California Privacy Notice

This California Privacy Notice applies to personal information we collect from California residents in connection with NoteHelix Cloud and our public website. It supplements our Privacy Policy and is intended to meet requirements of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, “CCPA”).

Terms defined in the CCPA have the meanings given there. “Personal information” does not include publicly available information or de-identified / aggregated information as those concepts are defined by law.

1. Categories of personal information we collect

In the preceding twelve (12) months, depending on how you interact with us, we may have collected the following categories of personal information:

• Identifiers — such as name, email address, account ID, IP address, and online identifiers
• Customer records information — such as billing contact details and subscription records
• Commercial information — such as plan tier, purchase history, and transaction status
• Internet or electronic network activity — such as browsing and usage data on our site or app, diagnostic logs, and interaction with modules
• Geolocation data — coarse location derived from IP address
• Professional information — if you choose to provide workplace or role details
• Inferences — limited inferences used to secure the service or understand product usage (not for advertising profiles)
• Sensitive personal information — account login credentials; content you choose to store in the service may include information you consider sensitive. We do not use sensitive personal information for purposes that require a CCPA “limit the use” right beyond what is necessary to provide the service you request

We do not intentionally collect biometric identifiers, government ID numbers, or precise geolocation for marketing.

2. Sources of personal information

• Directly from you (account signup, profile, support emails)
• Automatically from your devices when you use the Cloud Service
• From other users who invite you to workspaces or share content with you
• From service providers such as Stripe for payment-related metadata

3. Business or commercial purposes for collection and use

We use personal information for purposes including:

• Providing and maintaining the Cloud Service
• Creating and securing accounts and workspaces
• Processing transactions and subscriptions
• Customer support and service communications
• Security, fraud prevention, and debugging
• Analytics to improve product performance and reliability
• Compliance with law and enforcement of our terms

4. Disclosure of personal information

We may disclose personal information to service providers and contractors that help us operate the Cloud Service (hosting, email delivery, payments, monitoring), to other users according to workspace permissions, to professional advisors, to authorities when required, and to parties in a corporate transaction, as described in our Privacy Policy.

In the preceding twelve (12) months, we have disclosed identifiers, commercial information, and internet activity information to service providers for the business purposes listed above.

5. We do not sell or share personal information

NoteHelix does not sell personal information as “sell” is defined by the CCPA. NoteHelix also does not share personal information for cross-context behavioral advertising. Because we do not sell or share personal information in these ways, we do not offer a “Do Not Sell or Share My Personal Information” opt-out link at this time. If that practice changes, we will update this notice and provide required opt-out mechanisms.

6. Your California privacy rights

California residents may request to:

• Know / access the categories and specific pieces of personal information we have collected about you
• Delete personal information, subject to legal exceptions
• Correct inaccurate personal information
• Opt out of sale/sharing — not applicable while we do not sell or share as defined by CCPA
• Limit use of sensitive personal information — we use sensitive personal information only as reasonably necessary to provide the Cloud Service and for security/compliance
• Non-discrimination — we will not discriminate against you for exercising CCPA rights

7. How to submit a request

Submit California privacy requests by email only to contact@notehelix.com. Please include “California Privacy Request” in the subject line and tell us which right you want to exercise. We do not accept these requests by telephone, and we do not publish a postal mailing address for privacy requests at this time.

We will verify your request using information associated with your account (such as confirming control of the email address on file). You may designate an authorized agent to make a request on your behalf; we may require proof of the agent’s authority and verification of your identity.

We will respond within the timeframes required by California law. If we deny a request in whole or in part, we will explain the reasons as required.

8. Retention

We retain personal information for as long as reasonably necessary to provide the Cloud Service, meet legal obligations, resolve disputes, and enforce agreements. Retention periods vary by category; account and workspace data are generally kept while your account is active and for a limited period afterward unless a verified deletion request applies.

9. Minors

We do not sell the personal information of consumers we know are under 16. The Cloud Service is not directed to children under 16.

10. Shine the Light

California’s “Shine the Light” law permits certain residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing.

11. Contact

Questions about this notice or California privacy rights: contact@notehelix.com (email only).

12. Changes

We may update this notice from time to time. The “Last updated” date will change when we do.