Privacy Notice

Effective May 26, 2026

This Privacy Notice explains how Acaysia, Inc. ("Acaysia," "we," or "us") collects, uses, and shares personal information through acaysia.com (the "Site"). It applies to personal information of individuals located anywhere in the world, including the United States, the European Economic Area, the United Kingdom, and Switzerland. By using the Site you acknowledge this Notice.

If you have questions about this Notice or want to exercise the rights described below, email us at founders@acaysia.com.

What this Notice covers

This Notice covers personal information we collect from visitors to acaysia.com, primarily through the contact form and through standard web logs maintained by our hosting and security provider. It does not cover personal information we receive from customers in the course of a commercial engagement, which is handled under separate contractual terms.

What we collect

Information you give us. When you submit the contact form or otherwise correspond with us, you give us your name, your email address, the company you work for, and the contents of your message.

Information we collect automatically. When you visit the Site, our hosting and security provider records standard web log information: your IP address, browser type and version, operating system, the page that referred you, the pages you viewed, the date and time of your visit, and an approximate geographic region derived from your IP address.

Cookies. The Site uses only strictly necessary cookies set by our content delivery network for security, bot management, and load balancing. We don't use cookies for advertising, profiling, cross-site tracking, or behavioral targeting. We don't deploy third-party analytics, ad trackers, social media pixels, fingerprinting, or session-replay tools. Because we don't engage in any of that, you won't see a cookie banner on this Site.

What we don't collect. We don't knowingly collect sensitive personal information (the categories defined by Article 9 of the GDPR or by California's CPRA, for example government identifiers, precise location, health data, religious beliefs, sexual orientation, or biometrics). Please don't send us any of that through the contact form.

How we use information

We use the information we collect for a small number of straightforward purposes:

• To reply to your inquiry and provide information you've asked for.
• To operate, maintain, and secure the Site, and to detect and prevent fraud or abuse.
• To follow up with you about your inquiry and discuss related business matters where appropriate.
• To meet our legal obligations, respond to lawful requests, enforce our terms, and defend our legal rights.
• To improve the Site and our products.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising as those terms are defined under California law. We do not make automated decisions about you that produce legal or similarly significant effects.

Legal bases (EEA, UK, and Switzerland)

If you're in the EEA, the UK, or Switzerland, we process your personal information on one of these legal bases under Article 6 of the GDPR (and the equivalent provisions of the UK and Swiss laws):

• Consent. When you submit the contact form, you consent to our processing of what you've submitted so we can respond. You can withdraw consent at any time.
• Legitimate interests. For security, fraud prevention, internal record-keeping, and following up on your inquiry, where those interests are not overridden by your rights.
• Legal obligation. Where the law requires us to retain, disclose, or otherwise process information.
• Pre-contractual steps. Where you're inquiring about a potential commercial relationship, processing what you've submitted may be necessary to take steps at your request.

How we share information

We share information sparingly.

Service providers. We use a small number of vendors to operate the Site and respond to inquiries. They process information on our behalf under contractual confidentiality and data protection obligations. They are:

• Cloudflare for hosting, content delivery, edge storage, and security. Cloudflare is bound by a data processing addendum that incorporates the European Commission's Standard Contractual Clauses for international transfers.
• Google for outbound email through the Gmail API when we reply to you, and for the typefaces served by Google Fonts (which may receive your IP address and basic request metadata).

If we add new providers, we'll update this Notice.

Legal disclosures. We may disclose information when we believe in good faith that disclosure is required or permitted by law, for example in response to a subpoena, court order, or other legal process, to enforce our terms, to protect Acaysia or others from harm, or to investigate fraud or security incidents.

Business transactions. If we go through a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, personal information may be transferred or disclosed as part of that transaction with appropriate confidentiality protections and in line with applicable law.

With your consent. We share information with other parties when you direct us to or when you consent to it.

International data transfers

We're based in the United States, and we store and process information here and in the other places our service providers operate. Other countries' data protection laws may differ from yours and may not provide the same level of protection.

If we transfer personal information from the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, typically the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another mechanism permitted under Chapter V of the GDPR. You can ask us for a copy of the safeguards we rely on.

How long we keep information

We keep personal information for as long as we reasonably need it for the purpose it was collected, to follow up on your inquiry, to meet legal and record-keeping obligations, and to resolve disputes. Contact form submissions are retained for the duration of any active discussion and for a reasonable period after, consistent with our internal record-keeping. You can ask us to delete information earlier (see the next section).

Security

We use reasonable administrative, technical, and physical safeguards to protect personal information. No system is perfectly secure, and we don't claim otherwise.

Your rights

Depending on where you live, you have rights with respect to your personal information. To exercise any of them, email founders@acaysia.com. We may need to verify who you are before we respond. We won't retaliate against you for exercising your rights, and you can use an authorized agent.

If you're in the EEA, the UK, or Switzerland

You have the right to:

• Access the personal information we hold about you.
• Have inaccurate information corrected.
• Have information deleted (the "right to be forgotten").
• Restrict or object to certain processing.
• Receive a portable copy of information you gave us, in a structured, commonly used, machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of processing before you withdrew.
• Lodge a complaint with your local data protection authority. For the EEA, see edpb.europa.eu. For the UK, see ico.org.uk.

If you're a California resident

You have rights under the CCPA, as amended by the CPRA:

• Know what categories and specific pieces of personal information we collect, use, disclose, or share about you, the sources, the purposes, and the categories of recipients.
• Delete personal information.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising. We don't do either.
• Limit the use and disclosure of sensitive personal information. We don't collect sensitive information for purposes that would trigger this right.
• Not be retaliated against for exercising these rights.

In the past twelve months we have collected these CCPA categories: identifiers (name, email), commercial information (in limited form, where you mention it in a contact-form message), internet activity (IP address, browser metadata), and approximate geolocation (derived from IP address). We have not sold or shared personal information for cross-context behavioral advertising, and we don't intend to. We don't have actual knowledge that we sell or share personal information of consumers under sixteen (16).

If you live in another US state with a comprehensive privacy law

This includes Virginia, Colorado, Connecticut, Utah, Iowa, Texas, Oregon, Montana, Tennessee, Delaware, New Hampshire, New Jersey, and others. You generally have similar rights to know, correct, delete, port, and opt out of certain processing. We honor verifiable requests under your state's law.

Appeals

If we decline your request and your state's law gives you a right to appeal (Virginia, Colorado, Connecticut, and certain other states do), email us at founders@acaysia.com with the subject line "Privacy Appeal." We'll respond within the timeframe your state requires.

California Shine the Light

California Civil Code Section 1798.83 lets California residents request information about disclosures of personal information for third parties' direct marketing. We don't disclose personal information to third parties for their direct marketing.

Do Not Track

Browsers can transmit "Do Not Track" signals. There's no industry-standard interpretation of these signals and we don't respond to them, but we also don't engage in cross-site tracking of users in any event.

Children

The Site isn't directed to children under sixteen (16) and we don't knowingly collect information from them. If you think we have, contact us and we'll delete it.

Third-party links

The Site links to other sites. This Notice doesn't cover them, those sites have their own privacy practices.

Updates

We update this Notice from time to time. When we do, we'll change the "Effective" date at the top. If a change is material, we'll provide additional notice, for example by posting a prominent notice on the Site. Your continued use of the Site after the effective date of a revised Notice indicates you accept it.

Contact us

We have not appointed a representative under Article 27 of the GDPR. EEA, UK, and Swiss residents can reach us directly using the contact details above.