California Consumer Privacy Act (CCPA) Disclosure

Effective Date: May 1, 2025 Last Updated: April 15, 2026

This disclosure supplements Numbra's Privacy Policy with information specific to California residents under the California Consumer Privacy Act of 2018 ("CCPA"), as amended by the California Privacy Rights Act of 2020 ("CPRA"), and related California privacy laws.

1. Scope

This disclosure applies to:

• California residents who use Numbra as Bookkeepers (Subscribers)
• California residents who interact with Numbra as Client End-Users (clients of our Bookkeeper Subscribers)
• California residents who visit our website (numbra.tech)

If you are not a California resident, this disclosure does not apply to you (though the general Privacy Policy does).

2. Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information from California residents:

Sensitive Personal Information

We collect Sensitive Personal Information (SPI) as defined by CPRA only as necessary to provide the Service:

• Account credentials: required for authentication; passwords hashed Argon2id, MFA secrets encrypted
• Financial account info: bank account and routing numbers for bookkeeping operations and ACH billing, encrypted at rest (AES-256-GCM)

We use SPI only for the purposes you would reasonably expect based on the Service we provide (authentication, financial processing, security). We do not use SPI to infer characteristics or for advertising.

You have the right to limit our use of SPI to these purposes. See Section 7 below.

3. Purposes of Collection

We collect personal information for the following business and commercial purposes:

• Provide and operate the Service (account management, financial data processing, reporting)
• Authenticate users and prevent fraud
• Process payments and billing
• Communicate with you (transactional, security alerts, support, opt-in marketing)
• Improve the Service (debugging, analytics on aggregated data)
• Comply with legal obligations (FTC Safeguards Rule, tax laws, lawful requests)
• Enforce our Terms of Service

4. Categories of Third Parties We Share Personal Information With

We share personal information with the following categories of third parties:

A complete list of sub-processors is maintained in our Privacy Policy Section 4.1.

5. Sale of Personal Information

We do NOT sell your personal information for monetary or other valuable consideration, as defined by CCPA.

We do not share personal information for cross-context behavioral advertising.

6. Retention of Personal Information

We retain personal information for as long as necessary to fulfill the purposes described in our Privacy Policy, including:

• Active account data: duration of subscription + 90 days after cancellation
• Financial records (transactions, statements, audit logs): 7 years (FTC Safeguards Rule and standard accounting record retention)
• Billing records: 7 years (tax and audit requirements)
• Backups: 35 days rolling retention
• Marketing communications opt-in records: until withdrawn

7. Your California Privacy Rights

As a California resident, you have the following rights:

7.1 Right to Know

You may request that we disclose:

• The specific pieces of personal information we have collected about you
• The categories of personal information collected
• The categories of sources from which we collected it
• The business or commercial purpose for collecting it
• The categories of third parties with whom we share it

We will respond within 45 days (extendable by 45 additional days with notice).

7.2 Right to Delete

You may request that we delete personal information we have collected from you, subject to certain exceptions (e.g., financial records we are required to retain by law).

If we cannot delete certain information due to legal exceptions, we will inform you of the reason and delete what we can.

7.3 Right to Correct

You may request that we correct inaccurate personal information we hold about you.

7.4 Right to Opt-Out of Sale or Sharing

We do not sell or share personal information, so there is no need to opt out. However, you may submit a request to confirm this status at any time.

7.5 Right to Limit Use of Sensitive Personal Information

You may request that we limit our use of your Sensitive Personal Information to:

• Performing the services or providing the goods you reasonably expect
• Detecting security incidents
• Resisting malicious, deceptive, or illegal actions
• Ensuring physical safety
• Short-term, transient use (excluding profiling)
• Performing services on our behalf (sub-processors)
• Verifying or maintaining the quality and safety of the Service

Note: limiting use of authentication credentials or financial account info would prevent us from providing the Service. We will work with you to find an alternative or explain why we cannot fulfill the request.

7.6 Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights. We will not:

• Deny goods or services
• Charge different prices or rates
• Provide different quality of service
• Suggest different prices or quality based on your rights exercise

7.7 Right to Data Portability

When you exercise your right to know, you may request your information in a portable, machine-readable format (JSON or CSV).

8. How to Exercise Your Rights

8.1 Submit a Request

To exercise any rights described above, submit a request via one of:

• Email: contact@elgada.tech with subject line "CCPA Request"

Please include:

• Your full name
• Email address associated with your Numbra account (if applicable)
• The specific right you are exercising
• A clear description of your request

8.2 Verification

To protect your privacy, we will verify your identity before fulfilling certain requests. Verification methods:

• For account holders: log in with your credentials and confirm via email + MFA
• For non-account holders: provide additional information matching what we have on file (e.g., recent transaction details if you are a Client End-User of a Bookkeeper using Numbra)

We will not fulfill requests if we cannot reasonably verify your identity.

8.3 Response Time

• Acknowledgment of request: within 10 business days
• Substantive response: within 45 days (extendable by 45 days with notice to you)
• Free of charge (except in cases of repeated or excessive requests)

9. Authorized Agents

You may designate an authorized agent to make requests on your behalf. The agent must:

• Provide signed written authorization from you, OR
• Have a valid Power of Attorney under California Probate Code §§ 4000-4465

We may still ask you to verify your identity directly with us or confirm with us that you provided the agent with permission.

10. Minors

Numbra is not intended for users under 18. We do not knowingly collect or sell personal information of minors under 16. If you believe we have inadvertently collected information of a minor, contact us at contact@elgada.tech for prompt deletion.

11. Shine the Light (California Civil Code § 1798.83)

California residents may request information about disclosures of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes, so we have nothing to report under this law.

12. Do Not Sell or Share My Personal Information

As stated in Section 5, we do not sell or share personal information. Therefore, we do not provide a "Do Not Sell or Share My Personal Information" link, as it is not applicable.

If our practices change, we will update this disclosure and provide an opt-out mechanism.

13. Changes to This Disclosure

We may update this CCPA Disclosure to reflect changes in law or our practices. Updates will be reflected in the "Last Updated" date.

For material changes affecting California residents:

• We will notify you via email at least 30 days before changes take effect
• We will not retroactively apply new practices to data collected under prior versions without your consent (where consent is required)

14. Contact

For CCPA-related questions or to submit a request:

ELGADA Email: contact@elgada.tech Subject: "CCPA Request"

For general privacy inquiries, see our Privacy Policy.

Numbra is committed to honoring California residents' privacy rights and complying with the CCPA, CPRA, and related California privacy laws.