Our Privacy Policy

We do not sell your PII. We only share your information with third parties in the following circumstances:

• With Your Consent: We may share your PII with your explicit consent. For example, a job candidate's information is shared with a potential employer as part of the application process.

• Government Agencies: Information, including but not limited to PII, collected via the WOTC Bot is shared with the Internal Revenue Service (IRS) and designated State Workforce Agencies as required by law to process WOTC certifications.

• Service Providers: We engage trusted third-party companies to perform services on our behalf, such as cloud hosting (e.g., AWS, Google Cloud), payment processing, and data analytics. These providers are contractually obligated to protect your PII and are prohibited from using it for any other purpose.

• Legal Requirements: We may disclose your PII if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation, protect our rights or property, or prevent illegal activity.

• GDPR: 

You may have a right under the European Union General Data Protection Regulation 2016/679 of 2018 (“GDPR”) to: (i) withdraw consent; (ii) request your PII previously collected by us; or (iii) pause any data processing relating to your PII in the event you object to it. If you are subject to GDPR (if you are a resident of a jurisdiction subject to GDPR protections and are also using the Sites within a jurisdiction subject to GDPR protections) and would like to exercise any of the options listed in this subsection, please contact Canary at: _privacy@canaryai.com_. 

• In the event you are a resident of a jurisdiction subject to GDPR protections and are also using the Sites within a jurisdiction subject to GDPR protections, Canary will ensure your consent is consistently accurate with your most up-to-date information and the purpose for which the data is being used. If either of those changes, we will make a new request for your consent. 

• California Consumer Privacy Act:

These disclosures for California residents apply only to individuals who reside in California. The California Consumer Privacy Act of 2018 (“CCPA”) and California Privacy Rights Act (“CPRA”) may provide additional rights to know, delete and opt out, and may require some applicable businesses collecting or disclosing PII to provide notice of rights California residents may exercise. By voluntarily providing notice of and explaining some of these rights, Canary in no way acknowledges or consents to being subject to either the CCPA or CPRA, and expressly disclaims applicability of CCPA and/or CPRA to its business based on small business exemptions to both laws. 

• (i) Notice of Collection and Non-Collection. 

• (a) Canary may in the future or may have collected information corresponding to the following categories of information enumerated in the CCPA.

• Identifiers, including name, address, email address, account name, Social Security Number, IP address - and an ID number assigned to your account.

• Customer records, phone number, billing address, credit or debit card information, employment or education information.

• Demographic information, such as age or gender. This category includes pieces of PII that also qualify as protected classification characteristics under other pre-existing California or federal laws.

• Analytics and Advertising, including purchases and engagement with the Services.

• Internet activity, including history of visiting and interacting with our Service, browser type, browser language and other information collected automatically.

• Geolocation data, including location enabled services such as Wi-Fi and GPS.

• Inferences, including information about your interests and preferences.

• (b)Canary will not intentionally collect the following categories of information enumerated in the CRPA: 

• Sensitive Personal Information, including biometric and neural data, geolocation data, race, ethnicity, religious or philosophical beliefs, union membership, content of nonpublic communications, genetic data, or sex life or sexual orientation information. 

• Canary may collect and use some categories of PII in (a) above for the business purposes described in this Privacy Policy. Canary will not intentionally collect or use any of the categories of Personal Information in (b) above. 

• Canary may collect and maintain Personal Information in various formats, including but not limited to:

• a. Physical formats, including paper documents, printed images, vinyl records, or video tapes;

• b. Digital formats, including text, image, audio, or video files; and

• c. Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.

• Canary does not generally sell information. However, to the extent Canary “sells” information as that term is defined under the CCPA, if required, we will comply with applicable law as to such activity.

• Canary may disclose the following categories of information for commercial purposes: Commercial Information; Demographic Data; Location Data; Identifiers; Inferences; and Internet activity.

• We may use and/or partner with different types of entities to assist with our daily operations and manage the Services. 

• Right to Know and Delete. If you are a California resident, you may have the right to know certain information about our data practices in the preceding 12 months. You may request the following from us:

• The categories of PII we have collected about you;

• The categories of sources from which the PII was collected;

• The categories of PII about you we disclosed for a business purpose or sold;

• The categories of third parties to whom the PII was disclosed or sold;

• The business or commercial purpose for collecting or selling the PII; and

• The specific pieces of PIIwe have collected about you.

• In addition, you may have the right to delete the PII we have collected from you. However, this is not an absolute right, the right may be limited or non-existent based on certain exemptions from the applicability of the law, or we may have legal grounds for keeping such data.

• To request to exercise any of these rights, please submit a request to our privacy officer at __privacy@canaryai.com_. In the request, please specify which right you are seeking to exercise and the scope of the request. We will confirm receipt of your request within 10 days. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity or determine that we are not bound by law to respond to your request(s), we may deny your request(s).

• Authorized Agent. You can designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly.

• Right to Non-Discrimination. You have the right to non-discriminatory treatment by us, should you choose to exercise any of your applicable rights.

• Shine the Light. Clients who are residents of California may request: a list of the categories of PII disclosed by us to third parties during the immediately preceding calendar year for those third parties’ own direct marketing purposes, and (ii) a list of the categories of third parties to whom we disclosed such information. To submit a request, please contact us at ___privacy@canaryai.com___. Requests must include “California Shine the Light Request” in the subject line and include your name, street address, city, state, and ZIP code. We may require additional information from you to allow us to verify your identity and if we determine that we are not bound by law to respond to your request(s), we may deny your request(s). Please note that Canary is not required to respond to requests made by means other than through the provided email address or mail address (below).

• We may decline to process any requests that are outside the bounds of applicable law, frivolous/vexatious, jeopardize the privacy of others, are extremely impractical, or for which access is not otherwise required by law. We may also decline aspects of deletion or data access requests if we believe doing so would undermine our legitimate use of data for anti-fraud and security purposes.