What leaves your PC, and why.

Genie9 Ltd (“Genie9”, “we”), 20-22 Wenlock Road, London, N1 7GU, United Kingdom, company number 07787114, makes Genie Backup Manager AI (“GBM AI”, “the app”) and runs genie9.com. For the personal data described here, Genie9 is the controller.

This notice covers the app and the parts of genie9.com that serve it: the download, the store, your account page, Ask Genie and the e-mails we send about a licence or a trial. The Genie9 privacy policy and cookie policy cover the rest of the website. Where they differ for GBM AI, this notice applies; their parts about cloud backup, files kept in our data centres and face data do not apply to GBM AI.

Your backups never reach Genie9. The app writes them only to the destinations you choose: a disk, a USB drive, a network share or your own S3 bucket. Your jobs, settings, the Find index, the run history and the logs stay on your PC.

Passwords, share credentials, S3 keys and mail-server secrets are sealed on your PC with Windows data protection, and your sign-in token is kept in Windows Credential Manager. None of them is sent to Genie9.

No telemetry. The app sends no usage statistics, crash reports or analytics. A support bundle is a file you create, read and send yourself, and it holds no secrets.

The app talks to Genie9 only for the features below. Backing up, restoring and Find never do.

“This PC’s id” is a fingerprint the app derives from the PC, so a licence seat and a trial can be tied to one machine. “This PC’s name” is its Windows computer name.

Ask Genie turns a sentence into a backup job. When you press Send, the app sends the following to Genie9’s server, which passes it to OpenAI, the provider of the language model, to write the answer, and returns the answer to the app:

• your prompt, and the conversation so far;
• your edition and trial state, the Windows version and architecture, and the app’s language;
• each drive’s letter, label, kind (internal, USB, network or cloud), role, size and free space;
• the names of the top-level folders on internal drives, each with an item count, a date and a content hint (such as photos, code or documents). Nothing below the top level, and nothing from USB, network or cloud drives. This is on by default; turn it off under Settings ▸ General ▸ Ask Genie;
• your existing jobs: each one’s name, what it backs up (its folders, or files you ticked one by one), destination, type, schedule, whether it is encrypted, retention, health, sets and size, and its last runs as counts, error codes and skip reasons, without file names;
• if you use “Ask Genie why” on a skipped file in a run report, that one file’s path.

Never sent: your Windows user name, your PC’s name, a list of the files in your folders, the contents of any file, passwords or keys.

What Genie9 keeps. A record that you asked: your account e-mail, the PC, the month, the number of tokens used and the length of your prompt. It is used to count your monthly allowance and our costs. Genie9 does not keep the text of your prompts or of Genie’s answers.

What OpenAI does with it. OpenAI processes the request for Genie9 under its API terms. Data sent through its API is not used to train its models, and OpenAI may keep it for up to 30 days to monitor for abuse, then deletes it.

Ask Genie needs a sign-in and an internet connection. Backing up and restoring never need a sign-in.

The app can e-mail you after a run. With “Genie9 sends it” (a purchased Home or Pro licence, signed in), the app sends the message to Genie9’s server, and we deliver it to your sign-in address only, through our e-mail provider. It holds this PC’s name, the job and its result, when it ran, the destination and the set, the file and verification counts, and the paths of the first 50 skipped files with their reasons. The run log is attached only if “Attach the run log” is on; from version 10.0.56 it starts off.

Genie9 keeps a line for each alert, to apply the sending limits: your e-mail, the PC’s id, the subject, the size, whether a log was attached, and whether it was delivered. We do not keep the message itself.

With “My own mail server”, the same e-mail goes through the SMTP server you set up, and never touches Genie9.

Signing in, in the app or on your account page, needs only your e-mail address. We send a code, and when you use it we record a session with your e-mail, the IP address and the app or browser it came from; it lasts up to 90 days. We refuse disposable and some alias addresses to stop abuse of the trial and of Ask Genie.

A licence record holds the key, the edition, the e-mail it is registered to, the name given at purchase, when its updates window ends, and the PCs it is active on (each PC’s id, name, Windows and its architecture, app version, and when it was last seen). The first time you use Ask Genie on a trial, we record the date against your account, so a trial’s allowance cannot be claimed twice.

Payments are handled by Stripe. Your card details go to Stripe, never to Genie9. Stripe gives us what we need to issue the licence, the invoice and any refund: your name, e-mail address, billing address (country and, where tax needs it, postcode) and the payment’s status, amount and tax. If you bought from the app, the store link also carries a short id of that PC, so the licence can switch on there by itself.

These are service messages about something you asked for, or a licence or trial you hold:

• sign-in codes;
• your licence key after a purchase, and a confirmation when you renew;
• renewal reminders, to the licence’s registered e-mail, 30 days and 7 days before its updates window ends, and on the day it ends;
• trial reminders, to the signed-in account of a PC on a trial, when 3 days are left and on the day it ends. A PC that never signs in gets none;
• alert e-mails, if you chose “Genie9 sends it”.

We do not send marketing e-mails because you use GBM AI. To stop reminders, tell us.

We share personal data only with providers that process it for us, under contract and on our instructions:

• OpenAI, in the United States — answers Ask Genie requests (section 4);
• Stripe, in the United States and Ireland — takes payments and refunds, and works out tax (section 7);
• our hosting and storage providers, such as Amazon Web Services in the United States, which run genie9.com, its database and its files;
• our e-mail delivery provider, which delivers the e-mails in section 8.

Some of them process data in the United States or in other countries outside the UK and the European Economic Area. When data goes there, we rely on a safeguard the law recognises, such as an adequacy decision (including the UK–US data bridge and the EU–US Data Privacy Framework), standard contractual clauses, or the UK international data transfer agreement or addendum.

We may also disclose personal data when the law requires it, to establish or defend legal claims, or to a company that takes over our business, which would then be bound by this notice. We do not sell personal data, or share it for advertising.

• To provide what you asked for (a contract with you): sign-in, licences, updates, Ask Genie, alert e-mails and support.
• Our legitimate interests: keeping the services secure, preventing fraud and abuse, one trial per PC, sending limits and allowances, reminders about a licence or trial you hold, and establishing or defending legal claims.
• Legal obligations: keeping purchase and tax records, and working out tax on a purchase.

• Sign-in codes expire after 30 minutes; a sign-in session after at most 90 days.
• Licence and purchase records: while the licence exists, and then as long as tax and accounting law requires.
• Ask Genie and alert records (no text): while your account exists, to count allowances, limits and costs.
• OpenAI: up to 30 days, as section 4 says.

You can ask for a copy of the personal data we hold about you, and for it to be corrected, deleted or restricted; you can object to processing based on our legitimate interests, and ask for your data in a portable form. Contact us or write to info@genie9.com. Deleting your account does not touch the app on your PC or your backups.

You can also complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the European Union, the authority of the country you live in.

When the app starts to send something new, or we change this notice, we publish it here first, with a new date.