California privacy supplement

About this document

Version history

1. Scope

This supplement describes Alessia's privacy practices for California residents and supplements our Privacy Notice. Some rights described below apply as statutory CCPA rights only where Alessia or the relevant Institution is subject to the CCPA. Alessia nevertheless voluntarily provides its core access, correction and deletion routes to California residents, subject to the exceptions described in our Privacy Notice.

Where an Institution controls portfolio information, the Institution may be the relevant business and Alessia may act as its service provider or contractor. Requests concerning that information will normally be handled by the Institution with Alessia's assistance.

2. Notice at collection

Depending on how a person uses Alessia, we may collect the following categories of personal information.

Sources include the individual, their device, an Institution, people providing assessments or evidence, app stores/payment providers, identity providers and publicly available professional sources where lawful. Recipient categories are described in the Privacy Notice; the current provider entities and roles are maintained in the Subprocessor and Service-provider List.

Alessia will not collect additional categories or use information for materially incompatible purposes without providing the notice required by California law.

3. Sale, sharing and financial incentives

Alessia does not sell personal information or share it for cross-context behavioural advertising. During the preceding 12 months, Alessia has not sold or shared any category of personal information.

Depending on the features used, Alessia discloses relevant categories listed in section 2 to service providers and contractors for the business purposes described in that section. Those recipients are subject to applicable contractual restrictions.

Alessia does not offer a financial incentive or a difference in price or service in exchange for personal information.

Where Alessia maintains deidentified or aggregate consumer information, it takes reasonable measures to prevent the information from being associated with a consumer or household. Alessia publicly commits to maintain and use it in deidentified or aggregate form and not to attempt to re-identify it, except for controlled testing of deidentification safeguards where California law permits. Before disclosing it to a recipient, Alessia will contractually require the recipient to maintain the information in deidentified or aggregate form, not attempt to re-identify it except for permitted testing, and use it only for the authorised purposes. Such information may be used only for the purposes described in the core Privacy Notice, including the restricted anonymous AI-improvement purpose described there.

4. California rights

Where the CCPA applies and subject to exceptions, a California resident may request:

• the categories and specific pieces of personal information collected;
• the sources, business/commercial purposes and categories of recipients;
• deletion;
• correction;
• opt-out of sale or sharing;
• limitation of use/disclosure of sensitive personal information where that right applies;
• information about, and opt out of, a covered use of automated decision-making technology where California law provides that right;
• information about financial incentives, if introduced; and
• equal service and freedom from unlawful discrimination for exercising a CCPA right.

An authorised agent may submit a request subject to lawful verification of authority and, where permitted, the resident's identity. Alessia will honour a recognised opt-out preference signal such as Global Privacy Control where required.

Alessia uses and discloses sensitive personal information only for purposes permitted by section 7027(m) of the CCPA regulations - providing the requested service, security, quality and legal compliance - and does not use it to infer characteristics about a consumer; the right to limit therefore does not currently apply. Alessia accepts requests by email because it operates exclusively online and has a direct relationship with the consumers whose information it holds.

5. Submitting and verifying requests

Submit a request by email to privacy@alessiahq.com with subject “California Privacy Request”, using the privacy complaints page where helpful.

You do not need an Alessia account to submit a privacy request.

Alessia will verify requests proportionately and will not ask for more personal information than needed. It will confirm receipt and respond within the CCPA periods that apply at the time - currently confirmation within 10 business days and a substantive response within 45 calendar days, with one additional 45-day period where reasonably necessary and notified.

If an Institution is the business controlling the information, Alessia will direct the request to it and assist as service provider/contractor.

6. Minors

Alessia accounts are restricted to people aged 18 or over. We do not knowingly allow anyone under 18 to create or use an account, and we do not knowingly sell or share the personal information of anyone under 18.

7. Contact

For California privacy questions or requests, email privacy@alessiahq.com. Use the subject “California Privacy Request” for a rights request.