Privacy Policy

SuSea, Inc. and its affiliates (“we,” “our,” or “us”) value the privacy of individuals who use our website located at you.com, apps, and related services (collectively, our “Services”). The Services provide a productivity engine that helps customers leverage AI (via multiple large language models also known as LLMs) to accomplish work and general information retrieval. We collect data to perform these Services, to understand how our consumers use the service, to identify new features and opportunities, debug platform issues, fund the services via ads, and to protect the platform from fraud and abuse. Such data processing is conducted for the following reasons:

• When we have a legal duty.
• To fulfill our contract with you.
• When it is in our legitimate interests, data processing is necessary to achieve those interests and our interests are not overridden by your interests or fundamental rights and freedoms.
• With your consent, when needed and if applicable.

The section titled “How We Share the Information We Collect” in this Privacy Policy provides information on the Affiliates, Service Providers, and third parties with whom we share information.

This privacy policy (the “Privacy Policy”) explains how we collect, use, and share information from or about you.com users (“Users” or “you” or “your”) or their devices. By using our Services, you acknowledge the collection, use, disclosure, and procedures this Privacy Policy describes. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Service and our Cookie Notice.

Unless otherwise specified herein, this Privacy Policy also applies to our enterprise subscription customers with whom we have a Master Services Agreement (our “Enterprise Customers”) and their users, as well as paid subscribers to our Services such as ProPlan or Team Plan subscribers (our “Paid Subscribers). In the event of a conflict between the terms of this Privacy Policy and the terms of an Enterprise Customer’s Master Services Agreement, the terms of the latter will control.

Finally, as noted in our Terms of Service at Section 4.1, this Privacy Policy assumes that in accessing our Services you will not include in any queries or prompts (or disclose, send or transmit to you.com), or to upload any sensitive, personal information or personally identifiable information that is subject to specific regulations or laws that impose increased protections and/or obligations with respect to handling that type of information (including, but not limited to, personal financial, health, social security numbers or other government identification numbers, ethnicity, sexual orientation and political affiliations), such as HIPAA or GLBA, or under international regulations such as GDPR, or any other information where unauthorized disclosure could cause material or severe harm or impact to you.com or third parties. Please do not enter such sensitive personal information in prompts or otherwise share such information that could enter our systems.

Information We Collect

We collect any information that you provide to us, including when you create your account, submit your preferences, or contact us. We also collect information about your device and the ways you use and interact with our Services.

We may collect a variety of information from or about you or your devices from various sources, as described below.

If you do not provide your information when requested, you may not be able to use our Services if that information is necessary to provide you with our Services or if we are legally required to collect it.

Registration and Profile Information. When you sign up for an account, we ask you for your name and email address.

Information We Obtain from Third Parties. If you choose to connect your account on a third-party platform or network to the Services, like using your Google account to access your you.com account, we receive information from Google. For example, this information may include your Google username, profile picture, and other profile information. You can see Google’s Privacy Policy here. In the future, we may allow other services to provide log-in services. If so, we will share log-in credentials with the provider and receive information you have shared with the log-in provider. The source of this information is the third-party login or platform provider you choose to connect, and the categories we receive are those described above.

Third Party Service Collections. We will not use any third-party services (e.g. DropBox, Google Drive, or Microsoft Sharepoint, etc.) to collect information without explicit permission. Personal data collected through these services may include information to help us identify your account, prompts, content created or shared by you, or feedback that you provide to our Services. This data will not be used for developing, improving, or training third party AI and/or ML models. To the extent we transfer any data to our third-party AI providers, it is solely data which our users have represented they have the right to transfer, and to which we transfer our users consent. For instance, if a user creates a document on a platform like Google or Microsoft, the user represents that he/she has the ownership and/or rights in that document to upload it to our app, and by uploading it, the user consents based on our internal processes to share it with our third-party AI providers.

Prompts, Queries and Uploaded Content. When you use our Services, we receive the prompts, queries, files, and other content you submit, together with the outputs generated in response (collectively, “User Content”). We process User Content to operate and deliver the Services, to route your requests to the large language model providers identified in “How We Share the Information We Collect,” to detect fraud and abuse, and to maintain the security and integrity of the platform. We retain User Content for the periods described in “Data Retention” below. We do not use the substance of your prompts, files, or generated outputs to train or fine-tune our own models, and our contracts with our large language model providers prohibit them from using it to train their models, except where you have separately opted in. De-identified and aggregated User Content may be used as described in “How We Use the Information We Collect.” Where the terms of an Enterprise Customer’s Master Services Agreement or a Paid Subscriber’s subscription terms conflict with this section, those terms control.

Information We Collect from Publicly Accessible Web Sources. To operate a search and answer engine, we crawl, index, and retrieve content from publicly accessible websites and other public sources. That content may include personal data relating to individuals who are not our users and who have not interacted with us. We process this information in reliance on our legitimate interests in operating an information-retrieval and search service and in providing accurate, sourced responses, having weighed those interests against the rights and freedoms of the individuals concerned and taking account, for EU and UK data subjects, of the provisions applicable to information manifestly made public and to processing for search and information-society services. Where we obtain personal data from sources other than you, we provide the information required by Articles 13 and 14 of the GDPR and UK GDPR — including the categories of data, the source, the purposes, and the applicable rights — in this Privacy Policy, and individuals may object to our processing or request erasure of their personal data from our index by contacting us at the address in “Contact Information, Inquiries or Complaints.”

Careers. If you decide that you wish to apply for a job with us, you may submit your contact information and your resume online. We will collect the information you choose to provide on your resume, such as your education and employment experience.

Please note that if you submit your resume to us, we may rely on artificial intelligence tools to assess your candidacy. We cannot guarantee or assert the reliability or legality of these tools, but considering the thousands of applicants, we must rely on the latest technologies to assist us with the hiring process. Nevertheless, we will endeavor to use the best tools on the market, while abandoning any tools that are proven to be unreliable or discriminatory.

By submitting your contact information or resume to us, you acknowledge and consent to our usage of such tools.

Device Information. We receive information about the device and software you use to access our Services, including internet protocol (IP) address, web browser type, operating system version, and device identifiers.

Usage Information. To help us understand how you use our Services, to better personalize them to you, to help us improve them, and to communicate and market to you in the most relevant ways, we automatically receive information about your interactions with our Services, like the pages or other content you view, and the dates and times of your visits.

Fraud Detection. You.com collects user telemetry for abuse and security monitoring purposes. Telemetry might include IP address, client identification signals such as browser user-agent, and actions performed on the platform.

Payment Information. We may receive your payment details if you purchase services or to access services.

Information from Cookies and Similar Technologies. We, and the third-party partners identified in our Cookie Notice, collect information using first-party and third-party cookies and similar technologies, including pixel tags, local storage, and software development kits. Please review our Cookie Notice to learn more about our Cookie practices.

How We Use the Information We Collect

We use your information primarily to provide, personalize, maintain the security of, and improve the Services you use. We also use your information to communicate with you and to carry out our marketing; to protect you and others; and to exercise, defend or establish our rights.

We use the information we collect:

• To provide, maintain, improve, and enhance our Services;
• To understand and analyze how you use our Services and develop new products, services, features, and functionality;
• To personalize our services to our members;
• To communicate with you and provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
• To process payments;
• For marketing purposes, such as developing and providing promotional materials that may be useful, relevant, valuable or otherwise of interest to you, as well as for advertising purposes and to make our advertising as relevant as possible;
• To generate anonymized, aggregate data containing only de-identified, non-personal information that we may use for any lawful purpose;
• To find and prevent fraud, and respond to trust and safety issues that may arise;
• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
• For other purposes for which we provide specific notice at the time the information is collected.

You are in control of your profile information and email preferences:

• You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt-out of receiving promotional messages from us, you will continue to receive administrative messages from us.
• You can request the deletion of your user profile and all data associated with it by emailing us at [email protected].

How We Share the Information We Collect

We share your information with third party vendors who help us to provide and enhance our Services and marketing. We share information with the following categories of third parties.

Who we share with. We may share any information we receive with vendors and service providers retained in connection with the provision of our Services. We have agreements in place with vendors and service providers to address how they may use your information.

• Affiliates. Our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy.

• Service providers. Companies and individuals that provide services on our behalf or help us operate the Services or our business (such as hosting, information technology, customer support, email delivery, communications channels and website analytics services).

  • We have service provider relationships and use various Large Language Model (LLM) providers including without limitation OpenAI, Anthropic, and Google. The privacy policies to each of these are linked to the name of the service providers noted in our trust center and we reserve the right to make changes to our provider network from time to time.
  • As of the date of this Privacy Policy, we use services such as Google Analytics and Google Tag Manager for analytics, website optimization (to see what parts of our website users like the most), and to help us improve our advertising and marketing efforts. You can see Google's privacy policy here.
  • We use Descope for account management of consumer users (See Descope privacy policy) for API users.
  • We use Amazon Web Services for various content hosting (Amazon privacy policy).
  • We use Stripe for payment processing. Stripe's privacy policy is here.
  • We provide these vendor details to provide additional transparency but don’t guarantee that this list is current or complete. See https://trust.you.com.

• Advertising partners. Third party advertising companies for the interest-based advertising purposes described above. The disclosure of this information may constitute a data “sale” under certain privacy laws.

• Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.

• Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

• Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests (including, in connection with a bankruptcy or similar proceedings).

Advertisements. We reserve the right to use advertising services as part of our service which allows us to provide, support, and improve some of our products, when using our Services without a paid subscription. We do not use what you say in email, documents, photos, or other personal files to target ads to you. We use other data, detailed below, for advertising on our Services. For example:

• We may use data we collect, such as de-identified chat data, to select and deliver some of the ads you see on our Services.
• Third parties may access and use the advertising ID (much the same way that websites can access and use a unique identifier stored in a cookie) to select and deliver ads.

The ads that you see may also be selected based on other information learned about you over time using demographic data, location data, and chat queries with our customer services support group. Enterprise or paid users are not served advertising and this section shall not apply to such users.

Data collected by other advertising companies. Advertisers sometimes include their own web beacons (or those of their other advertising partners) within their advertisements that we display, enabling them to set and read their own cookie. These third parties may place cookies on your computer and collect data about your online activities across websites or online services. These companies currently include, but are not limited to Microsoft only. Select the preceding link to find more information on the company's privacy practices, including the choices it offers. This company may also be a member of the NAI or DAA, which provide a simple way to opt out of ad targeting from participating companies. Enterprise or paid users are not subject to advertiser data collection and this section shall not apply to such users.

As Required By Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement or otherwise lawful requests and legal process, such as a court order or subpoena by public authorities to meet national security or law enforcement requirements; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety.

Merger, Sale, or Other Asset Transfers. We may disclose and transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our business or assets.

Consent. We may disclose information from or about you or your devices with your permission.

Links to Other Websites or LLM Tools. Our Services contain links to other websites that are not owned or controlled by us, such as third-party websites in chat responses, our advertisers (not applicable to Enterprise Customers or Paid Subscribers), and other business partners. This Policy only applies to information collected by our Services. We have no control over these third-party websites, and your use of third-party websites and features are subject to privacy policies posted on those websites. We are not responsible or liable for the privacy or business practices of any third-party websites linked to our Services. Your use of third parties' websites linked to our Services is at your own risk, so we encourage you to read the privacy policies of any linked third-party websites when you leave one of our Services.

Data Broker Registration

As of the date of this Privacy Policy, SuSea, Inc. is registered as a data broker with the following authorities: California Privacy Protection Agency (CPPA); Texas Secretary of State under Bus. & Com. Code Ch. 509 (with consumer rights instructions at you.com/legal/texas-privacy-rights); Oregon Department of Consumer and Business Services under ORS 646A.593; and Vermont Secretary of State under 9 V.S.A. §§ 2446–2447.

Be sure to review future updates to this Privacy Policy in the event we are compelled to supplement this list of state registrations.

Your Rights Regarding Your Data

As explained below, you.com provides ways for you to access and delete your personal information as well as exercise applicable data rights that give you certain control over your information. Please note that we are subject to the investigatory and enforcement powers of the United States’ Federal Trade Commission (FTC) as well as applicable regulation in a user’s country of residence.

All Users

Email Subscriptions. You can always unsubscribe from our commercial or promotional emails by clicking unsubscribe in those messages. We will still send you transactional and relational emails about your use of the you.com Services.

Push Notifications. You can opt out of receiving push notifications through your app settings. Please note that opting out of receiving push notifications may impact your use of the you.com Services (such as notice of Services enhancements).

Profile Information. You can review and edit certain account information you have chosen to add to your profile by logging in to your account settings and profile.

Location Information. You can prevent your device from sharing location information through your device’s system settings. But if you do, this may impact you.com’s ability to provide you our full range of features and services.

Accessing Your Information. If you would like to access your information, please email us

at [email protected]. You can also see information we have about you by logging into your account and viewing things like your profile, settings, and preferences.

Deleting Your Account. If you would like to delete your you.com account, please email us at [email protected]. In some cases, we will be unable to delete your account, such as if there is an issue with your account related to trust, safety, or fraud. When we delete your account, we may retain certain information for legitimate business purposes or to comply with legal or regulatory obligations. For example, we may retain your information because we may be obligated to do so as part of an open legal claim. When we retain such data, we do so in ways designed to prevent its use for other purposes.

Data Subject Access Requests (DSARs). If you would like to exercise your data subject rights (such as accessing, correcting, or deleting your data), you may do so by going to Privacy Requests.

Regardless of where you live, and subject to our obligations under applicable laws, you may have certain rights and choices regarding your information. For example, in addition to choices described elsewhere in this Privacy Policy, you may have some or all of the following rights and choices in general:

General Regional Rights

• Access Rights: You may have the right to receive certain information, such as the following (these rights, and the applicable types of data and time periods, will vary depending on the laws applicable to the state or country in which you reside):

  1. The categories of information we have collected or disclosed about you; the categories of sources of such information; the business or commercial purpose for collecting your information; and the categories of third parties with whom we shared your information.
  2. Access to and/or a copy of certain information we hold about you.
  3. In some circumstances, you may have the right to obtain certain information in a portable format.

• Erasure: You may have the right to request that we delete certain information we have about you. We may either decide to delete your information entirely, or we may anonymize or aggregate your information such that it no longer reasonably identifies you, and may use it to improve our Services. Certain information may be exempt from such requests under applicable law. For example, we need certain types of information so that we can provide our Services to you, we may be required to retain certain information for legal purposes, and there may be other reasons we may need to keep certain information under various applicable laws. In addition, if you ask us to delete your information, you may no longer be able to access or use some of our Services.

• Correction: You may have the right to request that we correct certain information we hold about you.

• Limitation of Processing: Certain laws may allow you to object to or limit the manner in which we process some of your information, including the ways in which we use or share it. For example, you may have these rights if the processing was undertaken without your consent and without a legitimate business interest (although we may not be required to cease or limit processing in cases where our interests are balanced against your privacy interests).

• Regulator Contact: You may have the right to contact or file a complaint with regulators or supervisory authorities about our processing of information. To do so, please contact your local data protection or consumer protection authority.

• Postings by Minors: If unbeknownst to us there are users of our Services under the age of 18, then in certain jurisdictions those minors have the right to require that we delete any content they have posted on one of our Services.

• Other: You may have the right to receive information about any financial incentives that we may offer to you, if any. You may also have the right to not be discriminated against (as provided for in applicable law) for exercising certain of your rights.

If you believe that you have specific rights under your jurisdiction and you would like to exercise any of these rights, please submit a support request via email to us at [email protected]. Other than a request to opt out of the sale or sharing of personal information or of targeted advertising, or a simple marketing opt-out (none of which requires identity verification), you will be required to verify your identity before we fulfill your request. In certain jurisdictions, you may be able to designate an authorized agent to make a request on your behalf, subject to certain requirements of your applicable law. We may require that you provide the email address we have on file for you (and verify that you can access that email account) as well as an address, phone number, or other data we have on file, in order to verify your identity. If an agent is submitting the request on your behalf, we reserve the right to validate the agent’s authority to act on your behalf, and we may be required to take additional verification measures under applicable law.

Important Information for EU and United Kingdom Users

If you are a user from the European Union or United Kingdom you should be aware that we may be considered the controller of your information (Data Controller) under the EU General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and such similar laws promulgated in the various EU countries. As a general rule, we strive to take on the role of processor and not Data Controller.

EU and UK Representative. We are established in the United States. In accordance with Article 27 of the GDPR and Article 27 of the UK GDPR, we have designated the following representatives, whom EU and UK users may contact on any matter relating to our processing of their personal data:

EU Representative:
Osano UK Compliance LTD
ATTN: ORQ9
42-46 Fountain Street
Belfast
Antrim
BT1 - 5EF

UK Representative:
Osano International Compliance Services Limited
ATTN: ORQ9
25 North Wall Quay
Dublin 1
D01 H104

Our Data Protection Officer may be contacted at [email protected] or by post at the address set out under “Contact Information, Inquiries or Complaints” below. Contacting our representative or our Data Protection Officer does not affect your right to lodge a complaint with your local supervisory authority.

You may have certain additional rights regarding your information (as defined in the GDPR and UK GDPR, for instance), including the right to:

• access your information;
• rectify your information if it is incorrect or incomplete;
• have your personally identifiable information erased (“right to be forgotten”) if certain grounds are met;
• withdraw your consent to our processing of your information at any time, but only if our processing is based on consent;
• object to our processing of your information, if our processing is based on legitimate interests;
• object to our processing of your information for direct marketing purposes; and
• receive your information from us in a structured, commonly used, and machine-readable format, and
• the right to transmit your information to another controller without hindrance from us (data portability).

Automated Decision-Making and Profiling. Where we use automated processing to make a decision that produces legal effects concerning you or otherwise significantly affects you — including where we rely on artificial intelligence tools to assess a resume submitted to us, as described under “Careers” above — you have the right to be informed of that processing, to obtain meaningful information about the logic involved and its significance and envisaged consequences, to obtain human intervention, to express your point of view, and to contest the decision. To exercise these rights, email [email protected]. Residents of U.S. states whose privacy laws confer a right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects may exercise that right at the same address.

There is no charge for any of these requests. To make a request, please contact us at [email protected]. We try to respond to such requests in a timely manner, but in no event longer than one month.

When we collect your information, we retain it for the periods and on the criteria described under “Data Retention” below, unless you exercise your right to erasure described above.

If you are a citizen of the European Union or United Kingdom, when we process your information, we will only do so in the following situations:

• We have a contractual obligation.
• You have provided your consent. You are able to remove your consent at any time, and you may do this by contacting us at [email protected].
• We have a legal obligation.
• We have a legitimate business interest in processing your information. For example, we may process your information to send you marketing communications, relevant content, products or events invitations, or to communicate with you about changes to our Services, and to provide, secure, or improve our Services. Where the ePrivacy Directive, the UK Privacy and Electronic Communications Regulations (PECR), or other applicable law requires consent for direct electronic marketing, we send you marketing email only with your prior opt-in consent (or, where permitted, on the basis of the “soft opt-in” for existing customers marketing similar services), and you may withdraw that consent at any time.

How these bases map to our purposes. We rely on performance of our contract with you to create and administer your account and to deliver the Services; on your consent for non-essential cookies and similar technologies, for direct electronic marketing where consent is required, and for any processing of special-category data; on our legitimate interests to secure the Services, prevent fraud and abuse, analyze and improve the Services, operate our web-indexing and retrieval functions, and deliver advertising on our free tier (each subject to a balancing test we have documented and will make available on request); and on compliance with a legal obligation to retain records and to respond to lawful requests.

You should be aware that information that you provide to us may be transferred out of the country in which you reside to servers in a country that may not guarantee the same level of protection as the one in which you reside. We carry out such transfers only where a valid transfer mechanism under Chapter V of the GDPR or UK GDPR is in place, as described below, rather than in reliance on your consent. We will take all steps reasonably necessary to ensure that your information is treated securely in accordance with this Privacy Policy, and no transfer of your information will take place to a third party unless an appropriate transfer mechanism under Chapter V of the GDPR or UK GDPR is in place. We rely on our certification under the EU-U.S. Data Privacy Framework and the UK Extension, described below, and, where the Framework does not apply to a given transfer, on the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, supplemented by a transfer impact assessment and any additional safeguards it identifies. You may request a copy of the Standard Contractual Clauses applicable to transfers of your information, including the categories of information transferred, by emailing [email protected].

If you are a User in the European Union or United Kingdom and have a concern about our processing of personal information that we are not able to resolve, you have the right to lodge a complaint with the data privacy authority where you reside. For contact details of your local Data Protection Authority, please see: http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm.

Information for U.S. Residents

Various U.S. states (e.g., as of the date of this Policy, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) currently allow or will soon allow consumers to opt out of sharing of their data. As such, residents of those states may request that we:

• Disclose the sources, categories, and specific pieces of information we have collected about you, how that information is used, and with whom we share it
• Disclose the purpose for collecting your information
• Disclose the categories of third parties with whom we share your information
• Delete/rectify/restrict personally identifiable information, subject to certain exceptions (right of rectification not applicable to Utah residents)
• To disclose, for any “sale” or “sharing” of personal information, the categories of personal information involved and the categories of third parties to which it was sold or shared
• To opt out of the sale or sharing of your personal information and of targeted advertising, and, where applicable state law provides, to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects (profiling opt-out not applicable to Utah residents)
• Provide a copy of your information in a readily usable format that allows the information to be transmitted to others
• Residents in these states may not be discriminated against for exercising any of the rights described above. Certain states provide additional rights. For example, Oregon residents may request a list of the specific third parties (not merely the categories of third parties) to which we have disclosed personal information, and Minnesota residents have the right to question the result of profiling, to be informed of the reason for that result, and to review the personal data used in the profiling.

Residents of these states may exercise these rights by emailing us at [email protected]. Note that if a state law has been ratified but not yet effective, we reserve the right to deny your request as it pertains to that state.

Response Timing and Right to Appeal. We will confirm receipt of your request within ten (10) business days and respond substantively within forty-five (45) days. Where reasonably necessary, we may extend that period once by an additional forty-five (45) days, and will notify you of the extension and the reason for it. If we decline to act on your request, we will tell you why. You may appeal that decision by emailing [email protected] with the subject line “Appeal of Privacy Request.” We will respond to your appeal in writing within forty-five (45) days, setting out the reasons for our decision. If we deny your appeal, we will provide you with a method to submit a complaint to your state Attorney General.

Sensitive Personal Information. We do not seek to collect sensitive personal information, and we do not use or disclose it for purposes other than those permitted by Cal. Civ. Code § 1798.121 and the corresponding provisions of other state privacy laws. We do not sell or share sensitive personal information. We recognize, however, that content you voluntarily submit in a prompt or an uploaded file may incidentally reveal sensitive personal information — for example, government identification numbers, precise geolocation, racial or ethnic origin, religious beliefs, health information, sexual orientation, or biometric data. We do not use such content to infer characteristics about you. For EU and UK data subjects, to the extent special-category data (as defined in Article 9 of the GDPR and UK GDPR) is nonetheless contained in your prompts or uploaded files and processed by us, we rely on your explicit consent under Article 9(2)(a) or another applicable condition, and we apply data minimization. Any geolocation we collect is approximate (for example, derived from IP address) and is not precise geolocation within the meaning of Cal. Civ. Code § 1798.140(ae); we do not collect precise geolocation. If you are a California resident, you have the right to limit our use and disclosure of your sensitive personal information to those purposes permitted by law; to exercise that right, or to request deletion of sensitive personal information you have submitted, email [email protected].

We do not knowingly process the personal information of children, as described under “Children’s Privacy” below.

In general, we, including our vendors and service providers, collect the following California regulated categories of personal information (PI) from you: We retain each category of personal information for the period described in “Data Retention” below, determined by the criteria set out there.

Sharing Your Information for a Business Purpose

In the preceding twelve (12) months, we have disclosed the following categories of Personal Information for a business purpose with our Affiliates and Service Providers:

• Category A: Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address
• Category F: Internet or other similar network activity
• Category G: Geolocation data
• Category H: Sensory data
• Category K: Inferences drawn from other PI

Shine Your Light Law. Under California law, California residents are entitled, once per calendar year, to ask us for a notice identifying the categories of personal customer information that we share with certain third parties for the third parties' direct marketing purposes, and providing contact information (i.e., names and addresses) for these third parties. If you are a California resident and would like a copy of this notice, please submit a written request to us via email at [email protected]. You must put the statement "Your California Privacy Rights" in your request and include your name, street address, city, state, and ZIP code. We are not responsible for notices that are not labeled or sent properly or do not have complete information.

Opt-Out of Sale or Sharing in U.S. As a registered data broker and as part of interest-based advertising, we sell and/or share personal information as defined under CCPA, Colorado Privacy Act, Connecticut Data Privacy Act, Texas Data Privacy and Security Act, and other U.S. state consumer privacy laws. You may opt out at any time via our “Do Not Sell or Share My Personal Information” by transmitting a GPC signal from your browser; by emailing [email protected]; or via California's DROP portal at privacy.ca.gov/data-brokers.

Right to opt out of contact-data enrichment. You may specifically opt out of our use of your personal information for third-party contact-data enrichment (including matching your personal email to your professional email or employer) via the same channels. When you exercise deletion rights, we will forward the deletion request to our enrichment providers and remove your enriched profile from those systems within the statutory response window.

Global Privacy Control Signals. We honor Global Privacy Control signals. Where we rely on de-identified information, we maintain technical and organizational safeguards against re-identification, do not attempt to re-identify it except to test our de-identification methods, and contractually require recipients not to re-identify it, consistent with Cal. Civ. Code § 1798.140(m). Neither Enterprise Customers nor Paid Subscribers are subject to advertising-related sale or sharing.

Third-Party Advertising, Sale and Sharing. Third-party advertising partners may nonetheless collect information about your activity across websites through the advertising technologies described in “How We Share the Information We Collect.” That activity may constitute “sharing” for cross-context behavioral advertising, or a “sale,” under California and other state privacy laws, and you may opt out of it at any time. You may do so by using the “Do Not Sell or Share My Personal Information” on our website, by adjusting your preferences in our cookie settings tool, or by emailing [email protected]. We treat aGlobal Privacy Control (GPC) signal as a valid request to opt out of sale and sharing for the browser and device from which it is sent. Neither Enterprise Customers nor Paid Subscribers are subject to advertising-related sharing.

Do Not Track. Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals. To find out more about "Do Not Track," please visit www.allaboutdnt.com. This is distinct from any response to opt-out signals such as Global Privacy Control (aka GPC).

California Delete Act — DROP Compliance

Under California Civil Code §§1798.99.80–1798.99.89 (the Delete Act), we access the CPPA's Delete Request and Opt-Out Platform (DROP) at least once every 45 days, retrieve the consumer deletion lists that match the identifiers held in our systems, and report the status of each request in DROP within 45 days of retrieving it, using the state-specified transaction identifiers and hashing algorithm. For each matched request, we delete all personal information related to that consumer, including inferences, and we direct our service providers and contractors to delete that information as well, unless a statutory exemption applies. This obligation is broader than a deletion request under the CCPA, which reaches only information we collected directly from you. We may deny a DROP request only where the consumer's identity cannot be verified, and we process any request we deny as a request to opt out of the sale and sharing of that consumer's personal information. We maintain a list of the deletion requests we receive so that personal information we later collect about a consumer who has requested deletion is deleted on each 45-day cycle, unless that consumer directs us otherwise. Beginning January 1, 2028, we will obtain an independent audit of our Delete Act compliance at least once every three years and will submit the audit report to CalPrivacy. Our California Privacy Disclosure page shows the consumer requests received over the previous calendar year.

Written Information Security Program

Pursuant to Texas Bus. & Com. Code Ch. 509.056, 9 V.S.A. § 2447, and ORS 646A.622, we maintain a comprehensive written information security program with administrative, technical, and physical safeguards including designation of an information-security lead, documented risk assessments, access controls, encryption in transit and at rest, employee training, vendor due diligence, incident-response planning, and secure destruction of information no longer required. For more information, see our Trust Center.

General Security

We work hard to protect your information.

We make reasonable efforts to protect your information by using physical and electronic safeguards designed to improve the security of the information we maintain. However, as our Services are hosted electronically, we can make no guarantees as to the security or privacy of your information.

As part of our security program, we use vendors with recognized world-class security such as AWS, Stripe, and Google. AWS security documentation is here. Stripe’s security practices are here. Google’s security is described here. We also limit the type and amount of personal information we collect in the first place. All our communications and websites are encrypted (using transport layer security, or TLS, a leading encryption protocol).

Children’s Privacy

Our Services are not directed to children, and no part of our Services is intended for use by anyone under 18 years of age. We do not knowingly collect, maintain, or use personal information from children under 18. We do not knowingly collect personal information from children under 13, and we do not knowingly sell or share for cross-context behavioral advertising the personal information of any consumer we know to be under 16 years of age. If we learn that we have collected personal information from a child under 13, we will delete it promptly. For users in the European Union and United Kingdom, where we rely on consent to offer an information-society service to a child, we obtain consent from a parent or guardian for children below the applicable digital-consent age (between 13 and 16, as set by the relevant Member State, and 13 in the United Kingdom). Where a user of our Services is under 18 and resides in a jurisdiction conferring a right to have content they have posted removed, we will honor that request as described under “General Regional Rights” above. If you learn that a child you are a guardian or parent of has provided us with personal information in violation of this Privacy Policy, then you may alert us at [email protected].

Data Retention

We retain your information for as long as we need it for the purposes described in this Privacy Policy, and no longer. In practice, we retain (i) account and profile information for as long as your account remains active, (ii) User Content and usage information for the period necessary to deliver and secure the Services, (iii) information subject to a valid deletion request only until we have processed that request, and (iv) information we are required or permitted by law to keep, for the period of that requirement.

Where we cannot state a fixed period in advance, we determine the retention period by reference to the following criteria: retention periods prescribed by applicable statute or regulation; whether litigation, an investigation, or a regulatory inquiry is pending or reasonably anticipated and requires preservation; the limitations period applicable to potential legal claims; whether the information is needed to detect or prevent fraud, abuse, or security incidents; and whether the information remains necessary to provide the Services to you. When none of these criteria continues to apply, we delete the information, or de-identify or aggregate it so that it can no longer reasonably be used to identify you.

Where the terms of an Enterprise Customer’s Master Services Agreement or a Paid Subscriber’s subscription terms specify different retention periods or Zero Data Retention policy configurations, those terms control.

Affirmative Commitment to Comply with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF

SuSea, Inc. (you.com) complies with the EU-U.S. Data Privacy Framework (the “EU-U.S. DPF”) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (the “Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. SuSea, Inc. (“You.com”) has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (the “EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. SuSea, Inc. (“You.com”) has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (the “Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Our Liability for Onward Transfers

Under the DPF’s Accountability for Onward Transfer Principle (the “DPF Principle”), as the controller of your data, we comply with the DPF’s Notice and Choice Principles. Furthermore, under the Recourse, Enforcement and Liability Principles of the DPF, we are responsible for the processing of personal information, including transfers to third parties acting as agents on our behalf. To that end, we remain liable under the DPF Principles, if our third party agent processes your personal information in a manner that is inconsistent with the DPF Principles, unless we prove that we are not responsible for the event giving rise to the damage.

Contact Information, Inquiries or Complaints

You can contact us with your questions, comments, or concerns at [email protected]. If you have a disability and require this Privacy Policy in an alternative accessible format, email [email protected] with the subject line “Accessible Format Request” and we will provide it.

Specifically in compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, SuSea, Inc. (“You.com”) commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact SuSea, Inc. (you.com) at:

[email protected] or write to us at:

SuSea, Inc.
Attention: Data Privacy Officer
417 Montgomery Street, Suite 800
San Francisco, CA 94104

Alternative Dispute Resolution

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, SuSea, Inc. (“You.com”) commits to refer all unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States, but with facilities in the European Union, the United Kingdom, and/or Switzerland. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Note also that SuSea, Inc. (“You.com”) is obligated to arbitrate claims and follow the terms as set forth in Annex I of the DPF Principles, provided that an individual has invoked binding arbitration by delivering notice to our organization and following the procedures and subject to conditions set forth in Annex I of Principles. For more information, please visit: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction

Changes to this Privacy Policy

We will let you know about any material changes to this Privacy Policy.

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or share personal information previously collected from you through the Services, we will notify you through the Services, by email, or other communication (such as posting on this website).