In short: we collect only what we need to take and manage your reservation: your email address, what you reserved, and payment details, which Stripe processes. We use our own visit counter, which sets no cookies and stores no IP addresses.
Genesis Devices process your questions and documents on the Device itself. They don't send them to us or to any cloud.
1. Who is responsible for your data
The controller of your personal data is:
FINQUP Technology OOD
37 Georgi Benkovski Str., main entrance, 1st floor, Oborishte District, Sofia 1000, Republic of Bulgaria
Company number (UIC/EIK): 207033081
VAT number: BG207033081
Email: info@genesisbox.org
Website: genesisbox.org · Parent company website: finqup.com
For any privacy question or request, email info@genesisbox.org with "Privacy" in the subject.
2. Your Genesis Device
GenesisOne and GenesisBox run their AI, search and library on the Device. Your questions, answers, documents in the personal vault, and map searches stay on the Device. They aren't sent to us or to any third party, and the Device works without an account. Optional library updates download content to the Device; they don't upload your data. Everything below is about genesisbox.org and our reservation and sales process, not about how you use the Device.
3. What we collect and why
| Data | Why | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Email address, chosen Device and quantity (reservation form) | To create your reservation and send the confirmation | Steps before a contract, and the contract itself (Art. 6(1)(b)) | While your reservation or order is active, then up to 5 years (the general limitation period under Bulgarian law) |
| Name, billing country or address, and payment status (from Stripe) | To take the deposit or payment, handle refunds and prevent fraud | Contract (Art. 6(1)(b)), and our legitimate interest in preventing fraud (Art. 6(1)(f)) | As above |
| Invoices and payment records | Accounting and tax | Legal obligation (Art. 6(1)(c)) | 10 years, as required by Bulgarian accounting law |
| Emails you send us | To answer you and manage your reservation | Contract, or our legitimate interest in answering you | As long as needed for your request, then up to 3 years |
| Shipping address and phone number (only when you complete a purchase) | Delivery | Contract (Art. 6(1)(b)) | Up to 5 years after delivery |
| Technical data: IP address, browser type, time of request (web server logs) | To run and secure the website | Legitimate interest in security (Art. 6(1)(f)) | Short-term, as kept by our host for security and operations |
We don't sell your data. We don't use it for advertising. We don't make decisions about you by automated means that have legal or similarly significant effects.
The 30-day test and the free field guides
If you take the 30-day test, or ask for one of the free guides, we collect:
- Your email address, and a record that you ticked the consent box, with the date and time.
- Your test answers: the option you picked for each question, and the result worked out from them: how many days you would likely last, what would fail first and second, and your strongest area. We use these to produce your results email and to decide which follow-up is relevant to you.
- Your referral code, how many people have used it, and the code of whoever referred you if you arrived through someone else's link. We never link your friends' email addresses to your record, and we never email someone because you referred them — they only hear from us if they sign up themselves.
- Campaign parameters in the link you arrived on (for example utm_source), so we know which post or group brought you here.
Why we may do this: your consent, Article 6(1)(a) GDPR. You give it by ticking the box, and you can withdraw it at any time without giving a reason.
What you will receive: your results or guide immediately, then at most three short follow-up emails over the following eight days — a printable checklist, why we built GenesisBox, and one message about the category you scored lowest on. After that we email only occasionally, and only about GenesisBox.
Stopping it: every email carries a one-click unsubscribe link that works without logging in or replying. You can also email info@genesisbox.org and we will remove you by hand. Unsubscribing does not take away any guide you have already downloaded.
Who sends these emails: we do, from our own mailbox on our hosting provider's mail servers. Your email address is not sold, rented or shared with advertisers, and we do not upload it to advertising platforms.
Measuring our emails: some of our emails contain a tiny image and links that pass through genesisbox.org, so we can see roughly how many people opened each email and which links were clicked. We use this only to make our emails more useful; it is never sold or shared. Turning off images in your mail app avoids the first, and unsubscribing stops both.
If you reserve a device: we may email you about your reservation — production, specification, delivery — even if you are not on the list. Those emails carry an unsubscribe link too.
How long we keep it: while you are subscribed, and for up to 24 months after your last interaction with us, after which the record is deleted. If you unsubscribe we keep only enough information to be sure we do not email you again by mistake.
4. Who we share it with
- Stripe processes payments. Stripe is independently responsible for some processing, such as fraud prevention and meeting financial regulations. See stripe.com/privacy.
- DreamHost hosts genesisbox.org and our email, as our processor.
- Google Fonts: the website loads fonts from Google's servers, which receive your IP address and browser details when a page loads.
- Carriers, only when you complete a purchase: your name, address and phone number, so they can deliver.
- Our accountants and professional advisers, and authorities where the law requires it.
- FinqUP, our parent company: our team works under FinqUP, and your data is handled by that team under this policy.
5. Transfers outside the EEA
Some providers (for example DreamHost and Google) are based in the United States. Where your data leaves the European Economic Area, we rely on an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
6. Your rights
You have the right to:
- access your personal data and get a copy;
- have inaccurate data corrected;
- have data erased, where we don't need to keep it for legal reasons;
- restrict or object to processing based on our legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent (for example cookie preferences).
Email info@genesisbox.org. We'll reply within one month. You can also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the data-protection authority where you live.
7. Security
The website uses HTTPS. Secrets and reservation records are stored outside the public web folder. Payment card data never touches our servers.
8. Children
genesisbox.org is not directed at children. You must be 18 or older to reserve or buy.
9. Cookies
See our Cookie Policy, and change your choices on Cookie Preferences.
10. Changes
We'll update this policy when our practices change, and show the date at the top. For significant changes, we'll email people with an active reservation.