Privacy Policy

Last Updated: April 21, 2026 · Version 2.0

Varneli LLC, a Florida limited liability company d/b/a Geniri ("Geniri," "we," "us," or "our"), respects your privacy and is committed to protecting your Personal Data. This Privacy Policy explains how we collect, use, disclose, and safeguard Personal Data when you visit https://geniri.ai, create an account, subscribe to our communications, or use our products and services (collectively, the "Service").

1. Who We Are

When Geniri Processes Personal Data on behalf of a customer using the Service (for example, contact information of that customer's prospects), Geniri acts as a data processor, and the customer acts as the data controller. That Processing is governed by the Data Processing Addendum (DPA) and by the customer's own privacy notice.

2. Scope

This Privacy Policy applies to Personal Data we collect and Process as a data controller, including Personal Data of: visitors to our website; prospective and current customers, account holders, and Users of the Service; recipients of our own marketing communications; and business contacts (vendors, partners, applicants, event participants). This Privacy Policy does NOT apply to Personal Data that customers upload to or process through the Service about their own contacts, leads, or recipients.

3. Personal Data We Collect

3.1 Information You Provide

• Account information: name, email, password (hashed), company, job title, phone number
• Billing information: billing contact, billing address, VAT/tax ID, limited payment-card metadata (full card data is processed by Stripe, not stored by Geniri)
• Communications: support messages, feedback, survey responses
• Marketing preferences: subscription status, event registrations
• Identity verification where required for fraud prevention or regulatory compliance

3.2 Information Collected Automatically

• Technical and usage data: IP address, device identifiers, browser type, operating system, language, referring URLs, pages viewed, timestamps, session duration
• Cookies and similar technologies (see Section 8 and our Cookie Policy)
• Log data: errors, security events, API calls

3.3 Information from Third Parties

• Identity and contact data from publicly available sources, data-enrichment services, and integration partners
• Single-sign-on provider data (Google, Microsoft) when you authenticate
• Payment processor information regarding transactions and disputes

3.4 B2B Contact Data from Third-Party Sources

As part of the Service, Geniri aggregates professional and business contact information from licensed third-party data providers (including Apollo.io) and publicly available sources. This information may include names, job titles, business email addresses, company names, company addresses, industry, company size, and professional social-media profile URLs. We make this data available to our business customers through the Service for legitimate B2B sales and marketing purposes. The legal basis under GDPR is our legitimate interest (Article 6(1)(f)), supported by a documented Legitimate Interest Assessment. Under CCPA/CPRA, making this data available to our customers in exchange for credits or tokens constitutes a "sale" of Personal Information as defined in Section 1798.140(ad).

If you are a data subject whose professional information appears in our database and you wish to access, correct, or delete your data, or opt out of its inclusion, please contact us at privacy@geniri.ai or use the Do Not Sell My Personal Information form. We will process your request within 30 days and add your information to our permanent suppression list to prevent future inclusion.

3.5 Sensitive Personal Data

We do not knowingly collect special categories of Personal Data under GDPR Article 9 (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data), or sensitive Personal Data under LGPD or CCPA/CPRA. Please do not submit such data to us unless expressly requested.

4. How We Use Personal Data

Purpose	GDPR Legal Basis
Provide, operate, and maintain the Service	Contractual necessity (Art. 6(1)(b))
Authenticate Users and secure the Service	Contractual necessity; legitimate interest (security)
Process payments and manage subscriptions	Contractual necessity; legal obligation
Service announcements and support communications	Contractual necessity; legitimate interest
Marketing communications (where permitted)	Consent or legitimate interest, with opt-out
Improve, develop, analyze the Service	Legitimate interest
Prevent fraud, abuse, security incidents	Legitimate interest; legal obligation
Comply with Applicable Law and legal requests	Legal obligation

5. How We Share Personal Data

We share Personal Data with the following categories of recipients, subject to appropriate safeguards:

• Service providers (Sub-processors): cloud hosting, email delivery, analytics, monitoring, payment processing, customer support, AI inference. A current list is at legal@geniri.ai
• Professional advisors: lawyers, accountants, auditors under confidentiality obligations
• Affiliates and corporate successors in connection with a merger, acquisition, financing, restructuring, or sale of assets
• Government authorities, courts, law-enforcement agencies where required by law
• Integration partners when you direct us to share or use integrations requiring sharing

As described in Section 3.4, we make B2B professional contact data available to our business customers through the Service in exchange for credits or tokens. Under CCPA/CPRA, this constitutes a sale of Personal Information. We do not share Personal Data for cross-context behavioral advertising. For information about opting out of the sale of your Personal Information, see Section 14.3 and our Do Not Sell My Personal Information form.

6. International Data Transfers

We are based in the United States, and our Sub-processors may be located in the United States and other jurisdictions. Where Personal Data originating from the European Economic Area, United Kingdom, Switzerland, Brazil, or another jurisdiction with cross-border transfer restrictions is transferred to us or our Sub-processors, we rely on:

• European Commission Standard Contractual Clauses (SCCs, Decision 2021/914)
• UK International Data Transfer Addendum
• Swiss addendum to the SCCs
• Supplementary technical and organizational measures (see Annex II of our DPA)
• Transfer Impact Assessments where required (Schrems II principles)

You may request a copy of the applicable SCCs by emailing privacy@geniri.ai.

7. Data Retention

Data Type	Retention Period
Account information	Duration of account + 30 days
Billing records	7 years (legal obligation)
Conversation / campaign history	As configured by customer; default 30 days after termination
Server logs	90 days
Audit trail (security, compliance)	Up to 36 months
Suppression list entries	Permanent (to prevent re-inclusion)

8. Cookies and Similar Technologies

We use cookies, pixels, local storage, and similar technologies ("Cookies"). We use: strictly necessary cookies (required); functional cookies (preferences); analytics cookies (usage measurement); and marketing cookies (subject to consent). You can manage cookie preferences through our cookie banner and browser settings. We honor Global Privacy Control (GPC) signals as a valid opt-out request under CCPA/CPRA. See our Cookie Policy for details.

9. Your Privacy Rights

Depending on your location and Applicable Law, you have the following rights:

• Access: request information about the Personal Data we hold about you
• Rectification: correct inaccurate or incomplete Personal Data
• Erasure ("right to be forgotten"): request deletion of Personal Data, subject to legal exceptions
• Restriction: restrict Processing in certain circumstances
• Portability: receive Personal Data in a structured, commonly used, machine-readable format
• Objection: object to Processing based on legitimate interests, including direct marketing
• Withdrawal of consent at any time, without affecting the lawfulness of prior Processing
• Lodging a complaint with a Supervisory Authority
• Non-discrimination for exercising your rights (CCPA/CPRA)
• Opt-out of sale/sharing (California; use our Do Not Sell form or GPC)

To exercise your rights, email privacy@geniri.ai. We may need to verify your identity. Response times: 30 days (GDPR, extendable), 45 days (CCPA), 15 days (LGPD).

10. Security

We implement appropriate technical and organizational measures to protect Personal Data, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, multi-factor authentication for personnel, logging and monitoring, and periodic security testing (see our Security Policy). We notify affected customers of Personal Data Breaches without undue delay and within 72 hours (GDPR Art. 33) of becoming aware.

11. Children's Privacy

The Service is intended for businesses and professionals. We do not knowingly collect Personal Data from children under sixteen (16). If you believe we have collected data from a child, contact privacy@geniri.ai.

12. Third-Party Links and Services

The Service may contain links to third-party websites or services not operated by Geniri. We do not control, and are not responsible for, the privacy practices of those third parties.

13. Automated Decision-Making and AI

The Service includes AI-assisted features powered by third-party AI platforms (currently OpenAI, Anthropic, Google Gemini, and Perplexity). These features include content generation, email drafting, workflow automation, and conversational AI. When you use AI features, relevant data is transmitted to the applicable AI provider.

We use enterprise and API-tier services under which your data is not used to train foundation models. Our agreements prohibit the use of customer data for model training. We do not use AI features to make decisions producing legal or similarly significant effects on you based solely on automated processing.

You may opt out of AI-based processing by disabling AI features in your workspace settings or by contacting privacy@geniri.ai.

14. Region-Specific Notices

14.1 European Economic Area, United Kingdom, Switzerland (GDPR/UK GDPR/FADP)

We Process your Personal Data in accordance with GDPR, UK GDPR, and the Swiss FADP. The legal bases we rely on are described in Section 4. If you are in the EEA, UK, or Switzerland, you may contact our EU Representative (once appointed under Article 27 GDPR) or our privacy team at privacy@geniri.ai. You may lodge a complaint with your local Supervisory Authority.

14.2 Brazil (LGPD)

We Process Personal Data of individuals in Brazil in accordance with LGPD. We rely on legitimate interest (Article 7(IX)) or consent where required. You have the rights to: confirmation, access, correction, anonymization/blocking/deletion, data portability, deletion of consent-based data, information about third parties, and revocation of consent. Contact privacy@geniri.ai. We respond within 15 days. Complaints may be submitted to the Autoridade Nacional de Proteção de Dados (ANPD).

14.3 California (CCPA/CPRA)

California residents are entitled to the rights described in Section 9. In the preceding twelve (12) months, we have collected, disclosed for a business purpose, and sold the following categories of Personal Information:

• Identifiers (name, email, IP address)
• California Customer Records information (name, address, phone, employment information)
• Professional or employment-related information (job title, company name)
• Internet or other electronic network activity information (browsing history, Service interactions)
• Inferences drawn from the above (professional profiles, lead scores)
• Geolocation data (approximate location based on IP address)

We sell the following categories of Personal Information to our business customers (subscribers of the Service) for B2B sales and marketing purposes: identifiers (names, business email addresses), professional information (job titles, company names), and inferences (seniority level, department classification, industry). The consideration for this sale is credits or tokens purchased by our customers.

You have the right to opt out of the sale of your Personal Information. To exercise this right, you may: (a) click the "Do Not Sell or Share My Personal Information" link in the footer of our website; (b) submit a request at geniri.ai/legal/do-not-sell.html; (c) email privacy@geniri.ai; or (d) enable the Global Privacy Control (GPC) signal in your browser, which we honor as a valid opt-out request. We will add your information to our permanent suppression list within 15 business days. We will not discriminate against you for exercising your rights.

14.4 United Arab Emirates (PDPL)

We Process Personal Data of individuals in the UAE in accordance with the Federal Decree-Law No. 45/2021 (PDPL). You may exercise your rights by contacting privacy@geniri.ai.

14.5 Canada (PIPEDA / Quebec Law 25 / CASL)

We Process Personal Data of individuals in Canada in accordance with PIPEDA and, where applicable, Quebec Law 25. We comply with the Canadian Anti-Spam Legislation (CASL) in respect of commercial electronic messages. You may exercise your rights by contacting privacy@geniri.ai.

14.6 Other Jurisdictions

For individuals in Argentina (Ley 25.326), Colombia (Ley 1581, including mandatory "PUBLICIDAD" prefix for advertising emails), Mexico (LFPDPPP/FCPL), and other jurisdictions, we Process Personal Data in accordance with applicable local laws. You may contact privacy@geniri.ai to exercise your rights.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we notify you by email or by posting a notice on our website, and we update the "Last Updated" date. We encourage you to review this Privacy Policy periodically.

16. Contact Us