California Privacy Rights

If you are a resident of the State of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) give you rights over the personal data that Fyxi collects about you. This page describes those rights and how to exercise them.

When you use Fyxi on behalf of a company (as owneror workspace member), the company's business data may be covered by CCPA as “personal data” only if it identifies you individually. Most receipt data of a business is not personal data in the CCPA sense.

In the last 12 months we have collected the following categories of personal data (per CCPA definitions):

• Identifiers: email, name, user ID, session IDs, truncated IP addresses.
• Commercial information: records of contracted services (plans, billing).
• Device and internet activity information: browser, operating system, pages visited inside the application, technical errors.
• Approximate geolocation information: only at state/country level, inferred from IP for fraud prevention.
• Professional or employment information: role within workspace (owner, admin, contributor, viewer, accountant).
• Limited financial information: Stripe customer identifier, card brand, last 4 digits (not the full number).
• Content uploaded by you: receipt images, notes, categories, business/personal tags.

We do not collect special categories such as race, ethnic origin, religion, sexual orientation, union information, biometric, genetic, or health data, nor information about criminal convictions.

• Directly from you (when you register, upload receipts, invite members, etc.).
• Automatically when you interact with the Service (usage logs, strictly necessary cookies).
• From identity providers if you use “Sign in with Google”.
• From Stripe when you pay a subscription (customer identifier, card status).

We use your information to: operate the Service, authenticate you, process payments, communicate with you about your account, prevent fraud, comply with legal obligations, and improve the product through aggregated and non-identifiable analytics. See full details in the Privacy Policy.

We share data with the sub-processors listed on the Sub-processors page, exclusively to provide you the Service. Each has its own DPA and uses the data only for the functions we entrust to them.

We do not sell your personal data. We do not share your data with third parties for targeted advertising (cross-context behavioral advertising).

Under CCPA and CPRA you have the following rights:

The fastest way is directly from the application:

• View and correct your data: Settings → Profile and Settings → Business.
• Export your data: Export section in the main menu.
• Delete your account and data: Settings → Business → Danger zone.

If you need something not available from the app, or want to make a formal CCPA/CPRA request, write to privacy@fyxi.ai with:

• The right you want to exercise (Know, Delete, Correct, Opt-Out, Limit, Portability).
• Your email associated with the Fyxi account.
• Confirmation that you are a California resident.

We will verify your identity reasonably before responding (typically by confirming control of the account email) and we will respond within 45 days. If we need more time due to complexity, we will inform you.

You may designate an authorized agent to make these requests on your behalf. In that case we will ask for a signed authorization and verify the identity of both the agent and yourself.

The Service is not directed at minors under 18. We do not sell personal data under any circumstance, including minors' data. If you suspect a minor has created an account, notify us at privacy@fyxi.ai and we will close it.

Questions or requests: privacy@fyxi.ai.

If you believe we did not adequately respond to your request, you may file a complaint with:

• California Privacy Protection Agency (CPPA) — cppa.ca.gov
• California Attorney General — oag.ca.gov/privacy

Legal entity: Fyxi LLC · California Filing #B20260341393
Registered address: 2108 N ST STE N, Sacramento, CA 95816