Legal
US State Privacy Notice and Rights Requests
Effective 4 May 2026 · Version v1.0
Business: InfiniNova Limited (星天域有限公司), trading as VeyJet Contact: legal-privacy-ofac@infini-nova.com · Mailbox 108, 13030 Eastgate Park Way, Louisville, KY 40223, USA
Supplements the Privacy Policy (Privacy Policy) for residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island and any other US state with a comprehensive privacy law in force.
About applicability, plainly. Most US state privacy laws apply only above a volume threshold — commonly 100,000 consumers, or 25,000 with revenue from selling or sharing; California also applies at USD 25m annual revenue. We are below all of them. We do not claim that any of these statutes applies to us.
We publish this notice and honour the rights below because the rights are reasonable, not because a statute compels us to. We will not refuse a request on the ground that the law does not apply to us.
1. Notice at Collection (CPRA §1798.100)
At or before collection, this is what we collect, why, and for how long.
| CCPA category | Do we collect it? | Specific items | Purpose | Retention | Sold or shared? |
|---|---|---|---|---|---|
| A. Identifiers | Yes | Name, email, phone, WeChat ID, IP address | Respond to enquiry; deliver services; security | §3 table in Privacy Policy §8 | No |
| B. Customer records (Cal. Civ. Code §1798.80) | Yes | Guardian name, billing contact | Contract, invoice | 7 yrs (payment) | No |
| C. Protected classifications | No — except age band (student grade) | Grade level | Age-appropriate service and guardian-consent routing | With client file | No |
| D. Commercial information | Yes | Services enquired about, ordered, paid | Deliver and account | 7 yrs | No |
| E. Biometric information | No | — | — | — | — |
| F. Internet activity | Yes, aggregate only | Page path, referrer, country (Umami, cookieless) | Understand which pages help parents | Aggregate | No |
| G. Geolocation | Coarse only | Country/region from IP; self-reported region | Route language and service | With logs / client file | No |
| H. Audio, electronic, visual | Only if you provide it | Meeting notes; project media you submit | Deliver the service | With client file | No |
| I. Professional or employment | No | — | — | — | — |
| J. Education information | Yes | Courses, GPA trend, test timing, activities, portfolio, application progress | Assess, plan, mentor, give feedback | With client file | No |
| K. Inferences | No | We do not build profiles | — | — | — |
| L. Sensitive personal information | Only with separate consent | Accessibility or learning-support need, where relevant | That stated purpose only | As consented | No |
Sources: you, your child with your authority, and (with your instruction) a school report or transcript you provide. We do not buy personal information from data brokers.
2. 🔴 We do not sell or share
We have not sold personal information, and have not shared it for cross-context behavioural advertising, in the preceding 12 months, and we do not do so now. There is no advertising pixel, no third-party ad tag and no data broker relationship on this site.
We have no actual knowledge of selling or sharing the personal information of any consumer under 16 — because we do not sell or share at all.
Because we do not sell or share, there is no "Do Not Sell or Share My Personal Information" mechanism to operate. We still honour Global Privacy Control (see §6) and will treat a GPC signal as an opt-out request if that position ever changes.
3. Your rights
| Right | Available | Notes |
|---|---|---|
| Know / access | Yes | Categories, sources, purposes, recipients, and the specific pieces |
| Portability | Yes | Machine-readable copy where technically feasible |
| Correct | Yes | We correct on verification, considering the nature and purpose of the data |
| Delete | Yes | Subject to the exceptions below |
| Opt out of sale/share | N/A | We do neither (§2) |
| Limit use of sensitive information | N/A | We use it only for permitted purposes (Privacy Policy §3.3) |
| Opt out of profiling / automated decisions | N/A | We do not profile (Privacy Policy §12) |
| Appeal a refusal | Yes | Required in CO, CT, VA, TX and others; we offer it to everyone |
| Non-retaliation | Yes | Exercising a right never affects your service or price |
Deletion exceptions we may rely on: completing a transaction you requested; detecting security incidents or fraud; complying with a legal obligation (tax and accounting records in particular); exercising or defending legal claims; and internal uses reasonably aligned with your expectations. If we refuse in part, we will say which exception and to which data.
4. How to make a request
Email legal-privacy-ofac@infini-nova.com with subject "Privacy request", stating the right you are exercising and the state you reside in. Post: Mailbox 108, 13030 Eastgate Park Way, Louisville, KY 40223, USA.
We do not require an account; there is no account to create.
| Step | Timing |
|---|---|
| We confirm receipt | Within 10 business days |
| We verify identity | Proportionate: for access/deletion of a client file we match two data points already on file, and for a request touching a student's record we verify guardian authority |
| We substantively respond | Within 45 days, extendable once by a further 45 days with notice and reason |
| Appeal | Reply to our decision within 60 days; we decide within 45 days and, if we refuse, tell you how to contact your Attorney General |
Requests are free. We may charge, or decline, a manifestly unfounded or excessive repeated request, and will explain why.
5. Authorised agents
You may use an authorised agent. We require written authorisation signed by you, and we may contact you directly to confirm both that you authorised the agent and the scope. A valid power of attorney is accepted without further confirmation.
6. Global Privacy Control
Our site honours the Global Privacy Control (GPC) signal. Since we neither sell nor share, GPC produces no change in our processing today; we detect and log it so that the commitment is real rather than aspirational, and it would take effect automatically if we ever introduced any sale or share.
7. Minors under 16
We do not sell or share personal information of any consumer, including anyone under 16, and therefore do not need — and do not rely on — opt-in consent for that purpose. Separate rules on parental consent for collection are in Minors, Guardian Consent and Student Records Policy.
8. Notice of Financial Incentive
We do not offer any financial incentive or price difference in exchange for personal information. No discount, no referral bonus, no loyalty programme is conditioned on data.
9. Metrics disclosure
California requires annual request metrics only from a business that buys, receives, sells or shares the personal information of 10,000,000 or more consumers a year. We are far below that threshold and therefore do not publish those metrics. We re-check this conclusion once a year.
10. State-specific notes
- California (CCPA/CPRA): this notice is the Notice at Collection and the privacy policy disclosure required by §1798.130(a)(5). Complaints: California Privacy Protection Agency, or the Attorney General.
- Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, New Jersey, Minnesota, Maryland and similar: appeal rights are provided at §4; universal opt-out mechanisms are honoured at §6; we conduct no targeted advertising, sale or profiling with legal or similarly significant effects, so no data protection assessment is triggered on those grounds.
- Nevada (SB 220): we do not sell covered information; you may still submit a verified opt-out request to the address above.
- Washington My Health My Data / Nevada SB 370: we do not collect consumer health data. If a family volunteers health information we decline it and delete it, unless it is an accessibility need processed under the “Consent Form — Collection, Sensitive Information, Cross-Border Transfer and Marketing” Part B.
- Student data laws (e.g. New York Ed. Law §2-d, California SOPIPA): these bind operators contracting with schools and local education agencies. We contract with families, not schools. If we ever contract with a school, those laws apply and this notice is insufficient — obtain counsel first.
11. Contact
legal-privacy-ofac@infini-nova.com Mailbox 108, 13030 Eastgate Park Way, Louisville, KY 40223, USA