California Privacy Rights Notice
California residents, if CCPA as amended by CPRA applies to us. This notice supplements the Privacy Policy with the CCPA-prescribed categories, sources, purposes, recipients, retention and rights. Where it conflicts with the global text for California residents, this notice prevails.
Draft for legal review
This document is an implementation draft written to match how the product actually behaves. It has not been reviewed by a qualified lawyer and must not be relied on as legal advice. Items marked or are unresolved.
1. Applicability — conditional (do not assume)
[LEGAL REVIEW REQUIRED — OWNER INPUT REQUIRED] Whether Zdefence is a 'business' under Cal. Civ. Code §1798.140 (>$25M revenue, or buying/selling/sharing data of 100,000+ consumers/households, or 50%+ revenue from selling/sharing) is not established from the repository. The owner must confirm revenue/volume before this notice is treated as mandatory. We publish it regardless as a defensive transparency measure, and we honour its rights regardless of threshold.
If thresholds are not met, CCPA obligations are not triggered, but we still provide notice at collection, GPC handling, and the /legal/your-privacy-choices opt-out as good practice.
2. Categories of personal information we collect (CCPA §1798.100(b))
Identifiers: email address, name (optional), Clerk user ID, hashed network-address reference, user-agent family, slot number. Commercial information: platform interest, waitlist status. Internet activity: none collected today (no analytics/pixels). Geolocation: none (no precise location on website). Sensory: none. Professional/employment: optional role/company string. Inferences: none drawn. Sensitive personal information (Civ. Code §1798.140(ae)): none collected on the website today.
Sources: directly from you (forms, preferences, requests); automatically (hashed IP, user-agent, timestamps); from service providers (Clerk verification, Supabase confirmations). We do not collect from data brokers.
Purposes: waitlist operation, contact response, authentication, consent proof, abuse prevention, security logging, launch updates only with opt-in. See Privacy Policy Section 6 for the exhaustive list.
Recipients: Supabase (database/storage), Clerk (identity), hosting/CDN (transit). No sale, no sharing for cross-context behavioural advertising. Retention: waitlist 24m/launch+6m, contact 12m, abuse metadata 90d, consent proof relationship+3y, cookie choices 12m, logs 30d — see Privacy Policy Section 16.
3. Your CCPA rights
Right to know/access (specific pieces + categories, sources, purposes, recipients, retention). Right to delete (subject to §1798.105 exceptions such as security, legal compliance, consent proof). Right to correct inaccurate data. Right to opt out of sale/sharing (we do not sell/share today; opt-out at /legal/your-privacy-choices, no account required, GPC honoured + confirmed). Right to limit use/disclosure of sensitive personal information (none collected today; mechanism ready). Right to non-discrimination for exercising rights. Right to appeal a denial and to complain to the AG/CPPA.
- How to exercise: /privacy-center or privacy@zdefence.com. Verification: email-ownership check (minimum necessary). Authorised agents: accepted with your signed permission + identity proof.
- Response: 45 days (extendable once by 45 days with notice). Format: portable JSON + CSV where applicable; original uploads where relevant.
- Metrics (once applicable): requests received/complied/denied + median response time will be published per CPPA reporting expectations.
4. Sale/sharing, GPC and 'Your Privacy Choices'
We do not sell or share as defined. If that changes, this notice, the Privacy Policy Section 13, /legal/your-privacy-choices and the consent engine will be updated before the change, GPC (Sec-GPC: 1) will be honoured as a valid opt-out with visible confirmation, and the 2026 CCPA regulations on opt-out signals will be applied.
5. Minors, retention and non-discrimination
Under-16 sale/sharing requires opt-in (under-13 parental opt-in). We do not sell/share any minor's data today. Retention is no longer than reasonably necessary for each disclosed purpose. We never discriminate, deny service, charge differently or degrade quality for exercising a CCPA right.
6. Contact and version
privacy@zdefence.com; /privacy-center; /legal/legal-contact (AG/CPPA links). Version 0.9.0-draft, last updated 2026-10-02, next review 2026-12-01, LEGAL REVIEW REQUIRED.
Sources
This document is derived from the following entries in our legal source registry: US-CA-CCPA, US-CA-GPC. See for the full citations and the date each source was last verified.