CCPA Addendum
1. Scope
This California Consumer Privacy Act Addendum ("CCPA Addendum") supplements our Privacy Policy and applies to personal information of California residents as defined under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA", Cal. Civ. Code § 1798.100 et seq.).
This addendum applies to California residents who use the lynox.ai website or subscribe to lynox Managed Hosting services.
2. Role definitions
For the purposes of the CCPA:
- The Customer (Managed Hosting subscriber) is the "Business" that determines the purposes and means of processing personal information through their lynox instance.
- lynox AI (Brandfusion Burlet) acts as a "Service Provider" that processes personal information on behalf of the Business pursuant to a written contract.
As a Service Provider, lynox AI processes personal information solely for the business purposes specified in the Managed Hosting agreement and does not sell, share, or use personal information for purposes other than those specified.
3. Categories of personal information
The following categories of personal information (as defined in Cal. Civ. Code § 1798.140(v)) may be collected or processed in connection with our services:
| CCPA category | Examples | Collected | Source |
|---|---|---|---|
| A. Identifiers | Name, email address, account name | Yes | Directly from consumer (signup) |
| B. Personal information (Cal. Civ. Code § 1798.80(e)) | Name, address (billing), payment information (via Stripe) | Yes | Directly from consumer (checkout) |
| D. Commercial information | Subscription records, purchase history, usage data (aggregate token counts) | Yes | Generated from service use |
| F. Internet or electronic network activity | Page views, referrer, browser type (via Plausible, anonymous) | Yes | Automatically collected (anonymized) |
| G. Geolocation data | Country-level only (derived from IP, not stored) | Yes (coarse) | Automatically collected (not stored) |
| K. Professional or employment-related information | Company name (if provided during signup) | Yes (optional) | Directly from consumer |
Categories C (protected characteristics), E (biometric), H (sensory data), I (education), J (inferences for profiling), and L (sensitive personal information) are not collected by lynox AI.
4. No sale of personal information
lynox AI does not sell personal information as defined under CCPA § 1798.140(ad). We have not sold personal information in the preceding 12 months and have no plans to do so.
5. No sharing for cross-context behavioral advertising
lynox AI does not share personal information for cross-context behavioral advertising as defined under CCPA § 1798.140(ah). Ad measurement on our website (when consented to) is limited to first-party conversion tracking and does not involve sharing personal information with ad networks for behavioral targeting.
6. Consumer rights
California residents have the following rights under the CCPA:
6.1 Right to know (Cal. Civ. Code § 1798.100)
You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share it.
6.2 Right to delete (Cal. Civ. Code § 1798.105)
You have the right to request deletion of your personal information. Upon receiving a verified request, we will delete your personal information from our records and direct our service providers to do the same, unless an exception under § 1798.105(d) applies.
6.3 Right to correct (Cal. Civ. Code § 1798.106)
You have the right to request correction of inaccurate personal information that we maintain about you. We will use commercially reasonable efforts to correct the information as directed.
6.4 Right to opt-out of sale (Cal. Civ. Code § 1798.120)
Not applicable. lynox AI does not sell personal information.
6.5 Right to limit use of sensitive personal information (Cal. Civ. Code § 1798.121)
lynox AI does not collect or process sensitive personal information as defined under the CCPA beyond what is necessary to provide the requested services.
7. Verification of requests
To protect your privacy, we must verify your identity before responding to a request to know, delete, or correct personal information. Verification may include:
- Confirming your identity via the email address associated with your account
- Requesting additional information to match against our records
- For requests submitted by an authorized agent: written permission from the consumer and verification of the agent's identity
We will not fulfill a request if we cannot verify your identity or your authority to make the request.
8. Non-discrimination
lynox AI will not discriminate against you for exercising any of your CCPA rights. We will not:
- Deny you goods or services
- Charge you different prices or rates
- Provide you a different level or quality of service
- Suggest that you will receive a different price or level of service
9. Response timeline
We will acknowledge receipt of your request within 10 business days and provide a substantive response within 45 calendar days of receiving the request. If we need additional time, we will notify you of the extension and the reason. The maximum total response time is 90 calendar days (45 + 45-day extension).
10. Service Provider obligations
As a Service Provider under the CCPA, lynox AI:
- Processes personal information only for the specific business purposes set forth in the service agreement
- Does not sell or share personal information received from or on behalf of the Business
- Does not retain, use, or disclose personal information for any purpose other than performing the services, including for a commercial purpose other than providing the services
- Does not combine personal information received from the Business with personal information received from other sources, except as expressly permitted by the CCPA
- Notifies the Business if it determines that it can no longer meet its CCPA obligations
- Allows the Business to take reasonable and appropriate steps to ensure compliance
11. Metrics disclosure
Pursuant to Cal. Civ. Code § 1798.185(a)(15)(B), businesses that handle the personal information of 10 million or more consumers are required to disclose metrics regarding consumer requests. As of the last updated date of this addendum, lynox AI has not met this threshold. Should this change, we will publish annual metrics including the number of requests received, complied with, and denied, along with median response times.
12. Contact
To submit a CCPA request or for questions about this addendum:
- Email: [email protected]
- Subject line: "CCPA Request"
You may also designate an authorized agent to submit a request on your behalf. The agent must provide written proof of authorization and we may require you to verify your identity directly.