Effective: February 6, 2026

Introduction

To provide and improve CanopyLink, we collect, store, and process "Personal Information," which is information that directly or indirectly identifies you. This Privacy Statement describes the Personal Information we collect and what we do with it. By using CanopyLink, you agree to our collection, processing, and use of your Personal Information as described in this statement.

What Personal Information Does CanopyLink Collect?

CanopyLink may collect the following types of Personal Information directly from users:

Account registration information: name, email address, physical address, phone number.
Credit card information: payment and billing information.
User profile information: username, password.

CanopyLink may collect the following types of Personal Information indirectly from users:

Computer and mobile phone information: computer operating system, web browser, mobile device identifier, internet service provider, geolocation.
Information from Cookies: small text files stored on your browser that allow us to improve your experience with CanopyLink.
Information from your use of CanopyLink: de-identified versions of family trees and usage data, such as features you make use of.

How Does CanopyLink Use Your Personal Information?

We use your Personal Information to provide and improve CanopyLink. This includes:

Creating, maintaining, and securely registering your user account.
Processing payments for CanopyLink.
Communicating with you about CanopyLink.
Measuring usage of CanopyLink.
Improving CanopyLink features.
Advertising products from third-parties.
Ensuring security of CanopyLink.

How Does CanopyLink Share Your Personal Information?

We may share your Personal Information under the following circumstances:

To comply with a legal or regulatory request or process.
To process payments for CanopyLink subscriptions.
To enforce our Terms.
In de-identified aggregate form with third-party advertisers.
If you provide written permission for us to do so.

We will not otherwise disclose your Personal Information.

How Do I Manage My Personal Information?

You may change or remove your Personal Information at any time. To change your account and billing information, you may log into your account and make changes. To remove Cookies, you may block them from within your browser. To request removal of other Personal Information, please email info@canopylink.org with your request.

Legal Bases Under GDPR

Under EU/EEA and UK law, we are required to specify the purposes and legal bases we rely on for processing your Personal Information. We rely on the following bases:

To provide CanopyLink features and process payment information we collect Personal Information, and we rely on contractual necessity.
To maintain and improve CanopyLink we collect Personal Information, and we rely on legitimate interests.
For security purposes, we analyze your Personal Information to protect against unlawful activity, and we rely on legitimate interest and the need to comply with legal obligations.
For marketing activities, we use your Personal Information, and we rely on consent and legitimate interests.

U.S. Residents Additional Privacy Statement

This U.S. Resident Additional Privacy Statement ("U.S. Statement") supplements our Privacy Statement and provides additional information about the Personal Information we collect, process, and share. It also provides information on how residents of U.S. states that provide for the privacy rights outlined below may exercise those rights. This U.S. Statement applies to the Personal Information we collect from your use of CanopyLink and through any other means by which you engage with us.

Categories of Personal Information

CanopyLink may collect the following categories of Personal Information:

Identifiers, such as name, username, postal address, unique personal identifier, online identifier, IP address, your mobile device identifier, email address, account name, driver's license;
Personal information described in Section 1798.80(e) of the California Civil Code not covered by an existing category, such as physical characteristics or descriptions;
Characteristics of protected classifications under applicable state or federal law, such as self-reported assigned sex at birth and birthdate. This also includes Your Content you choose to disclose with us that is considered a legally protected class under applicable state or federal law;
Commercial information, such as products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
Internet usage information, such as your browsing history, search history, and information regarding your interaction with our sites and advertisements;
Geolocation data, such as location of your device or computer;
Sensitive Personal Information, such as driver's license, account login information, racial or ethnic origin, and genetic data, depending on how you use CanopyLink. We do not use or disclose Sensitive Personal Information to infer characteristics about you.

Business Purposes

CanopyLink uses Personal Information for the following business purposes:

Providing, personalizing, improving, updating, and expanding CanopyLink;
Communicating to you about CanopyLink;
Helping to ensure security and integrity of CanopyLink; and
Marketing new products and offers from us or our business partners based on your interests.

Disclosure of Personal Information for Business Purposes

CanopyLink discloses with the following categories of third parties the correlating categories of Personal Information for a business purpose:

Other CanopyLink users: if you disclosed your Personal Information to other CanopyLink users.

Disclosure and Advertising Preferences

CanopyLink shares with the following categories of third parties the correlating categories of Personal Information for targeted advertising: identifiers, commercial information, internet usage information, inferences.

We use cookies and similar tracking technologies to disclose information with our service providers and third-party partners for a variety of reasons, including to measure, target, and serve advertisements as further described in this Privacy Statement.

Under the laws in some U.S. jurisdictions, you have the right to opt out of our sharing of your Personal Information for online targeted advertising. CanopyLink does not sell or share your Personal Information for other purposes.

You may opt-out of Cookie usage by disabling it in your browser.

Some browsers or plug-ins use a Global Privacy Control (GPC), which you can learn more about at https://globalprivacycontrol.org. If our site detects a GPC signal from your device, we will interpret it as a request to opt out of selling or sharing your Personal Information and to opt out of targeted advertising. If you opt out of targeted advertising via the GPC or the opt-out preference on the Do Not Sell or Share my Personal Information/Opt Out of Targeted Advertising page, we may still deliver advertising to you that is not tailored based on your Personal Information.

CanopyLink does not sell or share any genetic or genealogical information with third-party marketers, insurance companies, or employers, and we will not use your genetic or genealogical information for marketing or personalized advertising.

Exercising Your Rights

Right to Know. You may have the right to request that we disclose what Personal Information we collect, use, disclose, or share. This includes the right to request the categories of Personal Information we have collected about you, the categories of sources of Personal Information, the business purpose for collecting, disclosing, or sharing Personal Information, the categories of third parties with whom we disclose or share categories of Personal Information, and the specific pieces of Personal Information we have collected about you.

If you are submitting a request to know on your own behalf, you can make your request online or by email.

To email your request to know, email us at info@canopylink.org. We are required to verify your identity before providing you with a copy of your data; you may be required to provide a copy of your government-issued ID, which will be used solely to verify your identity and address.

Right to Delete. You may have the right to request that we delete your Personal Information.

You may submit a request to delete your own information either online or by email. To delete your Personal Information, you must delete your account and, once an account deletion request is completed, this process is irreversible. Your information (including family trees and any linked sources) will be permanently deleted.

To email your request to delete, email us at info@canopylink.org. We are required to verify your identity before we delete your data; you may be required to provide a copy of your government-issued ID, which will be used solely to verify your identity and address.

Authorized Agents. In applicable jurisdictions, U.S. residents can use authorized agents to make requests to know and requests for deletion. Even if you choose to use an authorized agent for a request, you may still need to work directly with us to provide:

Signed permission allowing the authorized agent to act on your behalf.
Verification of your identity (e.g., a copy of your government-issued ID, which will be used solely to verify your identity and address).

If you are an authorized agent, email us at info@canopylink.org.

Right to Appeal. Depending on where you live, if your request to know or delete your data is denied, you may have the right to appeal. You can do so by contacting us at info@canopylink.org. Please incorporate the phrase "request for appeal" in the subject line and clearly state the specific reasons for your appeal. Your request will then be reviewed, and you will be informed of our decision.

Right to Correct. You have the right to correct inaccurate Personal Information that we maintain about you. You can do so by contacting us at info@canopylink.org.

Selling. To opt out of targeted advertising, please email us at info@canopylink.org.

Sensitive Personal Information. We process sensitive personal information collected about you only to provide CanopyLink, including to:

Maintain the quality and safety of CanopyLink;
Improve CanopyLink;
Detect security incidents;
Resist and prosecute malicious, deceptive, fraudulent, or illegal actions directed at CanopyLink; and
Maintain or service accounts, provide customer service, process or fulfill orders and transactions, verify customer information, process payments, provide analytic services, and provide storage.

We may also process this sensitive personal information as needed to help ensure people's physical safety and as required by applicable law.

Non-discrimination. We will not discriminate against you for exercising any of your rights under applicable U.S. privacy regulations.

California's Shine the Light Law. California Civil Code Section 1798.83, known as the "Shine the Light" law, permits users who are California residents to request and obtain from us a list of what Personal Information (if any) we disclosed to third parties for their direct marketing purposes in the preceding calendar year and the names and addresses of those third parties. Requests may be made only once a year and are free of charge. Under Section 1798.83, CanopyLink currently does not share any Personal Information with third parties for their own direct marketing purposes.

Annual Reporting. In compliance with the California Consumer Privacy Act, we will track global Right to Know/Subject Access and Right to Delete requests.

Contact Us. If you have questions about our U.S.-related privacy policies or practices, please contact us at info@canopylink.org.

Actions for Relief

Various federal, state, and local laws may protect your Personal Information.

Alabama residents who wish to allege a violation of the Alabama Genetic Data Privacy Act of 2024 may file a complaint with the Alabama Attorney General.
California residents who wish to allege a violation of the California Genetic Information Privacy Act (GIPA) may file a complaint with the California Attorney General or their district attorney. Residents of cities with more than 750,000 residents may file a complaint with their city attorney, and residents of cities with full-time city prosecutors may file a complaint with their city prosecutor. If you wish to file a complaint with your district attorney, city attorney, or city prosecutor, contact their local office for more information. California residents who believe that their Personal Information was used improperly may file a complaint with the California Attorney General or California Privacy Protection Agency (CPPA).
Minnesota residents who wish to allege a violation of the Minnesota Genetic Information Privacy Act (GIPA) may file a complaint with the Minnesota Department of Commerce, pursuant to Minn. Stat. §45.027.
Virginia residents who wish to allege a violation of Va. Code Ann. §59.1-593 through §59.1-602 of 2023 (relative to genetic data privacy) may file a complaint with the Virginia Attorney General.
Residents of other states who believe that their Personal Information was used improperly may file a complaint with their attorney general or applicable regulatory body.

Australian Resident Additional Privacy Statement

If the Australian Privacy Act 1988 (Cth) (Privacy Act) applies to the handling of your Personal Information, the following clauses will also apply.

Genetic information is considered "Sensitive Information" as set out under the Privacy Act. We will collect, use or disclose sensitive information about you only as permitted by law, for example where we have received your consent to do so or the collection is required or authorized by law.

You may have the right to make a complaint to the relevant privacy or data protection regulator in your jurisdiction. However, if you have any questions or concerns about our handling of your Personal Information, or if you believe we have not complied with this Privacy Statement or the relevant privacy law in your jurisdiction, we would appreciate it if you contact us in the first instance. We will investigate the complaint and determine what action, if any, to take.

Brazilian Resident Additional Privacy Statement

This section addresses the rights and obligations established by Law 13.709/2018 – Brazilian General Data Protection Regulations ("LGPD") that apply when:

The operation of Personal Information processing occurs in Brazil;
You offer products and services in Brazil; or
Personal Information is collected in Brazil.

The law grants users certain rights. The LGPD provides these rights:

Information of entities with which the controller has shared data. You may ask CanopyLink to provide information regarding sharing of Personal Information with third parties;
Anonymization, blocking or deleting unnecessary, excessive, or unlawfully processed data. Due to the principles of adequacy and necessity, you may request that CanopyLink anonymize, block or delete unnecessary, unreasonable, or unlawfully processed Personal Information;
Revocation of Consent. You may request the revocation of the consent given to CanopyLink to process Personal Information at any time; and
Opposition to Treatment if Improper. You may object to improper processing of Personal Information.