# Privacy — Genyra

> Privacy notice for Genyra.com: what is collected through enquiries, briefs, accounts and the newsletter, Google Analytics, retention and your rights.

Canonical page: https://genyra.com/legal/privacy

This notice explains the personal information handled through Genyra.com: the contact form, the guided project brief, client enrolment and accounts, the engineering-notes newsletter and the technical minimum needed to run the site securely.

## The short version.

The full notice follows. These four points are the substance of it.

- Genyra LLC, a Delaware company, is responsible for this website. Write to contact@genyra.com about anything in this notice.
- We collect only what you type into the enquiry, project brief, enrolment, account and newsletter forms, plus the technical minimum needed to run the site securely.
- Google Analytics counts visits to the public pages. In the United Kingdom, the EEA and Switzerland it sets no cookie until you allow it; everywhere else it runs by default and can be turned off from Cookie settings in the footer. One further cookie is set only when you sign in. Nothing is sold or shared for marketing.
- Information is handled in the United States. You can ask to see, correct or delete it, and withdraw newsletter consent at any time.

## Who is responsible.

Genyra LLC is responsible for the personal information described in this notice. Genyra LLC is a Delaware limited liability company, registered with the Delaware Division of Corporations under file number 10789617. Its public contact address is contact@genyra.com.

Questions, requests and complaints about this notice go to that address. Put “Privacy” in the subject line so the message reaches the person handling it without delay.

## What this notice covers, and what it does not.

This notice covers Genyra.com and the routes it operates: the contact form, the guided project brief at /start-a-project, client enrolment and activation links, client and staff accounts under /account and /admin, support conversations within a client account, and the engineering-notes newsletter.

It does not cover Genyra.ai, which is operated by Genyra L.L.C-FZ, a separate business in Dubai with its own notice, or any external website reached by a link from this site. Where a signed service agreement contains its own data-handling terms for project work, those terms govern that work.

This website is intended for organisations and the people who act for them. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has sent us information, tell us and we will delete it.

## The contact form.

When you send an enquiry we record your name, organisation, email address, the subject you selected, your message and the fact that you ticked the consent box, together with the time of consent and a reference in the form GNY-XXXXXXXX that confirms the enquiry was recorded.

We also record which page of this site the form was sent from and, if you arrived through a link carrying campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), those tags. A hidden anti-spam field is discarded. The enquiry is stored only after you consent to its use for a response; the form is not a subscription to anything.

Your enquiry goes to the Genyra staff inbox inside this site, where it is read and answered from contact@genyra.com. When email delivery is switched on for this site, a receipt carrying your reference and a copy of what you wrote is sent to the address you gave, and a copy of the enquiry is sent to the staff address; the date this is enabled will be noted in the changes section below. Until then nothing is emailed automatically.

Please do not include passwords, credentials, confidential records or information you are not authorised to share. If later work needs sensitive material, the appropriate access and contractual arrangements are agreed separately.

## The guided project brief.

The project brief asks for more than the contact form so that a first conversation is useful: your name, email address, organisation and industry, the services you are interested in, the problem you describe, and optional answers on budget, timeline, data readiness, integrations, sensitivity, location and notes.

The brief is stored as a lead for review by Genyra staff, with the time of your consent and a GNY reference. If a conversation leads to an engagement, the lead is converted into a client record so that the project history begins with what you told us.

## Client enrolment.

When an engagement proceeds, Genyra staff send a private enrolment link by email. The link is bound to your organisation, works for a stated period (30 days by default, never more than 90) and cannot be reused once the enrolment is reviewed.

The enrolment form asks for the legal name, registration number and jurisdiction of your organisation, its registered address, a billing email address and currency, the name, title and email address of the person signing for the organisation, and optional trading name, tax identifier, website, telephone number and notes. Staff review the submission and may approve it, request changes or reject it; submitting the form never implies approval.

## Client accounts, sign-in and support.

Accounts are created by invitation only. An invitation link is sent to a named email address, works for a stated period (48 hours by default, never more than seven days) and fixes the organisation on the server; an invitee cannot choose another one. On activation we store your name, your email address and your password, which is stored only as a salted scrypt hash. The password itself is never stored or logged.

Signing in uses your email address and password. A successful sign-in creates a session that lasts twelve hours or until you sign out, and sets the session cookie described in the cookie notice. Sign-ins and refused sign-in attempts are recorded in an audit trail that holds the account and the action, never the password.

If you forget your password, the reset page accepts an email address and always answers the same way, so it cannot be used to discover whether an address has an account. Where email delivery is enabled, an account holder receives a private link that works once, within one hour, and choosing a new password signs every other session out. Where it is not, a staff member resets the password on request.

Inside an account you see only your organisation’s projects, issued invoices, service agreements and support conversations. A support conversation stores the subject, each message and who wrote it. The public support page does not collect anything; it directs you to the contact form.

## Engineering notes.

Subscribing records your email address, your name if you give it, and the time you ticked the consent box. The subscription stays pending until you open the confirmation link sent to that address; the link works for 48 hours and no marketing is sent before confirmation.

Every confirmation carries an unsubscribe link, and unsubscribing is an explicit action on this site, so a mail scanner opening the link cannot unsubscribe you by accident. We keep the times of consent, confirmation and unsubscription so that we can show the basis on which any message was sent and so that an unsubscribed address is not contacted again.

## Technical information, and what is not collected.

To limit abuse, the site counts submissions and sign-in attempts from each connection for a short window. The count is keyed by a keyed hash of the connection address computed with a server-side secret; the address itself is not written into your enquiry, brief or account record, and the counters expire within minutes to a day.

Server access logs omit query strings and request bodies, and runtime errors never log form content or database addresses. The site serves its own fonts, images and video. The one outside service it loads is Google Analytics, described next.

Google Analytics 4, a service of Google LLC, runs on the public pages to count visits and show which pages are read, where visitors arrive from and roughly where they are. It records the pages you view, the page you came from, your browser and device type and an approximate location derived from your connection address; Google Analytics 4 does not store the connection address itself. It never runs on the sign-in, account, enrolment, activation, unsubscribe or newsletter-confirmation pages, so private links and account activity are not measured. Advertising features, Google Signals and any link to advertising accounts are switched off, and we use the reports only in aggregate.

Whether Google Analytics may set cookies depends on where you are. In the United Kingdom, the European Economic Area and Switzerland, and wherever your browser sends the Global Privacy Control signal, it sets no cookie and keeps no identifier until you press Allow on the cookie statement; until then it sends only anonymous, cookieless pings that Google counts in aggregate. Elsewhere it sets its cookies by default. In every case you can turn it off, or change your choice, from Cookie settings at the foot of each page; turning it off stops measurement entirely and removes its cookies.

Beyond that, the only items kept in your browser without signing in are a motion preference (genyra-motion-preference, set only if you use the motion control) and a note that you dismissed the short cookie statement (genyra-cookie-notice). Your analytics choice (genyra-cookie-consent) is kept the same way. None of these leaves your browser. Every submission must come from this site’s own pages, which is enforced on the server rather than with a tracking cookie.

## Why we use it, and on what basis.

We use personal information only for the purposes below. Where a legal basis is required by the law that applies to you, it is the one listed.

- Responding to an enquiry or project brief, and taking the steps you ask for before any agreement: our legitimate interest in answering you, and the steps needed to enter a contract.
- Enrolling a client, operating client accounts, issuing invoices and handling support: performance of the agreement with your organisation, and the accounting and tax records that follow from it.
- Sending engineering notes: your consent, which you can withdraw at any time by unsubscribing.
- Counting visits and seeing which pages are read, with Google Analytics: our legitimate interest in understanding how the site is used and improving it; where the law that applies to you requires consent for analytics cookies, your consent given on the cookie statement, which you can withdraw from Cookie settings.
- Rate limits, the anti-spam field, same-origin checks, hashed tokens and the audit trail: our legitimate interest in keeping the site and client records secure and preventing abuse.
- Responding to a lawful request from a court or authority: compliance with a legal obligation.

## Where it is stored and how it is protected.

Everything you submit is stored server-side in a database dedicated to this website and separate from Genyra.ai. In production the site is served over HTTPS behind a TLS proxy, the database connection is encrypted, session tokens and private links are stored only as hashes, passwords are hashed with scrypt, and queued email is held encrypted until it is sent.

Access is limited to the Genyra staff handling the matter, through staff accounts whose actions are recorded in the audit trail. Backups carry the same access restrictions as the database. One third-party provider is connected: Google LLC, which processes the Google Analytics measurements described above as our processor under Google’s data processing terms, on Google’s servers, which may be outside your country. No email-delivery, CRM or advertising provider is connected.

## How long we keep it.

Retention follows the purpose. The periods below are our stated practice; they are reviewed when this notice is updated.

- Enquiries and project briefs: kept while the conversation is live and reviewed for deletion afterwards. If an engagement follows, the lead becomes part of the client record.
- Enrolment, account, agreement and invoice records: kept for the life of the agreement and then for as long as accounting and legal obligations require.
- Newsletter subscriptions: kept until you unsubscribe. The unsubscribed address is then retained only so that it is not contacted again.
- Account sessions: twelve hours, or until you sign out. Private links: enrolment links up to 90 days, invitations up to seven days, newsletter confirmations 48 hours, password resets one hour; each is single-use.
- Queued email: held encrypted on the server until it is accepted by the email service or a staff member retries it; it is not kept as a separate archive of your correspondence.
- Abuse-prevention counters: minutes to one day. Audit entries: kept with the record they describe.

## Who we share it with.

We do not sell personal information, do not share it for cross-context behavioural advertising and do not share it with anyone for marketing. Within Genyra it is seen only by the staff handling your enquiry, engagement or account.

The site runs on infrastructure operated for Genyra LLC and is delivered through Cloudflare, which may set its own security cookies and add a cookieless performance beacon. Google LLC receives the analytics measurements described above. If an email-delivery or CRM provider is engaged to process personal information on our behalf, it will act under a written agreement and this notice will be updated to name the category of provider. We may disclose information where the law requires it, to protect the rights or safety of a person, or as part of a transfer of the business, in which case the recipient takes on the commitments in this notice.

## International handling.

Genyra LLC is a United States company. If you write to us from the United Kingdom, the European Union or elsewhere, expect your information to be handled in the United States under the protections described in this notice.

If project work will involve personal data that needs a particular transfer arrangement, raise it before sharing the data; the service agreement can provide for it.

## Your rights and how to exercise them.

Subject to the law that applies to you, you can ask us to:

- Tell you what personal information we hold about you and give you a copy.
- Correct information that is inaccurate or incomplete.
- Delete information, unless we must keep it for an agreement or a legal obligation.
- Restrict or object to a particular use, including any use based on legitimate interest.
- Withdraw consent to engineering notes at any time, by using the unsubscribe link or writing to us.
- Turn Google Analytics off at any time from Cookie settings at the foot of each page. We also honour the Global Privacy Control signal from your browser, which switches the site to ask before setting any analytics cookie.
- Complain to a supervisory authority where one has jurisdiction over you. We would rather hear from you first.

## Making a request.

Email contact@genyra.com with “Privacy” in the subject line. Tell us which route your information came through, the email address you used and, if you have one, your GNY reference. We may ask for enough detail to confirm that the request comes from the person the information concerns, and we will not ask for more than that.

There is no charge for a request. We answer within a reasonable time and tell you if a part of the request cannot be met and why.

## Changes to this notice.

This notice is dated at the top of the page. When the site’s routes, storage or providers change, the notice is updated and the date is revised. A material change, such as connecting a third-party provider, is noted on this page. 1 November 2026: Google Analytics was connected to the public pages, as described above and in the cookie notice. 4 November 2026: the staff inbox, enquiry receipts and the password-reset route described above were added; no email-delivery provider has been connected.

## Related work

- [Cookies and browser storage](https://genyra.com/legal/cookies): Cookie notice for Genyra.com: the Google Analytics cookies and when they are set, the session cookie, browser preferences and how to turn analytics off.
- [Website terms](https://genyra.com/legal/terms): Terms of use for Genyra.com: what the site offers, acceptable use of the enquiry and account routes, intellectual property, liability and governing law.
- [Contact Genyra](https://genyra.com/contact): Contact Genyra about software development, software archaeology, infrastructure, product requirements or a partnership.

Contact: contact@genyra.com

Genyra LLC and the Dubai business Genyra L.L.C-FZ / Genyra.ai are distinct entities. Project scope and the contracting entity are agreed explicitly.