TABLE OF CONTENTS
INTRODUCTION AND SCOPE
This Tofu Apps and Web Services ("Services") California Notice at Collection and Privacy Notice (“California Privacy Notice”) is only applicable to California residents (“you”). It supplements the information contained in our Privacy Policy. It is delivered on behalf of GetPaid Inc. (“we,” “us,” and “our”) and governs certain personal information we collect from you.
The California Code of Regulations defines a "resident" as:
- every individual who is in the State of California for other than a temporary or transitory purpose and
- every individual who is domiciled in the State of California, who is outside the State of California for a temporary or transitory purpose
All other individuals are defined as "non-residents."
If this definition of "resident" applies to you, we must adhere to certain rights and obligations regarding your personal information.
We have adopted this California Privacy Notice to comply with the California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100 et seq. (“CCPA, as amended by the California Privacy Rights Act of 2020 (CPRA)”). Please take the time to read and understand this California Privacy Notice.
Scope
This California Privacy Notice covers personal information collected from or processed about you when you use the Tofu Services, including by downloading, installing, registering with, accessing or otherwise using the Services (collectively referred to herein as “Use”).
There is other personal information that this California Privacy Notice does not cover. In some cases, that personal information may not be subject to the CCPA. In other cases, a different privacy notice may apply. Accordingly, this California Privacy Notice and/or the California privacy rights set out herein may not apply to you or to all of your personal information. For example, certain personal information relating to our current or former employees, job applicants, or contractors may be subject to separate notices and different rights under the CCPA, as amended by the CPRA.
The following is not personal information for purposes of the CCPA: (i) publicly available information; (ii) lawfully obtained, truthful information that is a matter of public concern; (iii) deidentified consumer information about California residents; and (iv) aggregate consumer information about California residents (in each case, as those terms are used in the CCPA). This California Privacy Notice does not apply to such information.
1. NOTICE AT COLLECTION AND OUR PRIOR COLLECTION, USE AND DISCLOSURE OF PERSONAL INFORMATION DURING THE PRECEDING 12 MONTHS
The CCPA requires us to give you specific information about the categories of personal information we collect about you, the sources from which we have obtained that information, the purposes for which we collect it, and the categories of entities to whom we disclose it. The table below outlines relevant practices as of now and during the preceding twelve (12) months. Our collection, use and disclosure of personal information depends on your relationship with us and your interaction with us.
| Categories of personal information collected over the 12-month period prior to the effective date of our Privacy Policy1 |
Sources of collection over the 12-month period prior to the effective date of our Privacy Policy |
Business or Commercial Purpose for Collection and Use |
Categories of third parties with whom the business shared or disclosed the personal information for a business purpose over the 12-month period prior to the effective date of our Privacy Policy |
| Identifiers and Categories in Cal. Civ. Code 1798.80(e), such as name, unique personal identifier, account login credentials, online identifier, IP address, email address, and cellular telephone number. |
- Directly from you or automatically when you Use the App.
- Via vendors on which we rely.
|
Providing and managing the Services; account creation and authentication; customer support; security and fraud prevention; analytics; cross-context behavioral advertising; legal compliance. |
- To our Affiliates.
- To third-party organizations such as contractors, business partners, service providers, and vendors that we use to support our business and who assist us in providing Tofu Services.
- To third-party analytics providers and advertising partners.
- To affiliated and nonaffiliated entities in the event that we or any of our affiliates, subsidiaries or lines of business is merged, acquired, divested, financed, sold, disposed of or dissolved.
- To law enforcement agencies, regulators, courts, or other competent authorities in response to legal requests and for purposes of preventing harm.
|
| Commercial information, such as records of products or services purchased, obtained or considered, or other purchasing or consuming histories of tendencies. |
- Directly from you or automatically when you Use the App.
- Via vendors on which we rely.
|
Providing and improving the Services; billing and payment processing; internal analytics and reporting; personalized content. |
- To our Affiliates.
- To third-party organizations such as contractors, business partners, service providers, and vendors that we use to support our business and who assist us in providing Tofu Services.
- To third-party analytics providers and advertising partners.
- To affiliated and nonaffiliated entities in the event that we or any of our affiliates, subsidiaries or lines of business is merged, acquired, divested, financed, sold, disposed of or dissolved.
- To law enforcement agencies, regulators, courts, or other competent authorities in response to legal requests and for purposes of preventing harm.
|
| Internet or other electronic network activity information, such as information regarding interaction with an app or advertisement. |
- Directly from you or automatically when you Use the App.
- Via vendors on which we rely.
|
Analytics and performance monitoring; improving the Services; cross-context behavioral advertising; security monitoring. |
- To our Affiliates.
- To third-party organizations such as contractors, business partners, service providers, and vendors that we use to support our business and who assist us in providing Tofu Services.
- To third-party analytics providers and advertising partners.
- To affiliated and nonaffiliated entities in the event that we or any of our affiliates, subsidiaries or lines of business is merged, acquired, divested, financed, sold, disposed of or dissolved.
- To law enforcement agencies, regulators, courts, or other competent authorities in response to legal requests and for purposes of preventing harm.
|
| Geolocation data, such as the state or country associated with your IP address. |
Directly from you or automatically when you Use the App. |
Providing location-relevant features (e.g., mileage tracking); analytics; determining applicable law. |
- To our Affiliates.
- To third-party organizations such as contractors, business partners, service providers, and vendors that we use to support our business and who assist us in providing Tofu Services.
- To third-party analytics providers and advertising partners.
- To affiliated and nonaffiliated entities in the event that we or any of our affiliates, subsidiaries or lines of business is merged, acquired, divested, financed, sold, disposed of or dissolved.
- To law enforcement agencies, regulators, courts, or other competent authorities in response to legal requests and for purposes of preventing harm.
|
| Sensory data, such as audio, electronic, visual, thermal, olfactory or similar information, such as the photos that you upload to the App. |
Directly from you or automatically when you Use the App. |
Providing the Services (invoice and estimate generation); storing user-created content. |
- To our Affiliates.
- To third-party organizations such as contractors, business partners, service providers, and vendors that we use to support our business and who assist us in providing Tofu Services.
- To affiliated and nonaffiliated entities in the event that we or any of our affiliates, subsidiaries or lines of business is merged, acquired, divested, financed, sold, disposed of or dissolved.
- To law enforcement agencies, regulators, courts, or other competent authorities in response to legal requests and for purposes of preventing harm.
|
| Inferences drawn from the information listed above to create a profile about a California resident reflecting their preferences, characteristics and other attributes. |
Directly from you, indirectly (by observing your activity) or automatically when you Use the App. |
Personalizing content and features; cross-context behavioral advertising; improving the Services. |
- To our Affiliates.
- To third-party organizations such as contractors, business partners, service providers, and vendors that we use to support our business and who assist us in providing Tofu Services.
- To third-party analytics providers and advertising partners.
- To affiliated and nonaffiliated entities in the event that we or any of our affiliates, subsidiaries or lines of business is merged, acquired, divested, financed, sold, disposed of or dissolved.
- To law enforcement agencies, regulators, courts, or other competent authorities in response to legal requests and for purposes of preventing harm.
|
2. DATA RETENTION
Retention periods vary depending on the category of personal information and the purpose for which it is collected. We retain personal information only for as long as reasonably necessary to fulfill the disclosed purposes, comply with legal obligations, and enforce our agreements.
2.1. Specific retention periods
- User account data. Retained for as long as your account remains active. If you delete your account, this data will be permanently removed in accordance with our deletion procedures.
- Payment and transactional data. Retained for seven (7) years as required to comply with applicable financial, tax, and accounting laws.
- Uploaded and created documents. Retained only for as long as necessary to provide the services you request. You may delete these documents at any time within the application; once deleted, they are permanently removed from our systems and cannot be recovered.
2.2. Account and data deletion
If you decide to stop using our services, you can delete your account. To make a request to delete your account, please contact us at support@tofu.com.
Following account deletion, we will erase or anonymize your personal information within the timeframes described above, except where retention is required by applicable law.
Where and as legally permitted, we may maintain and use data that, by itself, cannot identify or be attributed specifically to you for the purposes described in this California Notice, including to improve our service and create new features, technologies, and services.
3. HOW WE DISCLOSE PERSONAL INFORMATION
In the past twelve months, we have disclosed each of the categories of personal information listed above for business purposes, as set out above.
3.1. Sales of Personal Information
We do not sell your personal information.
3.2. Sharing Personal Information for Cross-Context Behavioral Advertising
We may share the following categories of personal information with third-party ad-tech providers and others throughout the online advertising ecosystem for purposes of cross-context behavioral advertising:
- Identifiers;
- Categories of personal information described in Cal. Civ. Code Section 1798.80(e);
- Commercial Information;
- Internet or other electronic network activity information;
- Geolocation data;
- Inferences drawn from personal information such as preferences, characteristics, and behaviors.
For more information, please see Section 5 of our Privacy Policy.
3.3. Minors Under the Age of 16
We do not have actual knowledge that we sell or share the personal information of minors under the age of 16.
4. YOUR RIGHTS AS A CALIFORNIA RESIDENT
As a California resident, you may have certain rights in relation to your personal information.
4.1. Your rights
- (i) Right to Know
You may have the right to know how we have collected, used, and disclosed your personal information. Specifically, you may have the right to know:
- The categories of personal information we have collected about you.
- The categories of sources from which we have collected your personal information.
- The business or commercial purpose for which we collect, sell or share your personal information.
- The categories of third parties to whom we have disclosed your personal information.
- The categories of personal information that we have sold or shared about you and the categories of third parties to whom it was sold or shared.
- The categories of personal information we have disclosed about you for a business purpose and the categories of persons to whom we have disclosed it.
- (ii) Right to Make a Deletion Request
You may have the right to request that we delete your personal information that we have collected or received. Subject to certain exceptions, we must delete your personal information and direct our service providers and contractors to delete your personal information.
We may deny your deletion request if retaining the information is necessary for us or our service providers to:
- Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity or prosecute those responsible for such activities.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
- Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
- Comply with a legal obligation.
- Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
- (iii) Right to Correct Inaccurate Personal Information
You may have the right to request that we correct inaccurate personal information about you, taking into account the nature of the personal information and the purposes of the processing of the personal information. - (iv) Right to Opt-Out of Sales of Personal Information
We do not sell your personal information. - (v) Right to Opt-Out of Sharing of Personal Information
You may have the right to opt out of us sharing your personal information for cross-context behavioral advertising purposes. To exercise this right, please toggle the “Do Not Sell or Share My Personal Information” switch. When the toggle is enabled, it signals the user’s preference to opt out of the sale or sharing of their personal information.
We also recognize opt-out preference signals, such as the Global Privacy Control (“GPC”). If our website detects a GPC signal from your browser, we will treat it as a valid request to opt out of the sale and sharing of your personal information for that browser. For more information about GPC, please visit https://globalprivacycontrol.org. - (vi) Right to Limit Use and Disclosure of Sensitive Personal Information
Subject to certain exceptions, you may have the right to limit our use and disclosure of your sensitive personal information if applicable.
- (vii) Right to Non-Discrimination
You have the right not to be discriminated against by us for choosing to exercise your rights under the CCPA, including by:
- Denying goods or services to you;
- Charging different prices or rates for goods or services, including the use of discounts or other benefits, or imposing penalties;
- Providing a different level or quality of goods or services to you;
- Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.
4.2. Other Rights: Notice to California Consumers
You have other rights under California’s “Shine the Light” law. California Civil Code section 1798.83, requires certain businesses to respond to requests from California customers asking about the businesses’ practices related to disclosing personal information to third parties for the third parties’ direct marketing purposes. We do not disclose personal information to third parties for those third parties’ direct marketing purposes.
4.3. How to Exercise Your California Privacy Rights
If you wish to exercise your right to know, access specific pieces of personal information we have about you, delete or correct inaccuracies in your personal information, please submit a request to us by contacting us at support@tofu.com or using in-app functionality.
4.4. Information for Authorized Agents
You can authorize a person (“Authorized Agent”) to exercise your California privacy rights on your behalf. To submit a request to us on behalf of another person as an Authorized Agent, please submit a request to us by contacting us at support@tofu.com.
We may require the Authorized Agent to provide proof of written authorization or a power of attorney. We may also require that the consumer directly verify their identity with us and confirm that they authorized the agent to act on their behalf.
4.5. Verifying Your Requests
Your request to us must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We may need to ask you for personal information to verify your request so we can match it to the personal information we already have about you. We may also need to obtain additional information about you that we do not already have. If you provide us with new personal information that we do not already have about you, we will use it solely for the purpose of verifying your request. We will let you know via email if we need more information from you to verify your request. Please reply to our requests promptly.
We will communicate with you about your requests via email. We will use the email address you provided when submitting your request.
If we cannot verify your identity, we will let you know.
5. RESPONDING TO YOUR REQUESTS
5.1. Timeline
We aim to promptly verify and respond to your requests within 45 days of receipt, but we may require a total of up to 90 days to respond to your requests. If we require additional time beyond the initial 45 days after we receive your request, we will let you know within the first 45 days.
We do not ordinarily charge a fee for our response to your requests. However, we may do so to the extent your request(s) are excessive, repetitive, or manifestly unfounded. If we determine that charging a fee is warranted, we will let you know and will provide you with an estimate of the associated costs of responding to your request(s).
If we determine that we cannot or will not take the action that you requested, we will let you know. We will inform you of our reasons for not taking action and any rights you may have to appeal the decision.
Unless you tell us that you would like to receive a response via postal mail, we will respond to you via email regarding your requests to know and to access the specific pieces of personal information we have about you. We will contact you at the email address you provided when submitting your request(s). If you would like to receive responses to a request to know or access personal information via postal mail rather than email, please let us know when submitting your request(s).
5.2. Limitations
We are only required to respond to certain requests twice in any twelve-month period. We are not required to provide you access to specific pieces of personal information more than twice in any twelve-month period. Similarly, we are not required to comply with your “requests to know” more than twice in any twelve-month period. This limitation does not apply to requests to opt out of sale or sharing.
6. FINANCIAL INCENTIVES
We do not offer any financial incentives — such as discounts, rewards, or payments — in exchange for the collection, retention, or sharing of your personal information. Accordingly, we do not maintain any financial incentive program subject to disclosure under Cal. Civ. Code § 1798.125.
7. CHANGES TO OUR CALIFORNIA PRIVACY NOTICE
We will update this California Privacy Notice as required by law and at least once every 12 months.
8. HOW TO CONTACT US
If you have any questions or concerns about this California Privacy Notice, please contact us at support@tofu.com.
