Privacy Policy

This Privacy Policy explains what personal information Envyrofax collects, how we use and share it, and the choices and rights you have. It applies to envyrofax.com and our related services. Health-related information is also covered by our Consumer Health Data Privacy Policy.

Information we collect

Information you give us

• Account information: name, email address, mobile phone number, street address, city, state or province, postal code and country.
• If you sign in with Google, Facebook or LinkedIn: we receive only your name, your verified email address and an account identifier from that service. We do not receive your password, contacts, posts or any other data, and we never post on your behalf. You can disconnect Envyrofax in that service's settings at any time; see Data Deletion.
• Sex: female or male, required for an account and used to personalize health context because environmental health and cancer risks differ by sex.
• Addresses you scan and properties you save.
• Work history, if you use the Work History Exposure Check: the employers, job titles, workplace addresses and years you confirm. If you upload a resume or paste your work history, we read it once to pull out those workplaces and do not keep the uploaded file or its text; nothing is saved until you confirm the list. We do not log the contents of your resume.
• Health conditions you select in the Body Scan. These selections are processed in your browser and are not sent to or stored by us.
• Consents: the date, time, IP address and version of each consent you give (terms, health data, text messages, marketing).
• Messages you send us.

Information collected automatically

• Device and log information such as IP address, browser type, pages viewed, referring URLs and timestamps, used for security, rate limiting and debugging.
• Cookies and similar technologies: a sign-in session cookie, a first-visit animation flag, your privacy opt-out setting, and cookies set by our advertising partners. See Cookies & Ads.

How we use information

• To provide reports, verify your account with two-step codes, and keep your account secure.
• To personalize health context using your sex and address (with your consent).
• To show the environmental records, linked organ systems and county health signals around the places you worked, using the work history you confirm and your sex (with your separate consent), and to let you return to that list later.
• To send security codes by email and, if you opt in, by text message.
• To send optional updates about new records near your address, only if you opt in.
• To show advertising that keeps the Service free, and to measure and improve the Service.
• To prevent fraud and abuse, comply with law, and enforce our Terms.

How we share information

We do not sell your name, email, phone number, address or sex. We share information only with:

• Aggregated, de-identified statistics (for example, the number of users by state or by sex, or the most-scanned counties) with investors, partners and the public. These never identify you.
• Service providers that host our site and database, send email and text messages, and provide security, under contracts that limit their use of the information.
• Google, through its Gemini API, which acts as our processor to read an uploaded resume or pasted work history and return the list of workplaces. The file and text are sent only for that request and are not used by us for anything else.
• Advertising partners (Ezoic, Infolinks and, when enabled, Google), which may use cookies and device identifiers to show and measure ads. Under some state laws this can be a "sale" or "sharing" for targeted advertising; you can opt out on our Do Not Sell or Share page, and we honor Global Privacy Control signals automatically.
• Authorities when required by law or to protect rights and safety, and a successor in a merger or acquisition, subject to this Policy.

Retention

We keep account information while your account is active and for up to 24 months after your last use, unless you ask us to delete it sooner or the law requires longer. Your confirmed work history is kept with your account until you delete it (with the Delete saved list button on the Work History page) or delete your account on your account page; uploaded resumes are never stored. Verification codes expire after 15 minutes and are deleted within 30 days. Server logs are kept up to 90 days.

Security

We use encryption in transit, hashed session and verification tokens, two-step verification, access controls and rate limits. No method is perfectly secure, and we will notify you of a breach as required by law.

Your rights and choices

Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Florida and other states), you may have the right to know, access, correct, delete and obtain a portable copy of your personal information, to opt out of targeted advertising and sales, and to limit use of sensitive information. You can download or delete your data at any time from your account page, or email hello@envyrofax.com. We will verify requests and respond within 45 days. You may use an authorized agent. We will not discriminate against you for exercising your rights. If we deny a request you may appeal by replying to our decision; if the appeal is denied you may contact your state attorney general.

Visitors in the European Economy Area, the UK and Switzerland

Envyrofax is operated from the United States by Adam Silva Consulting, Inc., which is the controller of your personal data under the EU General Data Protection Regulation, the UK GDPR and the Swiss Federal Act on Data Protection. We rely on these legal bases: performing our contract with you (your account and the reports you request); your consent (advertising cookies and similar technologies, which our certified consent manager asks for before they load, and your sex, health-related selections and work history, which are special or sensitive data we process only with your explicit consent); our legitimate interests (keeping the Service secure and working, and understanding how it is used), balanced against your rights; and legal obligations.

You have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interests or used for direct marketing, and to withdraw consent at any time without affecting earlier processing. You can change your advertising choices through the consent notice, download or delete your data on your account page, or email hello@envyrofax.com; we respond within one month. You may also complain to your local data protection authority (in the UK, the Information Commissioner's Office). Your data is stored and processed in the United States; when it is transferred from the EEA, the UK or Switzerland we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) or another lawful transfer mechanism. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Children

The Service is not directed to children under 13 and accounts are limited to adults 18 and older. We do not knowingly collect information from children.

Changes and contact

We will post updates here and notify account holders of material changes. Contact: hello@envyrofax.com.