CCPA Privacy Notice

Purpose of this notice. This notice gives residents of California the information required by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §§ 1798.100 ff., the "CCPA"), and by the regulations of the California Privacy Protection Agency (Cal. Code Regs. tit. 11, §§ 7000 ff., the "CCPA Regulations"). Terms defined in the CCPA, such as "consumer", "personal information", "sensitive personal information", "sell", "share", "business purpose", "service provider", "contractor" and "third party", have the same meaning in this notice.

Who we are. This notice is given by Ole Nepomuk Mai, trading as ManyPI as a sole proprietorship (Einzelunternehmen) under German law, Goethestrasse 70, 10625 Berlin, Federal Republic of Germany ("ManyPI", "we", "us" or "our"). We provide the ManyPI software service (the "Service") only to businesses, on a Free Plan and on Paid Plans. "Customer" means a business that uses the Service under the Terms of Service; "Plan", "Free Plan", "Paid Plan", "Credits", "User", "Workspace", "Customer Data" and "Contact Data" have the meanings given in §2 of the Terms of Service.

Whether the CCPA applies to us. The CCPA applies to a business that does business in California and meets at least one of the following thresholds in Cal. Civ. Code § 1798.140(d)(1):

1. (a)
   annual gross revenues in the preceding calendar year above the amount fixed in that provision, as adjusted from time to time;
2. (b)
   annually buying, selling or sharing, alone or in combination, the personal information of 100,000 or more consumers or households; or
3. (c)
   deriving 50 per cent or more of its annual revenues from selling or sharing consumers' personal information.

Extent of this notice. This notice applies to the extent that the CCPA applies to us. Publishing it is not an admission that we are a "business" within the meaning of Cal. Civ. Code § 1798.140(d), or that the CCPA applies to any particular processing. The descriptions of our practices in §2 to §7 are accurate whether or not the CCPA applies, and we do not ask you to show that it applies before we handle a request made under this notice.

Business contacts are covered. This notice applies to you whether you deal with us on your own account or as an owner, employee, officer or contractor of a business, for example as a User of a Workspace or as the contact person of a Customer. The CCPA's former partial exemption for business-to-business personal information expired on 1 January 2023, and we do not rely on it.

Relationship to the Privacy Policy and the GDPR. This notice supplements the Privacy Policy, which describes the same processing in more detail. Because we are established in Germany, the General Data Protection Regulation (the "GDPR") applies to the processing we carry out as controller wherever you live, and the rights described in §14 of the Privacy Policy are also available to you. Where the GDPR or the Privacy Policy gives you a further right or a shorter time limit than this notice, we apply it. Nothing in this notice reduces a right you have under them.

Notice at collection and privacy policy. Where the CCPA applies, §2 to §5 are our notice at collection under Cal. Civ. Code § 1798.100 and § 7012 of the CCPA Regulations, and this notice as a whole is our privacy policy under Cal. Civ. Code § 1798.130(a)(5) and § 7011 of the CCPA Regulations.

How this section is organised. This section describes the personal information we collect as a business, all of which we have also collected in the 12 months before the effective date of this notice. Sensitive personal information is described in §3, and personal information we process on behalf of Customers in §6. For each category, this section states:

1. (a)
   examples of the information;
2. (b)
   the categories in Cal. Civ. Code § 1798.140(v)(1) into which it falls;
3. (c)
   the sources from which we collect it;
4. (d)
   the business or commercial purposes for which we collect and use it;
5. (e)
   the categories of persons to whom we disclose it, described further in §4;
6. (f)
   whether we sell or share it; and
7. (g)
   how long we keep it or, where a fixed period is not possible, the criteria we use.

Account and profile information.

1. (a)
   Examples: your name, email address and avatar; the name of your organisation and your role in it; the identifier of your Google account, where you sign in with Google; your answers to optional onboarding questions, such as your intended use of the Service; and your log-in credentials (§3);
2. (b)
   Statutory categories: identifiers; personal information described in Cal. Civ. Code § 1798.80(e); professional or employment-related information; visual information, where your avatar is a photograph; and sensitive personal information;
3. (c)
   Sources: you; Google, where you sign in with Google; and the Customer or User who invites you to a Workspace;
4. (d)
   Purposes: creating and administering your account and your membership of a Workspace; authenticating you; providing the Service and customer support; sending you service, transactional and lifecycle messages about the Service; and protecting the security and integrity of the Service;
5. (e)
   Recipients: service providers and contractors in the categories in clause 4.1(a), (b) and (e);
6. (f)
   Sold or shared: no; and
7. (g)
   Retention: for the life of your account, after which we delete it as described in §7.

Billing and transaction information.

1. (a)
   Examples: your name, email address, billing address and country; your VAT or other tax identification number and tax status; the Plan you purchased; and your transaction, subscription and invoice history, but not your card or other payment method details, which we never receive;
2. (b)
   Statutory categories: identifiers; personal information described in Cal. Civ. Code § 1798.80(e); and commercial information;
3. (c)
   Sources: you; and our merchant of record and payment providers (clause 4.2);
4. (d)
   Purposes: taking payment; managing subscriptions, Credits and metered usage; issuing invoices; and complying with tax and accounting obligations;
5. (e)
   Recipients: our merchant of record and payment providers (clause 4.2); and service providers in the category in clause 4.1(a);
6. (f)
   Sold or shared: no; and
7. (g)
   Retention: up to 10 years, as German commercial and tax law requires (§ 257 HGB, § 147 AO).

Usage information.

1. (a)
   Examples: the features you use; the jobs and agent runs you start; the AI tokens and Credits you consume; error events; and operational events, such as creating a workflow or changing a subscription, recorded with your account identifier and Plan;
2. (b)
   Statutory categories: identifiers; internet or other electronic network activity information; and commercial information;
3. (c)
   Sources: automatically, from your use of the Service;
4. (d)
   Purposes: metering your Plan, Credits and overage; capacity planning; diagnosing and repairing faults; and monitoring the reliability of the Service and understanding how it is used;
5. (e)
   Recipients: service providers in the categories in clause 4.1(a) and (f);
6. (f)
   Sold or shared: no; and
7. (g)
   Retention: usage records for the life of your account; operational events and error diagnostics held by our product analytics provider only while needed for those purposes (clause 7.4). Aggregated statistics that do not identify you may be kept longer (clause 7.5).

Analytics information (only with your consent).

1. (a)
   Examples: browser and session identifiers stored in cookies or local storage; pages viewed, interactions, referrer and device and browser characteristics; a truncated IP address; browser errors; masked session replays, where enabled; and, in the app, your account identifier and, where available, your name and email address linked to that activity;
2. (b)
   Statutory categories: identifiers, including online identifiers; and internet or other electronic network activity information;
3. (c)
   Sources: automatically, from your browser, after you accept analytics in our cookie banner (§3 of the Cookie Policy);
4. (d)
   Purposes: understanding how our website and the Service are used, diagnosing problems and improving navigation;
5. (e)
   Recipients: service providers in the category in clause 4.1(f);
6. (f)
   Sold or shared: no, and it is not used for cross-context behavioural advertising (§5); and
7. (g)
   Retention: in your browser, for the storage periods stated in the Cookie Policy; collected events and recordings only while needed to analyse usage or investigate faults (clause 7.4). Withdrawing your consent stops further collection in your browser.

Sign-up attribution.

1. (a)
   Examples: the referring URL, campaign parameters, the landing page and the Plan you chose, which travel in the address of the sign-up redirect (nothing is stored on your device for this purpose) and which we then store with your account;
2. (b)
   Statutory categories: internet or other electronic network activity information;
3. (c)
   Sources: automatically, from your browser when you sign up;
4. (d)
   Purposes: measuring which channels bring us customers and allocating our marketing expenditure;
5. (e)
   Recipients: service providers in the category in clause 4.1(a);
6. (f)
   Sold or shared: no; and
7. (g)
   Retention: for the life of your account.

Correspondence and enquiries.

1. (a)
   Examples: your name, email address and company; the content of the messages you send us by email or through the contact, sales and support forms on our website or in the Service; support tickets linked to your account, where you have one; and our replies;
2. (b)
   Statutory categories: identifiers; personal information described in Cal. Civ. Code § 1798.80(e); professional or employment-related information; and any other information you choose to include;
3. (c)
   Sources: you;
4. (d)
   Purposes: responding to enquiries and support requests; documenting agreements; and handling requests under this notice and the Privacy Policy;
5. (e)
   Recipients: service providers in the categories in clause 4.1(a) and (e);
6. (f)
   Sold or shared: no; and
7. (g)
   Retention: up to 3 years after the matter is closed. Within that period, we keep records of requests made under this notice, and of our responses, for at least 24 months, as § 7101 of the CCPA Regulations requires.

Security and access logs.

1. (a)
   Examples: records of internal access to our production systems, showing the person who accessed them, the path accessed, the IP address, the user agent and the time, which may relate to your account; and server and request logs of our hosting providers, including your IP address;
2. (b)
   Statutory categories: identifiers; and internet or other electronic network activity information;
3. (c)
   Sources: automatically, from our systems and from your browser or device when it connects to our website or the Service;
4. (d)
   Purposes: delivering the website and the Service; detecting, preventing and investigating security incidents and abuse; keeping a verifiable record of internal access; and diagnosing faults;
5. (e)
   Recipients: service providers in the category in clause 4.1(a);
6. (f)
   Sold or shared: no; and
7. (g)
   Retention: records of internal access for 24 months; server and request logs under our hosting providers' own retention settings, typically for days to weeks.

Marketing preferences.

1. (a)
   Examples: your email address and name, whether you have subscribed to or unsubscribed from our product communications, and the record of your choice;
2. (b)
   Statutory categories: identifiers;
3. (c)
   Sources: you;
4. (d)
   Purposes: sending you the product communications to which you have subscribed, and ensuring that we do not contact you after you unsubscribe;
5. (e)
   Recipients: service providers in the category in clause 4.1(e);
6. (f)
   Sold or shared: no; and
7. (g)
   Retention: until you withdraw your consent and, after that, a suppression record of your email address, kept so that we do not add you again.

Shared caches: published company contact details and email deliverability results.

1. (a)
   Examples: email addresses, telephone numbers, named roles and links to social profiles, as published by a company on its own website, stored by website domain; and, stored by email address, whether a mailbox was found to exist, the reason and the code returned by the mail server;
2. (b)
   Statutory categories: identifiers; and professional or employment-related information;
3. (c)
   Sources: publicly accessible company websites, retrieved through our web data collection infrastructure; and the mail servers we query when the Service verifies an email address, a check that stops before any message is sent (§7 of the Privacy Policy);
4. (d)
   Purposes: avoiding repeated retrieval of the same websites and repeated queries to the same mail servers, reducing the load on those systems and keeping the Service performant;
5. (e)
   Recipients: service providers in the categories in clause 4.1(a) and (d); and Customers, but only as the result of a lookup they run themselves: the published contact details for a website domain they research, or the deliverability result for an email address they ask the Service to verify. No customer account can read the deliverability cache itself, and neither cache records who performed a lookup;
6. (f)
   Sold or shared: no (clause 5.3); and
7. (g)
   Retention: entries are deleted automatically thirty (30) days after they were last checked, and earlier on request (§4 of the Data Rights Notice).

What we collect. We collect the following sensitive personal information within the meaning of Cal. Civ. Code § 1798.140(ae):

1. (a)
   your account log-in, that is your email address, in combination with your password, which we store only as a hash;
2. (b)
   where you connect a mailbox to a Workspace, the log-in for that mailbox in combination with the password or the OAuth access and refresh tokens that allow access to it, which we store encrypted; and
3. (c)
   where you connect a mailbox, the contents of email messages of which we are not the intended recipient, to the extent described in clause 6.4.

Purposes. We use and disclose sensitive personal information only for the purposes permitted by § 7027(m) of the CCPA Regulations, namely:

1. (a)
   to provide the Service you request, including authenticating you, sending the messages you instruct us to send, identifying replies and bounces, synchronising correspondence with your contacts and classifying replies;
2. (b)
   to prevent, detect and investigate security incidents, and to resist malicious, deceptive, fraudulent or illegal actions directed at us; and
3. (c)
   to have our service providers and contractors perform services on our behalf, such as storage and the processing described in clause 4.1.

No right to limit. Because we use and disclose sensitive personal information only for the purposes in clause 3.2, the right to limit its use and disclosure under Cal. Civ. Code § 1798.121 does not apply, and we do not provide a "Limit the Use of My Sensitive Personal Information" link.

Recipients, sale and retention. We disclose sensitive personal information only to service providers and contractors in the categories in clause 4.1(a) and (b) and, for excerpts of replies of up to about 1,200 characters used for classification, in the category in clause 4.1(c). We do not sell or share it. We keep it as follows:

1. (a)
   your password hash, for the life of your account;
2. (b)
   the credentials of a connected mailbox, until you disconnect the mailbox or your account is deleted; and
3. (c)
   synchronised messages, until they are deleted in the Service or your account is deleted, subject to clause 7.3.

Service providers and contractors. We disclose personal information for business purposes to service providers and contractors that process it on our behalf under written contracts restricting them to the services they perform for us. They fall into the following categories:

1. (a)
   hosting, content delivery, database, authentication, file storage and background processing;
2. (b)
   sign-in and mailbox connectivity, where you sign in with Google or connect a Google or Microsoft mailbox;
3. (c)
   AI model inference, by a single provider that is contractually prohibited from training its models on the data we submit;
4. (d)
   web search, page retrieval and proxy infrastructure for collecting publicly accessible business information;
5. (e)
   delivery of the service, transactional and lifecycle email we send to you; and
6. (f)
   website and product analytics.

Merchant of record and payment providers. You buy a Paid Plan from our merchant of record and deal with it directly at checkout. For new purchases this is Stripe, Inc., with its affiliate Sold through Link, LLC as merchant of record. Subscriptions purchased earlier through Polar Software Inc., or on the Lemon Squeezy platform of Sold through Link, LLC (formerly Lemon Squeezy LLC), continue to be billed by those providers. These providers process checkout, payment, fraud-prevention and tax data as independent businesses under their own privacy policies. They share the order data with us and receive from us the information they need to bill your Plan. Stripe also holds our customer and subscription records as our service provider. You enter your payment details directly with the provider, and we never receive your card details.

Other recipients. We also disclose personal information:

1. (a)
   to public authorities, courts and other persons, where we are legally obliged to do so (§10 of the Privacy Policy);
2. (b)
   to an acquirer or successor, as part of a merger, acquisition or other transaction in which it assumes control of all or part of our business, which may use the information only consistently with this notice and the CCPA;
3. (c)
   to recipients to whom you direct us to disclose it, such as an integration you connect to a Workspace (§3 of the Sub-processor List); and
4. (d)
   to Customers, as the result of lookups in our shared caches (clause 2.10(e)).

Disclosures in the last 12 months. In the 12 months before the effective date of this notice, we disclosed each category of personal information described in §2 and §3 for a business purpose to the recipients stated for it there. We did not sell or share personal information.

No sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the 12 months before the effective date of this notice. We do not use advertising or retargeting pixels.

Analytics. Our analytics providers process the information described in clause 2.5 as our service providers, only after you consent and only to provide analytics to us. The same analytics project covers our website and the Service, so your consented activity can be linked across the two; it is not used to track you across unrelated websites.

Shared caches. In our assessment, returning a cached result to a Customer, as the outcome of a lookup that the Customer runs, is not a sale. The published company contact details are information that a company has made available to the general public on its own website, which we treat as publicly available information excluded from personal information by Cal. Civ. Code § 1798.140(v)(2). The Customer pays for the lookup it directs, which the Service would otherwise perform afresh, and not for the information as such.

Minors. We have no actual knowledge that we sell or share the personal information of consumers under 16 years of age. The Service is sold only to businesses and is not directed at children, and we do not knowingly collect the personal information of anyone under 18 (§16 of the Privacy Policy).

Opt-out preference signals. Because we do not sell or share personal information, an opt-out preference signal such as Global Privacy Control has no further effect on our processing. If that changes, we will treat such a signal as a valid request to opt out of sale and sharing.

If our practices change. We will not sell or share personal information that we collected while this notice stated that we do not, unless you give us your affirmative authorisation. Before we begin to sell or share personal information, we will update this notice and provide the "Do Not Sell or Share My Personal Information" link and the other notices the CCPA then requires.

Our role. Customers use the Service to research, import and manage business contacts, keep CRM records, run outreach campaigns from their own mailboxes and connect mailboxes to their Workspaces. The personal information of the people a Customer researches, stores and contacts is Contact Data, which forms part of Customer Data. The Customer decides why and how it is processed, and we process it on the Customer's behalf under the Data Processing Agreement. Where the CCPA applies to that processing, the Customer is the business and we act as its service provider or contractor.

Requests about Customer Data. The Customer, not ManyPI, is responsible for giving you notice of its processing and for responding to your requests. If a Customer contacted you through the Service, or holds your details in its Workspace, send your request to that Customer, for example by replying to the message you received. We cannot ourselves decide to delete or change Customer Data in response to your request, because that decision belongs to the Customer.

Our assistance. If you send such a request to us at privacy@manypi.com, preferably with the message you received, we will:

1. (a)
   identify the Customer whose Workspace holds your information, to the extent the information you provide allows;
2. (b)
   forward your request to that Customer and tell you which Customer is responsible, so that you can pursue your request against it directly;
3. (c)
   where you ask not to be contacted again, add your email address to the suppression list of the Workspace concerned, which blocks further outreach to that address through the Service from that Workspace, and inform the Customer; and
4. (d)
   assist the Customer in responding to your request, as the Data Processing Agreement requires.

Connected mailboxes. Where a User connects a mailbox to a Workspace, we read the headers of every message in the folders on an allowlist, which by default are the inbox and sent items. We download and store the body of a message only where the sender, a recipient or a copied address matches a contact that already exists in the Workspace, and we store bodies truncated. We never store attachments. Synchronised messages are visible to every member of the Workspace. §4 of the Privacy Policy describes this processing in full.

Retention of Customer Data. Customer Data is kept as the Customer decides while its account exists. When the Customer's contract with us ends, the Customer may export Customer Data for 30 days. We then delete it from our production systems, and it is overwritten in backups within 90 days (§13 of the Terms of Service).

Periods by category. We keep each category of personal information for the period stated for it in §2, §3 and §6, and delete it when that period ends. A period runs from the last event that made the information necessary, such as the deletion of your account, the closure of a support matter or the date of an invoice.

Account deletion. When you delete your account, we delete your account data, your organisation data and the lead, CRM, outreach and mailbox data in your Workspace, together with stored credentials and files, except:

1. (a)
   information we must keep by law, principally billing records, which we keep only for that purpose and delete when the statutory period expires; and
2. (b)
   entries in our shared caches (clause 2.10), which are not tied to your account and which we delete on request.

Backups. Information deleted from our production systems remains in encrypted backups until they are overwritten, and in any event for no longer than 90 days. During that period it is used only to restore the Service.

Criteria where no fixed period applies. For analytics events, session recordings, operational events and error diagnostics, a fixed period is not possible. We keep them only while they are needed to analyse usage or investigate faults, taking into account their age and relevance, any unresolved incident and any request for deletion.

Deidentified information. Where we keep aggregated or deidentified information, we take reasonable measures to ensure that it cannot be associated with you, we maintain and use it only in deidentified form, and we do not attempt to reidentify it, except to test whether our deidentification measures meet the requirements of Cal. Civ. Code § 1798.140(m).

Right to know and to access. You may request that we disclose to you:

1. (a)
   the categories of personal information we have collected about you;
2. (b)
   the categories of sources from which we collected it;
3. (c)
   the business or commercial purposes for which we collected it;
4. (d)
   the categories of personal information we disclosed about you for a business purpose, and the categories of persons to whom we disclosed it; and
5. (e)
   the specific pieces of personal information we have collected about you.

Period covered. We provide the personal information we have collected about you on or after 1 January 2022, including information collected more than 12 months before we received your request, unless providing it proves impossible or would involve disproportionate effort. In that case we explain why, and we provide at least the personal information collected in the 12 months before we received your request.

Form of disclosure. We provide specific pieces of personal information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit them to another entity. For security reasons we do not disclose your password hash or the credentials of a connected mailbox, but we tell you that we hold them.

Right to delete. You may request that we delete personal information that we have collected from you. When we receive a verified request, we delete the information, or deidentify or aggregate it, and notify our service providers and contractors to delete it as well, unless an exception in Cal. Civ. Code § 1798.105(d) applies. In particular, we may keep information that is reasonably necessary to:

1. (a)
   complete the transaction for which it was collected, provide a service you requested or otherwise perform a contract between you and us;
2. (b)
   help to ensure security and integrity, to the extent the use is reasonably necessary and proportionate;
3. (c)
   debug to identify and repair errors that impair existing intended functionality; or
4. (d)
   comply with a legal obligation, such as the retention of invoices and accounting records under German law.

Response to a deletion request. If we deny a deletion request in whole or in part, we explain the basis for the denial, delete the information that is not covered by the exception, and use the information we keep only for the purpose of that exception. Information in backups is deleted when the backups are overwritten (clause 7.3); if we restore a backup before then, we apply your request to the restored information.

Right to correct. You may request that we correct inaccurate personal information we hold about you. You can change your profile details yourself in your account settings. We use commercially reasonable efforts to correct information, taking into account its nature and the purposes for which we process it, and we may ask you for documentation where that is necessary to assess its accuracy. If we decline a request, we explain why.

Right to opt out of sale and sharing. You have the right to direct a business that sells or shares your personal information to stop doing so. We do not sell or share personal information (§5), so there is nothing to opt out of, and we do not provide a "Do Not Sell or Share My Personal Information" link. If you send us an opt-out request nonetheless, we record it and will apply it if our practices change.

Right to limit the use of sensitive personal information. You have the right to limit a business's use and disclosure of your sensitive personal information to the purposes permitted by the CCPA. We use and disclose sensitive personal information only for those purposes (clause 3.2), so this right does not apply.

Non-discrimination. We will not discriminate or retaliate against you for exercising a right under the CCPA. In particular, we will not, because you exercised a right, deny you the Service, charge you a different price or rate, provide you with a different level or quality of service, or suggest that you will receive a different price, rate, level or quality.

No financial incentives. We offer no financial incentive, and no price or service difference, related to the collection, retention or sale of personal information. The Free Plan and the Paid Plans differ in price, allocation and functions. Which Plan is available to you does not depend on whether you allow us to collect, retain or sell personal information, or on whether you exercise your rights.

Automated decision-making. We do not use automated decision-making technology to make significant decisions about consumers, such as decisions about financial or lending services, housing, education, employment or healthcare. The scoring and ranking of contacts in the Service supports a User's own prioritisation, and §8 of the Terms of Service prohibits using the Service to make decisions of that kind.

How to submit a request. You, or an authorised agent acting for you, may submit a request under this notice:

1. (a)
   by email to privacy@manypi.com, preferably with "CCPA request" in the subject line; or
2. (b)
   by post to ManyPI, Ole Nepomuk Mai, Goethestrasse 70, 10625 Berlin, Federal Republic of Germany.

Self-service. If you have an account, you can also export your data and delete your account in the account settings, and change your marketing preferences in the notification settings.

What to include. Your request should state your name; the email address you use with us or, if you do not use the Service, the email address or other details your request concerns; the right you wish to exercise; and enough detail for us to understand and respond to the request.

Confirmation and response times. We confirm receipt of a request to know, delete or correct within 10 business days, and tell you how we will verify it and when you can expect a response. We respond within 45 calendar days of receiving the request, however long verification takes. Where reasonably necessary, we may extend that period once by up to 45 further calendar days; if we do, we tell you within the first 45 days, with the reason. Where the GDPR applies and requires a shorter period, we respond within that period (clause 1.6).

Fees. We do not charge for responding to a request. If requests from you are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act on them, and we will tell you why.

Verification. Before we act on a request to know, delete or correct, we verify your identity by matching information you give us with information we already hold, in accordance with §§ 7060 to 7062 of the CCPA Regulations:

1. (a)
   if you have an account, we verify you through it, for example by asking you to send or confirm the request from the email address of your account, and we may ask you to authenticate again before we disclose or delete information;
2. (b)
   if you do not have an account and request the categories of personal information we hold, we require at least two reliable data points to match;
3. (c)
   if you do not have an account and request specific pieces of personal information, we require at least three reliable data points to match, together with a declaration signed by you under penalty of perjury that you are the consumer whose personal information is requested;
4. (d)
   if you do not have an account and request deletion or correction, we require at least two or three reliable data points to match, depending on the sensitivity of the information and the risk of harm that an unauthorised request would cause; and
5. (e)
   if we cannot verify your identity to the required degree, we tell you why, and we treat a request for specific pieces of personal information as a request for the categories.

Use of verification information. We use information you give us for verification only to verify your identity or authority and to keep the records required by § 7101 of the CCPA Regulations, and we delete it as soon as practical after responding. We do not charge for verification, and we do not require you to create an account.

Authorised agents. An authorised agent, which may be a natural person or a business entity, may submit a request to know, delete or correct on your behalf. Under § 7063 of the CCPA Regulations, we may require the agent to provide proof that you gave it signed permission to submit the request, and we may also require you to verify your own identity directly with us or to confirm directly with us that you gave that permission. These requirements do not apply where you have given the agent a power of attorney under California Probate Code §§ 4121 to 4130. We may deny a request from an agent that does not provide proof of its authority.

Complaints. You may raise a concern about our handling of a request at privacy@manypi.com, but you do not have to contact us first. You may also file a complaint with the California Attorney General (oag.ca.gov) or with the California Privacy Protection Agency (cppa.ca.gov).

Changes to this notice. We review this notice at least once every 12 months and update it when our practices or the applicable law change. The version and effective date at the top of this notice show when it was last updated. We do not collect additional categories of personal information, or use personal information for purposes incompatible with those described in this notice, without first updating it.

Accessibility. If you need this notice in another format because of a disability, contact us at privacy@manypi.com.

Contact. Questions about this notice and requests under it may be sent:

1. •
   by email: privacy@manypi.com
2. •
   by post: ManyPI, Ole Nepomuk Mai, Goethestrasse 70, 10625 Berlin, Federal Republic of Germany