CCPA Notice
Effective 1 September 2026. Last updated 1 September 2026.
This notice is provided by Yin Yang, Inc. (dba Elaichi) under the California Consumer Privacy Act, as amended by the CPRA. It supplements the Privacy Policy. Terms used here have their CCPA meanings.
1. The two roles — read this first
For data inside a customer's Elaichi workspace, we are a service provider, not a business. Our customers decide what to connect and why; we process on their documented instructions under the DPA. If your personal information is in an organization's Elaichi workspace and you want to exercise a right over it, contact that organization. We will forward your request and assist them, but we cannot act on it ourselves.
We are a business only for the personal information we collect for our own purposes — account holders, billing contacts, people who email us, and website visitors. The rest of this notice concerns that data.
2. Selling and sharing
We do not sell personal information. We never have.
We do share a limited amount of personal information for cross-context
behavioral advertising. When a visitor to elaichi.ai consents to
advertising cookies, identifiers are disclosed to Google so we can measure
whether an advertisement led to a signup. California law classifies that as
"sharing".
You are opted out by default. Nothing is shared unless you actively accept cookies — stricter than California requires, which permits sharing until you opt out. We also honour the Global Privacy Control signal automatically: if your browser sends it and you have made no explicit choice, we treat it as an opt-out and load no advertising script.
To opt out, see Your Privacy Choices.
What is never shared: anything inside a customer's Elaichi workspace, any data reached through a connector, and sensitive personal information. Those are never disclosed for advertising, and never used to train a model.
We have not enabled Google Signals, so no cross-device advertising profile is built from our site.
We do not have actual knowledge of selling or sharing the personal information of consumers under 16. Elaichi is a business-to-business service and is not offered to anyone under 18.
3. Personal information we collect as a business
| CCPA category | Do we collect it? | Examples | Source | Retention |
|---|---|---|---|---|
| Identifiers | Yes | Name, work email, organization, account and IdP identifiers | You, your employer, your identity provider | Account life + 7 years for billing records |
| Customer records (Cal. Civ. Code §1798.80) | Yes | Billing contact and subscription records | You; Stripe | 7 years |
| Commercial information | Yes | Plan, subscription status, invoice history | You; Stripe | 7 years |
| Internet or network activity | Yes | Pages viewed, referrer, device and browser type. Cookieless and aggregate by default; with your consent, also Google Analytics and Google Ads measurement, and product-usage events in the application | Your browser | 14 months (Google Analytics); aggregate reports indefinitely |
| Geolocation data | Coarse only | Approximate region inferred from IP | Your browser | Aggregate only |
| Audio, electronic, visual | Limited | Support correspondence you send us | You | Account life |
| Professional or employment information | Yes | Job title or role, where you provide it | You; your identity provider | Account life |
| Sensitive personal information | Limited | Account log-in credentials | You | Account life |
| Biometric information | No | — | — | — |
| Education information | No | — | — | — |
| Inferences / profiles | No | We build no profiles and draw no inferences about you | — | — |
We do not collect government identifiers, financial account numbers, racial or ethnic origin, religious beliefs, union membership, health data, genetic data, precise geolocation, or the contents of your mail or messages as a business. Our Terms prohibit customers from routing several of these categories through the Service at all — see Terms §8.
Sensitive personal information
The only sensitive personal information we handle as a business is account log-in credentials, used solely to authenticate you and secure your account. We do not use or disclose it to infer characteristics. Because our use is limited to purposes the CCPA permits without a right to limit, the "Limit the Use of My Sensitive Personal Information" right does not apply — but you may still ask us about it.
4. Why we collect it
To provide, secure, and support the Service; to bill and keep tax and accounting records; to respond to support and sales enquiries; to detect and prevent fraud, abuse, and security incidents; to comply with law; and to send service and security notices. Marketing email is sent only with consent and can be withdrawn at any time.
We do not use personal information to train or improve any AI model.
5. Who we disclose it to
For business purposes, to the sub-processors listed at /subprocessors/ — Cloudflare, Stripe, OVH, and our Indian affiliate — each bound by a written contract limiting them to performing services for us. None of these disclosures is a sale or a share.
For analytics and advertising, only with your consent, to Google
(Analytics 4 and Ads measurement on elaichi.ai). That disclosure is the
"sharing" described in section 2.
We may also disclose personal information to comply with law or valid legal process, to enforce our agreements, or in connection with a merger or acquisition, in which case this notice will govern until updated.
6. Your California rights
You have the right to:
- Know what personal information we have collected, the categories of sources, our purposes, and the categories of third parties to whom we disclose it
- Access a copy of the specific pieces we hold
- Delete personal information, subject to legal exceptions
- Correct inaccurate personal information
- Opt out of sharing for cross-context behavioral advertising — see Your Privacy Choices. We do not sell.
- Limit the use of sensitive personal information — see section 3
- Non-discrimination — we will never deny service, charge a different price, or provide a different quality of service because you exercised a right. We offer no financial incentives for personal information.
7. How to exercise your rights
If your information is in a customer's Elaichi workspace, contact that organization directly.
If we are the business, email [email protected] with the request and the email address associated with you.
Verification. We confirm your identity by sending a confirmation link to the email address we hold. For deletion and correction requests we apply a second check — confirmation from an authenticated session, or matching two data points already on file. We ask for no more information than is necessary, and we use anything you provide for verification only.
Authorized agents may submit a request with written permission signed by you; we will also verify your identity directly and may ask you to confirm the agent's authority.
Timing. We confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 days where a request is complex, with notice to you. There is no charge for a reasonable request.
8. Other US states
Residents of other US states with comprehensive privacy laws may have comparable rights. Use the same contact address and we will honour any right the applicable law gives you.
9. Contact
Yin Yang, Inc., 9450 SW Gemini Dr, PMB 69868, Beaverton, Oregon 97008‑7105, USA.
If you have a disability and need this notice in an alternative format, email us and we will provide one.