California Privacy Notice

This notice supplements our global Privacy Policy and applies exclusively to California residents under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), Cal. Civ. Code §1798.100 et seq.

If you are not a California resident, the rights described in this notice do not apply to you, but equivalent rights under the EU-GDPR and Swiss nDSG are available — see our Global Privacy Policy §§9–10.

California residents have the following rights under CCPA/CPRA:

• Right to Know (§1798.100) — Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the third parties with whom we share it. We respond within 45 days (extendable by 45 days with notice).
• Right to Delete (§1798.105) — Request deletion of your personal information, subject to statutory exceptions (e.g. GoBD tax-retention obligations for financial records require retention for up to 10 years).
• Right to Correct (§1798.106) — Request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing (§1798.120) — COEUS does not sell personal information. You can still disable optional sub-processors via the toggle in your account settings under Profile → Privacy.
• Right to Limit Use of Sensitive Personal Information (§1798.121) — You may direct us to use and disclose sensitive personal information only as necessary to provide the services you requested.
• Right to Non-Discrimination (§1798.125) — We will not discriminate against you for exercising any of these rights (no price increases, no service degradation, no different quality of service).

Signed-in California residents can exercise each right from the options below. We will verify your identity before processing any request.

Operating COEUS requires the following essential sub-processors. These are unaffected by the "Do Not Sell or Share" toggle because they are strictly necessary to deliver the service you contracted for:

• Mistral AI — LLM inference and OCR processing. EU-hosted (Paris, France). Transfer mechanism: EU server location, no US transfer.
• Supabase — Database, authentication, storage, and edge functions. EU-hosted (Frankfurt, Germany). Transfer mechanism: EU server location, no US transfer.
• Stripe — Subscription billing and payment processing. US-based. Transfer mechanism: Standard Contractual Clauses (SCCs).
• Resend — Transactional email delivery (receipts, verification codes, DSAR responses). US-based. Transfer mechanism: Standard Contractual Clauses (SCCs).

Full details including retention periods, data categories, and transfer mechanisms are in our Data Processing Addendum (DPA).

The "Do Not Sell or Share" toggle in your account settings controls optional sub-processor categories (e.g. marketing email, cross-product analytics across the publisher's other products) that are not required to run COEUS. Disabling these does not affect core functionality.

We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

For privacy questions or to exercise your rights, see our Global Privacy Policy §17 (Contact) for the designated privacy contact and Data Protection Officer details.

Authorized-agent requests must be submitted via the Authorized-Agent Request form above — direct email submissions from agents will not be accepted.

California residents may also file complaints with the California Privacy Protection Agency (CPPA) or the California Attorney General's office.