** — account holders, billing contacts, people who email us, and
website visitors. The rest of this notice concerns that data.

## 2. Selling and sharing

**We do not sell personal information.** We never have.

**We do share a limited amount of personal information for cross-context
behavioral advertising.** When a visitor to `elaichi.ai` consents to
advertising cookies, identifiers are disclosed to Google so we can measure
whether an advertisement led to a signup. California law classifies that as
"sharing".

**You are opted out by default.** Nothing is shared unless you actively accept
cookies — stricter than California requires, which permits sharing until you opt
out. We also honour the **Global Privacy Control** signal automatically: if your
browser sends it and you have made no explicit choice, we treat it as an
opt-out and load no advertising script.

To opt out, see **[Your Privacy Choices](/privacy-choices/)**.

**What is never shared:** anything inside a customer's Elaichi workspace, any
data reached through a connector, and sensitive personal information. Those are
never disclosed for advertising, and never used to train a model.

**We have not enabled Google Signals**, so no cross-device advertising profile
is built from our site.

**We do not have actual knowledge of selling or sharing the personal
information of consumers under 16.** Elaichi is a business-to-business service
and is not offered to anyone under 18.

## 3. Personal information we collect as a business

| CCPA category | Do we collect it? | Examples | Source | Retention |
|---|---|---|---|---|
| **Identifiers** | Yes | Name, work email, organization, account and IdP identifiers | You, your employer, your identity provider | Account life + 7 years for billing records |
| **Customer records (Cal. Civ. Code §1798.80)** | Yes | Billing contact and subscription records | You; Stripe | 7 years |
| **Commercial information** | Yes | Plan, subscription status, invoice history | You; Stripe | 7 years |
| **Internet or network activity** | Yes | Pages viewed, referrer, device and browser type. Cookieless and aggregate by default; with your consent, also Google Analytics and Google Ads measurement, and product-usage events in the application | Your browser | 14 months (Google Analytics); aggregate reports indefinitely |
| **Geolocation data** | Coarse only | Approximate region inferred from IP | Your browser | Aggregate only |
| **Audio, electronic, visual** | Limited | Support correspondence you send us | You | Account life |
| **Professional or employment information** | Yes | Job title or role, where you provide it | You; your identity provider | Account life |
| **Sensitive personal information** | Limited | Account log-in credentials | You | Account life |
| **Biometric information** | **No** | — | — | — |
| **Education information** | **No** | — | — | — |
| **Inferences / profiles** | **No** | We build no profiles and draw no inferences about you | — | — |

**We do not collect government identifiers, financial account numbers, racial
or ethnic origin, religious beliefs, union membership, health data, genetic
data, precise geolocation, or the contents of your mail or messages** as a
business. Our Terms prohibit customers from routing several of these categories
through the Service at all — see [Terms §8](/terms/).

### Sensitive personal information

The only sensitive personal information we handle as a business is **account
log-in credentials**, used solely to authenticate you and secure your account.
We do not use or disclose it to infer characteristics. Because our use is
limited to purposes the CCPA permits without a right to limit, **the "Limit the
Use of My Sensitive Personal Information" right does not apply** — but you may
still ask us about it.

## 4. Why we collect it

To provide, secure, and support the Service; to bill and keep tax and
accounting records; to respond to support and sales enquiries; to detect and
prevent fraud, abuse, and security incidents; to comply with law; and to send
service and security notices. Marketing email is sent only with consent and can
be withdrawn at any time.

**We do not use personal information to train or improve any AI model.**

## 5. Who we disclose it to

**For business purposes**, to the sub-processors listed at
**[/subprocessors/](/subprocessors/)** — Cloudflare, Stripe, OVH, and our Indian
affiliate — each bound by a written contract limiting them to performing
services for us. **None of these disclosures is a sale or a share.**

**For analytics and advertising, only with your consent**, to **Google**
(Analytics 4 and Ads measurement on `elaichi.ai`). That disclosure is the
"sharing" described in section 2.

We may also disclose personal information to comply with law or valid legal
process, to enforce our agreements, or in connection with a merger or
acquisition, in which case this notice will govern until updated.

## 6. Your California rights

You have the right to:

- **Know** what personal information we have collected, the categories of
  sources, our purposes, and the categories of third parties to whom we
  disclose it
- **Access** a copy of the specific pieces we hold
- **Delete** personal information, subject to legal exceptions
- **Correct** inaccurate personal information
- **Opt out** of sharing for cross-context behavioral advertising — see
  **[Your Privacy Choices](/privacy-choices/)**. We do not sell.
- **Limit** the use of sensitive personal information — see section 3
- **Non-discrimination** — we will never deny service, charge a different
  price, or provide a different quality of service because you exercised a
  right. We offer no financial incentives for personal information.

## 7. How to exercise your rights

**If your information is in a customer's Elaichi workspace**, contact that
organization directly.

**If we are the business**, email
**[privacy@elaichi.ai](mailto:privacy@elaichi.ai)** with the request and the
email address associated with you.

**Verification.** We confirm your identity by sending a confirmation link to
the email address we hold. For deletion and correction requests we apply a
second check — confirmation from an authenticated session, or matching two data
points already on file. We ask for no more information than is necessary, and
we use anything you provide for verification only.

**Authorized agents** may submit a request with written permission signed by
you; we will also verify your identity directly and may ask you to confirm the
agent's authority.

**Timing.** We confirm receipt within 10 business days and respond within
**45 days**, extendable once by a further 45 days where a request is complex,
with notice to you. There is no charge for a reasonable request.

## 8. Other US states

Residents of other US states with comprehensive privacy laws may have
comparable rights. Use the same contact address and we will honour any right
the applicable law gives you.

## 9. Contact

**[privacy@elaichi.ai](mailto:privacy@elaichi.ai)**

Yin Yang, Inc., 9450 SW Gemini Dr, PMB 69868, Beaverton, Oregon 97008‑7105, USA.

If you have a disability and need this notice in an alternative format, email
us and we will provide one.