Email Subscriptions. You can always unsubscribe from our commercial or promotional emails by clicking unsubscribe in those messages. We will still send you transactional and relational emails about your use of the you.com Services.

Push Notifications. You can opt out of receiving push notifications through your app settings. Please note that opting out of receiving push notifications may impact your use of the you.com Services (such as notice of Services enhancements).

Profile Information. You can review and edit certain account information you have chosen to add to your profile by logging in to your account settings and profile.

Location Information. You can prevent your device from sharing location information through your device’s system settings. But if you do, this may impact you.com’s ability to provide you our full range of features and services. 

Accessing Your Information. If you would like to access your information, please email us at [email protected]. You can also see information we have about you by logging into your account and viewing things like your profile, settings, and preferences.

Deleting Your Account. If you would like to delete your you.com account, please email us [email protected]. In some cases, we will be unable to delete your account, such as if there is an issue with your account related to trust, safety, or fraud. When we delete your account, we may retain certain information for legitimate business purposes or to comply with legal or regulatory obligations. For example, we may retain your information because we may be obligated to do so as part of an open legal claim. When we retain such data, we do so in ways designed to prevent its use for other purposes.

Regardless of where you live, and subject to our obligations under applicable laws, you may have certain rights and choices regarding your information. For example, in addition to choices described elsewhere in this Privacy Policy, you may have some or all of the following rights and choices in general:

B) General Regional Rights

• Access Rights: You may have the right to receive certain information, such as the following (these rights, and the applicable types of data and time periods, will vary depending on the laws applicable to the state or country in which you reside):
  1. The categories of information we have collected or disclosed about you; the categories of sources of such information; the business or commercial purpose for collecting your information; and the categories of third parties with whom we shared your information.
  2. Access to and/or a copy of certain information we hold about you.
  3. In some circumstances, you may have the right to obtain certain information in a portable format.

• Erasure: You may have the right to request that we delete certain information we have about you. We may either decide to delete your information entirely, or we may anonymize or aggregate your information such that it no longer reasonably identifies you, and may use it to improve our Services. Certain information may be exempt from such requests under applicable law. For example, we need certain types of information so that we can provide our Services to you, we may be required to retain certain information for legal purposes, and there may be other reasons we may need to keep certain information under various applicable laws. In addition, if you ask us to delete your information, you may no longer be able to access or use some of our Services.
• Correction: You may have the right to request that we correct certain information we hold about you.
• Limitation of Processing: Certain laws may allow you to object to or limit the manner in which we process some of your information, including the ways in which we use or share it. For example, you may have these rights if the processing was undertaken without your consent and without a legitimate business interest (although we may not be required to cease or limit processing in cases where our interests are balanced against your privacy interests).
• Regulator Contact: You may have the right to contact or file a complaint with regulators or supervisory authorities about our processing of information.  To do so, please contact your local data protection or consumer protection authority.
• Postings by Minors: Users of our Services under the age of 18 in certain jurisdictions have the right to require that we delete any content they have posted on one of our Services.
• Other: You may have the right to receive information about any financial incentives that we may offer to you, if any. You may also have the right to not be discriminated against (as provided for in applicable law) for exercising certain of your rights.

If you believe that you have specific rights under your jurisdiction and you would like to exercise any of these rights, please submit a support request via email to us at [email protected]. Other than a simple marketing opt-out, you will be required to verify your identity before we fulfill your request. In certain jurisdictions, you may be able to designate an authorized agent to make a request on your behalf, subject to certain requirements of your applicable law. We may require that you provide the email address we have on file for you (and verify that you can access that email account) as well as an address, phone number, or other data we have on file, in order to verify your identity.  If an agent is submitting the request on your behalf, we reserve the right to validate the agent’s authority to act on your behalf, and we may be required to take additional verification measures under applicable law.

C) Important Information for EU and United Kingdom Users

If you are a user from the European Union or United Kingdom you should be aware that we are joint controllers of your information (Data Controller) under the EU General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and such similar laws promulgated in the various EU countries. 

You may have certain additional rights regarding your information (as defined in the GDPR and UK GDPR, for instance), including the right to:

• access your information;
• rectify your information if it is incorrect or incomplete;
• have your personally identifiable information erased (“right to be forgotten”) if certain grounds are met;
• withdraw your consent to our processing of your information at any time, but only if our processing is based on consent;
• object to our processing of your information, if our processing is based on legitimate interests;
• object to our processing of your information for direct marketing purposes; and
• receive your information from us in a structured, commonly used, and machine-readable format, and
• the right to transmit your information to another controller without hindrance from us (data portability).

There is no charge for any of these requests. To make a request, please contact us at [email protected]. We try to respond to such requests in a timely manner, but in no event longer than one month.

When we collect your information, we maintain and store it for as long as we determine reasonably necessary to provide our Services to you, unless you exercise your right to erasure described above, or to comply with applicable legal requirements.

If you are a citizen of the European Union or United Kingdom, when we process your information, we will only do so in the following situations:

• We have a contractual obligation.
• You have provided your consent. You are able to remove your consent at any time, and you may do this by contacting us at [email protected].
• We have a legal obligation.
• We have a legitimate business interest in processing your information. For example, we may process your information to send you marketing communications, relevant content, products or events invitations, or to communicate with you about changes to our Services, and to provide, secure, or improve our Services.

You should be aware that information that you provide to us may be transferred out of the country in which you reside to servers in a country that may not guarantee the same level of protection as the one in which you reside. We do this for a legitimate business purpose in providing the Services as permitted under UK and EU privacy laws, and therefore specific consent is not required under the EU and UK legal schema. We will take all steps reasonably necessary to ensure that your information is treated securely in accordance with this Privacy Policy, and no transfer of your information will take place to a third party unless there are adequate controls in place to protect your information and/or you have provided contractual consent by becoming a User.

If you are a User in the European Union or United Kingdom and have a concern about our processing of personal information that we are not able to resolve, you have the right to lodge a complaint with the data privacy authority where you reside. For contact details of your local Data Protection Authority, please see: http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm.

D) Information for U.S. Residents

Various U.S. states (e.g., as of the date of this Policy, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia) currently allow or will soon allow consumers to opt out of sharing of their data. As such, residents of those states may request that we:

• Disclose the sources, categories, and specific pieces of information we have collected about you, how that information is used, and with whom we share it
• Disclose the purpose for collecting your information
• Disclose the categories of third parties with whom we share your information
• Delete/rectify/restrict personally identifiable information, subject to certain exceptions (right of rectification not applicable to Utah residents)
• Though not specifically applicable to us, to disclose, for any “sales” of personal information, the categories of personal information collected and sold and to what categories of third parties it was sold
• Though not specifically applicable to us, to opt you out of sales of your information (if any) or subject certain information to automated decision-making algorithms (not applicable to Utah residents)
• Provide a copy of your information in a readily usable format that allows the information to be transmitted to others
• Residents in these states may not be discriminated against for exercising any of the rights described above.

Residents of these states may exercise these rights by emailing us at [email protected]. Note that if a state law has been ratified but not yet effective, we reserve the right to deny your request as it pertains to that state. Finally, if you are a Colorado resident, please note that we do not require or seek to process any of your sensitive personal information (defined as personal data that reveals racial or ethnic origin, religious beliefs, sexual orientation and biometric information). As noted in the first page of this Policy, if you are a Colorado resident, please do not enter such sensitive personal information in prompts or otherwise share such information that could enter our systems. 

We do not process any data of children.

In general, we, including our vendors and service providers, collect the following California regulated categories of personal information (PI) from you:

Category	Examples	Collected
A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.	YES
B. PI categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, license or state identification card number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some information included in this category may overlap with other categories.	NO
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	NO
D. Commercial information.	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	NO
E. Biometric information.	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	NO
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer's interaction with websites, services, or advertisement.	YES
G. Geolocation data.	Physical location or movements.	YES
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	YES
I. Professional or employment-related information.	Current or past job history or performance evaluations.	NO
J. Non-public education information	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
K. Inferences drawn from other PI.	Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	YES

Sharing Your Information for a Business Purpose

In the preceding twelve (12) months, we have disclosed the following categories of Personal Information for a business purpose with our Affiliates and Service Providers:

• Category A: Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address
• Category F: Internet or other similar network activity
• Category G: Geolocation data
• Category H: Sensory data
• Category K: Inferences drawn from other PI

Shine Your Light Law. Under California law, California residents are entitled, once per calendar year, to ask us for a notice identifying the categories of personal customer information that we share with certain third parties for the third parties' direct marketing purposes, and providing contact information (i.e., names and addresses) for these third parties. If you are a California resident and would like a copy of this notice, please submit a written request to us via email at [email protected]. You must put the statement "Your California Privacy Rights" in your request and include your name, street address, city, state, and ZIP code. We are not responsible for notices that are not labeled or sent properly or do not have complete information.

Opt-Out of Sale in U.S. We do not currently “sell” (as defined by the California Consumer Privacy Act and other U.S. state laws) any personal information subject to this Privacy Policy, and we do not exchange information for any type of financial incentive. Information shared with our advertisers is not considered personal information, as none of the data exchanged could lead to the identification of you as an individual (i.e., at minimum it is de-identified).

Do Not Track. Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals. To find out more about "Do Not Track," please visit www.allaboutdnt.com. This is distinct from any response to opt-out signals such as Global Privacy Control (aka GPC).

Children’s Privacy

We do not knowingly collect, maintain, or use personal information from children under 18 years of age, and no part of our Services are directed to children. If you learn that a child you are a guardian or parent of has provided us with personal information in violation of this Privacy Policy, then you may alert us at [email protected].

Security

We work hard to protect your information.

We make reasonable efforts to protect your information by using physical and electronic safeguards designed to improve the security of the information we maintain. However, as our Services are hosted electronically, we can make no guarantees as to the security or privacy of your information.

As part of our security program, we use vendors with recognized world-class security such as AWS, Stripe, and Google. AWS security documentation is here. Stripe’s security practices are here. Google’s security is described here. We also limit the type and amount of personal information we collect in the first place. All our communications and websites are encrypted (using transport layer security, or TLS, a leading encryption protocol).

Affirmative Commitment to Comply with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF

Su-Sea, Inc. (dba you.com) complies with the EU-U.S. Data Privacy Framework (the “EU-U.S. DPF”) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (the “Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. Su-Sea, Inc. (dba you.com) has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (the “EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Su-Sea, Inc. (dba you.com) has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (the “Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Our Liability for Onward Transfers

Under the DPF’s Accountability for Onward Transfer Principle (the “DPF Principle”), as a joint controller of your data, we comply with the DPF’s Notice and Choice Principles. Furthermore, under the Recourse, Enforcement and Liability Principles of the DPF, we are responsible for the processing of personal information, including transfers to third parties acting as agents on our behalf. To that end, we remain liable under the DPF Principles, if our third party agent processes your personal information in a manner that is inconsistent with the DPF Principles, unless we prove that we are not responsible for the event giving rise to the damage.

Contact Information, Inquiries or Complaints

You can contact us with your questions, comments, or concerns.

Specifically in compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Su-Sea, Inc. (dba you.com) commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Su-Sea, Inc. (dba you.com) at:  

[email protected] or write to us at:

SuSea, Inc.

Attention: Data Privacy Officer

228 Hamilton Ave, Floor 3

Palo Alto CA 94301

 

Alternative Dispute Resolution

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Su-Sea, Inc. (dba you.com) commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States, but with facilities in the European Union, the United Kingdom, and/or Switzerland. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Note also that Su-Sea, Inc. (dba you.com) is obligated to arbitrate claims and follow the terms as set forth in Annex I of the DPF Principles, provided that an individual has invoked binding arbitration by delivering notice to our organization and following the procedures and subject to conditions set forth in Annex I of Principles. For more information, please visit: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction

Changes to this Privacy Policy

We will let you know about any material changes to this Privacy Policy.

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or share personal information previously collected from you through the Services, we will notify you through the Services, by email, or other communication (such as posting on this website).