Privacy Notice

Effective August 21, 2026

This Privacy Notice explains how Acaysia, Inc. ("Acaysia," "we," or "us") collects, uses, and shares personal information through acaysia.com (the "Site"). It applies to personal information of individuals located anywhere in the world, including the United States, Canada, the European Economic Area, the United Kingdom, and Switzerland. By using the Site you acknowledge this Notice, and where the law requires consent for the collection, use, or disclosure described here (as Canada's PIPEDA does), you provide it through the choices described in this Notice.

If you have questions about this Notice or want to exercise the rights described below, email us at founders@acaysia.com.

What this Notice covers

This Notice covers personal information we collect from visitors to acaysia.com, primarily through the contact form, through our own first-party page-view analytics, and through standard web logs maintained by our hosting provider. It does not cover personal information we receive from customers in the course of a commercial engagement, which is handled under separate contractual terms.

What we collect

Information you give us. When you submit the contact form or otherwise correspond with us, you give us your name, your email address, the company you work for, and the contents of your message. Contact form submissions are stored together with the IP address and browser identification (user agent) they were sent from, for security and abuse prevention.

Information we collect automatically. We run our own first-party page-view analytics. When you visit the Site, it records the page you viewed, the page that referred you, your browser language, a bucketed viewport-size label (never raw screen dimensions), and any campaign (UTM) tags in the link you followed. It sets no cookie and stores no identifier in your browser. On our servers, your IP address is used to derive an approximate country and a visitor hash whose salt rotates daily — so visits can't be linked across days — and the raw IP address is not kept in our analytics; it's retained only transiently for rate limiting and abuse prevention. If your browser sends a Do Not Track signal, the analytics beacon doesn't run at all. Separately, our hosting provider maintains standard web logs of requests to the Site.

Cookies. The Site sets no cookies. A few functional flags are kept in your browser's own session storage (for example, that you've unlocked gated resources during a visit); they never leave your browser and are cleared when the tab closes. We don't use cookies for advertising, profiling, cross-site tracking, or behavioral targeting. We don't deploy third-party analytics, ad trackers, social media pixels, fingerprinting, or session-replay tools. Because we don't engage in any of that, you won't see a cookie banner on this Site.

What we don't collect. We don't knowingly collect sensitive personal information (the categories defined by Article 9 of the GDPR or by California's CPRA, for example government identifiers, precise location, health data, religious beliefs, sexual orientation, or biometrics). Please don't send us any of that through the contact form.

How we use information

We use the information we collect for a small number of straightforward purposes:

• To reply to your inquiry and provide information you've asked for.
• To operate, maintain, and secure the Site, and to detect and prevent fraud or abuse.
• To follow up with you about your inquiry and discuss related business matters where appropriate.
• To meet our legal obligations, respond to lawful requests, enforce our terms, and defend our legal rights.
• To improve the Site and our products.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising as those terms are defined under California law. We do not make automated decisions about you that produce legal or similarly significant effects.

Legal bases (EEA, UK, and Switzerland)

If you're in the EEA, the UK, or Switzerland, we process your personal information on one of these legal bases under Article 6 of the GDPR (and the equivalent provisions of the UK and Swiss laws):

• Consent. When you submit the contact form, you consent to our processing of what you've submitted so we can respond. You can withdraw consent at any time.
• Legitimate interests. For security, fraud prevention, internal record-keeping, and following up on your inquiry, where those interests are not overridden by your rights.
• Legal obligation. Where the law requires us to retain, disclose, or otherwise process information.
• Pre-contractual steps. Where you're inquiring about a potential commercial relationship, processing what you've submitted may be necessary to take steps at your request.

How we share information

We share information sparingly.

Service providers. We use a small number of vendors to operate the Site and respond to inquiries. They process information on our behalf under contractual confidentiality and data protection obligations. They are:

• Amazon Web Services (AWS) for hosting, content delivery, storage, and email delivery (Amazon S3, CloudFront, Lambda, DynamoDB, and SES). AWS is bound by a data processing addendum that incorporates the European Commission's Standard Contractual Clauses for international transfers.
• Google (Google Workspace), which hosts our company mailbox, and therefore processes email you exchange with us. The Site's typefaces are self-hosted; no font provider receives your requests.

If we add new providers, we'll update this Notice.

Legal disclosures. We may disclose information when we believe in good faith that disclosure is required or permitted by law, for example in response to a subpoena, court order, or other legal process, to enforce our terms, to protect Acaysia or others from harm, or to investigate fraud or security incidents.

Business transactions. If we go through a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, personal information may be transferred or disclosed as part of that transaction with appropriate confidentiality protections and in line with applicable law.

With your consent. We share information with other parties when you direct us to or when you consent to it.

International data transfers

We're based in the United States, and we store and process information here and in the other places our service providers operate. Other countries' data protection laws may differ from yours and may not provide the same level of protection.

If we transfer personal information from the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, typically the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another mechanism permitted under Chapter V of the GDPR. You can ask us for a copy of the safeguards we rely on.

If you're in Canada, your personal information is transferred outside your province and outside Canada: it is stored and processed on our systems in the United States, where it is subject to United States law and may be accessible to US courts, law enforcement, and national security authorities. We apply the protections described in this Notice wherever the information is processed, and we require comparable protection from the service providers that process it for us.

How long we keep information

We keep personal information for as long as we reasonably need it for the purpose it was collected, to follow up on your inquiry, to meet legal and record-keeping obligations, and to resolve disputes. Contact form submissions are retained for the duration of any active discussion and for a reasonable period after, consistent with our internal record-keeping. You can ask us to delete information earlier (see the next section).

Security

We use reasonable administrative, technical, and physical safeguards to protect personal information. No system is perfectly secure, and we don't claim otherwise.

If a breach of our security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you and the appropriate regulators — including the Office of the Privacy Commissioner of Canada where required — as applicable law requires, and we keep records of any such breach.

Your rights

Depending on where you live, you have rights with respect to your personal information. To exercise any of them, email founders@acaysia.com. We may need to verify who you are before we respond. We won't retaliate against you for exercising your rights, and you can use an authorized agent.

If you're in the EEA, the UK, or Switzerland

You have the right to:

• Access the personal information we hold about you.
• Have inaccurate information corrected.
• Have information deleted (the "right to be forgotten").
• Restrict or object to certain processing.
• Receive a portable copy of information you gave us, in a structured, commonly used, machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of processing before you withdrew.
• Lodge a complaint with your local data protection authority. For the EEA, see edpb.europa.eu. For the UK, see ico.org.uk.

If you're a California resident

You have rights under the CCPA, as amended by the CPRA:

• Know what categories and specific pieces of personal information we collect, use, disclose, or share about you, the sources, the purposes, and the categories of recipients.
• Delete personal information.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising. We don't do either.
• Limit the use and disclosure of sensitive personal information. We don't collect sensitive information for purposes that would trigger this right.
• Not be retaliated against for exercising these rights.

In the past twelve months we have collected these CCPA categories: identifiers (name, email), commercial information (in limited form, where you mention it in a contact-form message), internet activity (IP address, browser metadata), and approximate geolocation (derived from IP address). We have not sold or shared personal information for cross-context behavioral advertising, and we don't intend to. We don't have actual knowledge that we sell or share personal information of consumers under sixteen (16).

If you live in another US state with a comprehensive privacy law

This includes Virginia, Colorado, Connecticut, Utah, Iowa, Texas, Oregon, Montana, Tennessee, Delaware, New Hampshire, New Jersey, and others. You generally have similar rights to know, correct, delete, port, and opt out of certain processing. We honor verifiable requests under your state's law.

If you're in Canada

We handle personal information of individuals in Canada in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws, including Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, and the Personal Information Protection Acts of Alberta and British Columbia. We collect, use, and disclose your personal information with your consent or as those laws otherwise permit, and only for the purposes described in this Notice. You have the right to:

• Access the personal information we hold about you and be told how it has been used and to whom it has been disclosed.
• Have inaccurate or incomplete information corrected.
• Withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice.
• Challenge our compliance with these laws by contacting our Privacy Officer (see "Contact us" below).
• Complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, where a provincial law applies, your provincial regulator — in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).

Appeals

If we decline your request and your state's law gives you a right to appeal (Virginia, Colorado, Connecticut, and certain other states do), email us at founders@acaysia.com with the subject line "Privacy Appeal." We'll respond within the timeframe your state requires.

California Shine the Light

California Civil Code Section 1798.83 lets California residents request information about disclosures of personal information for third parties' direct marketing. We don't disclose personal information to third parties for their direct marketing.

Do Not Track

Browsers can transmit "Do Not Track" signals. We honor them: if your browser sends one, our first-party analytics beacon doesn't run at all. We don't engage in cross-site tracking of users in any event.

Children

The Site isn't directed to children under sixteen (16) and we don't knowingly collect information from them. If you think we have, contact us and we'll delete it.

Third-party links

The Site links to other sites. This Notice doesn't cover them, those sites have their own privacy practices.

Updates

We update this Notice from time to time. When we do, we'll change the "Effective" date at the top. If a change is material, we'll provide additional notice, for example by posting a prominent notice on the Site. Your continued use of the Site after the effective date of a revised Notice indicates you accept it.

Contact us

Our Privacy Officer is the person responsible for the protection of personal information and is accountable for our compliance with the laws described in this Notice, including PIPEDA and Quebec's Law 25. Reach them at the address above.

We have not appointed a representative under Article 27 of the GDPR. EEA, UK, and Swiss residents can reach us directly using the contact details above.