US State Privacy Addendum

US state privacy laws apply only if the business meets that state's thresholds (typically a revenue threshold and/or a volume of consumers whose data is processed or sold) AND the individual is a resident of that state. Whether a given threshold applies to us is a SCOPE question answered in compliance/applicability-matrix.md, not by guessing from a visitor's location. [LEGAL REVIEW REQUIRED — confirm thresholds per state.]

Because thresholds and definitions differ, we apply a single, more protective baseline to all US residents covered here, and we honour Global Privacy Control (GPC) as a binding opt-out of sale/sharing where the state requires it.

We do not assert a state-specific right or deadline that has not been verified against the state's official statute or regulator. Unverified provisions are labelled and listed in compliance/jurisdictions/us.md and the legal-review package.

• California — CCPA/CPRA (see the dedicated California notice at /legal/california-notice).
• Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, New Hampshire, New Jersey, Kentucky, Maryland, Minnesota, Rhode Island, and any others that have enacted comprehensive consumer privacy laws. Verify current effective status and amendments with counsel; new laws and amendments are frequent. [LEGAL REVIEW REQUIRED]

Mechanisms: /privacy-center and the /api/privacy/* endpoints (access, delete, correct, export, opt-out, complaint). No account is required. Identity verification uses the minimum necessary (email ownership) and never requests government ID for an ordinary request.

• Right to know / access the categories and specific pieces of personal information we hold.
• Right to delete, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to data portability (a machine-readable copy).
• Right to opt out of 'sale' and 'sharing' (including targeted advertising) — we state factually whether we sell or share; today we do not.
• Right to limit use of sensitive personal information (where the state provides it).
• Right to non-discrimination for exercising a right.
• Right to appeal a refusal (where the state provides it).

The Privacy Policy serves as the notice at collection; the categories collected, purposes and recipients are listed there and in compliance/data-processing-registry.json. Where a state requires a 'Do Not Sell or Share My Personal Information' link, it is provided through /legal/your-privacy-choices and /privacy-center. We do not sell personal information as defined today; if that changes, this section and the notice are updated and re-accepted before the change takes effect.

We do not process sensitive personal information for the purpose of inferring characteristics except as described in the Privacy Policy. Children's data handling is governed by the Age Policy (/legal/age-policy) and is an unresolved OWNER INPUT REQUIRED decision (see compliance/regulatory-review.md).

We respond within the timeframe each state requires (commonly 45 days, extendable where permitted). If we deny a request, we explain the legal basis without revealing another person's data, and we provide an appeal route where the state requires one. [LEGAL REVIEW REQUIRED — confirm per-state response and appeal windows.]