Privacy Policy

This Privacy Policy for Green Canyon AI LLC, doing business as Green Canyon (“we,” “us,” or “our”), describes how and why we access, collect, store, use, and share (“process”) your personal information when you use our services (the “Services”), including when you:

• Visit our websites at greencanyon.ai or gcapps.ai, or any website of ours that links to this Privacy Policy;

• Communicate with us, request information from us, or engage us for consulting, development, training, or related professional services; or

• Engage with us in other related ways, including sales, marketing, or events.

Reading this Privacy Policy will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you have questions or concerns, contact us at matt@greencanyon.ai.

Summary of Key Points

• What personal information do we process? We process personal information you provide directly (such as contact details and payment information), information collected automatically when you use our websites (such as device and usage data), and information processed in connection with professional-services engagements.

• Do we process sensitive personal information? We do not intentionally collect sensitive personal information for our own purposes, and we ask that you not submit it to us through our websites.

• How do we process your information? To provide, improve, and administer the Services, deliver professional services, communicate with you, market our services, maintain security and prevent fraud, and comply with law.

• Do we share personal information? We share information with service providers that support our business, including cloud, data-storage, payment, and AI platform providers, and in connection with business transfers, legal compliance, and with your consent. We do not sell personal information.

• Do we use AI? Yes. Some of our tools and services are powered by third-party AI providers, and information you submit to AI-powered features may be processed by those providers, as described in Section 6.

• What are your rights? Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. See Sections 11–13.

• How do you exercise your rights? Email us at matt@greencanyon.ai. We will consider and act upon any request in accordance with applicable data protection laws.

1. What Information Do We Collect?

Personal information you disclose to us

We collect personal information that you voluntarily provide when you fill out a contact or intake form, register for an account (where offered), request a consultation, audit, or proposal, subscribe to communications, participate in activities on the Services, engage us for professional services, or otherwise contact us. This may include:

• Names, email addresses, phone numbers, and mailing addresses;

• Company names, job titles, and other professional information;

• Usernames and account credentials (where accounts are offered);

• The contents of messages, forms, and files you choose to send us, including information about your business, systems, and workflows submitted in connection with a consultation, audit, or engagement; and

• Billing and transaction information.

Payment Data. If you make a purchase, payment is processed by our third-party payment processor, Stripe. We do not store full payment card numbers; payment data is handled and stored by Stripe in accordance with its privacy policy.

Sensitive Information. We do not intentionally collect sensitive personal information (such as government identifiers, health information, biometric data, or precise geolocation) for our own purposes, and we ask that you not submit it through our websites. If an engagement requires the processing of sensitive or regulated data, that processing will be governed by the applicable services agreement.

Social Media Login Data. Where we offer registration through a third-party social or identity provider, we will receive certain profile information from that provider (often name, email address, and profile picture), as described in Section 7.

All personal information you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

When you visit our websites, we and our service providers automatically collect certain information from your device, which may include IP address, browser and device characteristics, operating system, referring URLs, pages viewed, links clicked, date/time stamps, and other usage and diagnostic data. This information is collected through server logs, cookies, and similar technologies, is used primarily to operate and secure the Services and understand how they are used, and may be associated with you where required for those purposes. See Section 8 (Cookies and Tracking Technologies).

Information processed in client engagements

When we perform professional services, such as building automations, developing software, conducting training, or performing audits, e may process personal information contained in the data, systems, and accounts our clients give us access to. In those cases, we process that information on the client’s behalf and under the client’s instructions pursuant to a services agreement, and the client’s own privacy policy governs that data. If you believe your personal information has been processed by us on behalf of one of our clients and you wish to exercise privacy rights in that information, please direct your request to that client; we will assist our clients in responding as required by our agreements and applicable law.

Google API

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. How Do We Process Your Information?

We process your personal information for the following purposes, depending on how you interact with the Services:

• To deliver and facilitate the Services, including responding to inquiries, preparing proposals and audits, performing engagements, and providing requested features and tools;

• To manage accounts, including creating and authenticating accounts and keeping them in working order, where accounts are offered;

• To communicate with you, including administrative messages about our services, changes to our terms and policies, and responses to your requests;

• For marketing, including sending newsletters and information about services we think may interest you, subject to your right to opt out at any time;

• For billing and administration, including invoicing, payment processing, accounting, and enforcing our agreements;

• To improve the Services, including analyzing usage, diagnosing problems, and developing new features and offerings;

• For security and fraud prevention, including monitoring for, preventing, and investigating security incidents and misuse;

• To comply with law, including responding to lawful requests, establishing and defending legal claims, and meeting regulatory obligations; and

• To protect vital interests, such as preventing harm to an individual.

3. What Legal Bases Do We Rely On?

We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law. If you are located in the EEA or UK, the GDPR and UK GDPR require us to explain the legal bases we rely on:

• Consent. Where you have given us permission to process your personal information for a specific purpose. You can withdraw consent at any time.

• Performance of a contract. Where processing is necessary to fulfill our contractual obligations to you or to take steps at your request before entering into a contract.

• Legitimate interests. Where processing is reasonably necessary to achieve our legitimate business interests, such as operating, securing, and improving the Services and marketing to business contacts, and those interests are not outweighed by your interests and fundamental rights.

• Legal obligations. Where processing is necessary for compliance with our legal obligations.

• Vital interests. Where processing is necessary to protect your vital interests or those of a third party.

If you are located in Canada, we process your information with your express consent or in situations where consent can be implied, and you may withdraw consent at any time, subject to applicable law.

4. When and With Whom Do We Share Your Personal Information?

We may share personal information with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to the information to do that work. We have contracts in place with these parties designed to safeguard your personal information, and they are not permitted to use it for their own purposes except as permitted by law. The categories of third parties with whom we may share personal information include:

• Cloud computing and hosting providers;

• AI platform providers (see Section 6);

• Data storage and backup providers;

• Payment processors (Stripe);

• Analytics, communications, scheduling, and customer-relationship-management providers; and

• Professional advisors, such as lawyers, accountants, and insurers, where necessary.

We may also disclose personal information: (i) in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business (a “Business Transfer”); (ii) to our affiliates, who will be required to honor this Privacy Policy; (iii) to comply with law, legal process, or enforceable governmental requests, or to establish, exercise, or defend legal claims; (iv) to protect the rights, property, or safety of Green Canyon, our clients, or others; and (v) with your consent or at your direction.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

5. How Long Do We Keep Your Information?

We keep personal information only for as long as necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). In determining retention periods, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes of processing and whether we can achieve them by other means, and applicable legal requirements. When we no longer have an ongoing legitimate business need to process your personal information, we will delete or anonymize it or, if that is not possible (for example, because it is stored in backup archives), we will securely store it and isolate it from further processing until deletion is possible. Client engagement data is retained and returned or destroyed as provided in the applicable services agreement.

6. Do We Offer Artificial Intelligence-Based Products?

Yes. As part of our Services, we offer and build products, features, and tools powered by artificial intelligence, machine learning, and similar technologies (collectively, “AI Products”).

Use of AI technologies. We provide AI Products through third-party AI service providers, which may include Anthropic, Google Cloud AI, OpenAI, and Perplexity (“AI Service Providers”). When you use an AI Product, your inputs, outputs, and associated personal information may be shared with and processed by the applicable AI Service Providers to enable the feature. You must not use AI Products in any way that violates the terms or policies of any AI Service Provider.

What you should not submit. Do not submit sensitive personal information, confidential information of third parties, or information you are not authorized to share to any AI Product unless a written agreement with us expressly provides for it.

How we process your data using AI. Personal information processed through our AI Products is handled in accordance with this Privacy Policy and our agreements with the AI Service Providers. We use commercially reasonable efforts to configure AI Service Provider offerings so that data submitted through our AI Products is not used by those providers to train their generally available models, where such configurations are offered. AI-generated output may be inaccurate and should be reviewed before you rely on it.

7. How Do We Handle Your Social Logins?

Where the Services offer registration or login through a third-party social or identity provider, we will receive certain profile information about you from that provider. The information we receive varies by provider but often includes your name, email address, and profile picture, along with other information you choose to make public on the platform. We use this information only for the purposes described in this Privacy Policy or otherwise made clear to you on the relevant Services. We do not control, and are not responsible for, how your social media provider processes your personal information, and we recommend you review its privacy notice.

8. Cookies and Tracking Technologies

We and our service providers may use cookies, pixels, local storage, and similar technologies to operate the Services, remember your preferences, maintain security, and understand how the Services are used. These may include strictly necessary cookies (required for the Services to function), functional cookies (which remember your choices), and analytics cookies (which help us understand usage). You can control cookies through your browser settings, and most browsers allow you to refuse or delete cookies; if you disable cookies, some features of the Services may not function properly. Where required by applicable law, we will request your consent before setting non-essential cookies.

Do-Not-Track. Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature or setting. No uniform technology standard for recognizing and implementing DNT signals has been finalized, and we do not currently respond to DNT browser signals. If a standard is adopted that we must follow, we will inform you in a revised version of this Privacy Policy. To the extent applicable law treats certain browser-based signals (such as the Global Privacy Control) as a valid opt-out request, we will honor them as required.

9. How Do We Keep Your Information Safe?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of the personal information we process, appropriate to the nature of the information and the risks involved. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Transmission of personal information to and from the Services is at your own risk, and you should access the Services only within a secure environment.

10. Do We Collect Information from Minors?

The Services are intended for business users and adults. We do not knowingly collect, solicit data from, or market to children under 18 years of age. By using the Services, you represent that you are at least 18. If we learn that we have collected personal information from a user under 18, we will take reasonable measures to promptly delete it. If you become aware of any data we may have collected from anyone under 18, please contact us at matt@greencanyon.ai.

11. What Are Your Privacy Rights?

Depending on your state or country of residence, including the EEA, UK, Switzerland, and Canada, you may have rights under applicable data protection laws, which may include the right: (i) to request access to and obtain a copy of your personal information; (ii) to request rectification or erasure; (iii) to restrict or object to the processing of your personal information; (iv) to data portability, if applicable; and (v) not to be subject to automated decision-making producing legal or similarly significant effects. We will consider and act upon any request in accordance with applicable law. If we rely on your consent to process your personal information, you may withdraw consent at any time by contacting us, without affecting the lawfulness of processing before withdrawal.

Account information. If accounts are offered and you would like to review, change, or terminate your account, you may do so through your account settings or by contacting us. Upon a termination request, we will deactivate or delete your account and information from our active databases, though we may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, and comply with legal requirements.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your local data protection supervisory authority; in Switzerland, to the Federal Data Protection and Information Commissioner.

12. Do United States Residents Have Specific Privacy Rights?

If you are a resident of a US state with a comprehensive privacy law (including, among others, California, Colorado, Connecticut, Texas, Utah, and Virginia), you may have the right to request access to and details about the personal information we maintain about you and how we have processed it, correct inaccuracies, obtain a copy, or delete your personal information, and to opt out of targeted advertising, sales of personal data, or certain profiling. These rights may be limited by applicable law.

Categories of personal information we collect

The table below describes the categories of personal information we have collected in the past twelve (12) months, using categories drawn from California law:

Your rights

• Right to know whether we are processing your personal data;

• Right to access your personal data;

• Right to correct inaccuracies in your personal data;

• Right to request deletion of your personal data;

• Right to obtain a copy of the personal data you previously shared with us;

• Right to non-discrimination for exercising your rights; and

• Right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal data or process it for targeted advertising.

How to exercise your rights

To exercise these rights, email us at matt@greencanyon.ai or use the contact details at the bottom of this Privacy Policy. We may need to verify your identity before responding, and we will respond within the timeframes required by applicable law. You may designate an authorized agent to make a request on your behalf, subject to verification requirements.

Appeals

Under certain US state data protection laws, if we decline to take action on your request, you may appeal our decision by emailing us at matt@greencanyon.ai. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation. If your appeal is denied, you may submit a complaint to your state attorney general.

13. International Transfers

We are based in the United States, and the Services are operated from the United States. If you access the Services from outside the United States, your personal information will be transferred to, stored, and processed in the United States and in other jurisdictions where we or our service providers operate, which may have data protection laws different from those of your jurisdiction. Where required by applicable law, we implement appropriate safeguards for such transfers, such as standard contractual clauses.

14. Do We Make Updates to This Policy?

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated “Last updated” date at the top of this Privacy Policy. If we make material changes, we may notify you by prominently posting a notice of the changes or by sending you a direct notification. We encourage you to review this Privacy Policy frequently.

15. How Can You Contact Us About This Policy?

If you have questions or comments about this Privacy Policy, or wish to review, update, or delete the personal information we have collected from you, you may email us at matt@greencanyon.ai or contact us by post at:

Green Canyon AI LLC

24285 Katy Freeway, Suite 300-1031, Katy, TX 77494