In short: we collect only what we need to take and manage your reservation: your email address, what you reserved, and payment details, which Stripe processes. We don't use analytics or advertising trackers.
Genesis Devices process your questions and documents on the Device itself. They don't send them to us or to any cloud.
1. Who is responsible for your data
The controller of your personal data is:
FINQUP Technology OOD
37 Georgi Benkovski Str., main entrance, 1st floor, Oborishte District, Sofia 1000, Republic of Bulgaria
Company number (UIC/EIK): 207033081
VAT number: BG207033081
Email: info@genesisbox.org
Website: genesisbox.org · Parent company website: finqup.com
For any privacy question or request, email info@genesisbox.org with "Privacy" in the subject.
2. Your Genesis Device
GenesisOne and GenesisBox run their AI, search and library on the Device. Your questions, answers, documents in the personal vault, and map searches stay on the Device. They aren't sent to us or to any third party, and the Device works without an account. Optional library updates download content to the Device; they don't upload your data. Everything below is about genesisbox.org and our reservation and sales process, not about how you use the Device.
3. What we collect and why
| Data | Why | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Email address, chosen Device and quantity (reservation form) | To create your reservation and send the confirmation | Steps before a contract, and the contract itself (Art. 6(1)(b)) | While your reservation or order is active, then up to 5 years (the general limitation period under Bulgarian law) |
| Name, billing country or address, and payment status (from Stripe) | To take the deposit or payment, handle refunds and prevent fraud | Contract (Art. 6(1)(b)), and our legitimate interest in preventing fraud (Art. 6(1)(f)) | As above |
| Invoices and payment records | Accounting and tax | Legal obligation (Art. 6(1)(c)) | 10 years, as required by Bulgarian accounting law |
| Emails you send us | To answer you and manage your reservation | Contract, or our legitimate interest in answering you | As long as needed for your request, then up to 3 years |
| Shipping address and phone number (only when you complete a purchase) | Delivery | Contract (Art. 6(1)(b)) | Up to 5 years after delivery |
| Technical data: IP address, browser type, time of request (web server logs) | To run and secure the website | Legitimate interest in security (Art. 6(1)(f)) | Short-term, as kept by our host for security and operations |
We don't sell your data. We don't use it for advertising. We don't make decisions about you by automated means that have legal or similarly significant effects.
4. Who we share it with
- Stripe processes payments. Stripe is independently responsible for some processing, such as fraud prevention and meeting financial regulations. See stripe.com/privacy.
- DreamHost hosts genesisbox.org and our email, as our processor.
- Google Fonts: the website loads fonts from Google's servers, which receive your IP address and browser details when a page loads.
- Carriers, only when you complete a purchase: your name, address and phone number, so they can deliver.
- Our accountants and professional advisers, and authorities where the law requires it.
- FinqUP, our parent company: our team works under FinqUP, and your data is handled by that team under this policy.
5. Transfers outside the EEA
Some providers (for example DreamHost and Google) are based in the United States. Where your data leaves the European Economic Area, we rely on an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
6. Your rights
You have the right to:
- access your personal data and get a copy;
- have inaccurate data corrected;
- have data erased, where we don't need to keep it for legal reasons;
- restrict or object to processing based on our legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent (for example cookie preferences).
Email info@genesisbox.org. We'll reply within one month. You can also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the data-protection authority where you live.
7. Security
The website uses HTTPS. Secrets and reservation records are stored outside the public web folder. Payment card data never touches our servers.
8. Children
genesisbox.org is not directed at children. You must be 18 or older to reserve or buy.
9. Cookies
See our Cookie Policy, and change your choices on Cookie Preferences.
10. Changes
We'll update this policy when our practices change, and show the date at the top. For significant changes, we'll email people with an active reservation.