California Privacy Notice (CCPA / CPRA)
This Notice supplements our Privacy Policy and applies to California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).
1. Categories of personal information we collect
| CCPA category | Examples we collect | Source |
|---|---|---|
| Identifiers | Name, email, phone, IP (hashed) | You (forms), automatically (server logs) |
| Customer records | Lead inquiry contents, review submissions | You |
| Commercial information | Lead purchase history (advertisers only) | You |
| Internet activity | Pages viewed, referrers, device type, aggregated analytics | Automatically |
| Geolocation (general) | City/state inferred from IP (never precise GPS) | Automatically |
| Inferences | Event-planning intent (category, city, budget band) | Derived from your lead submissions |
We do not collect: biometric information, sensitive personal information beyond what's listed (no race, religion, union membership, sexual orientation, etc.), education / employment records, or precise geolocation.
2. Purposes of collection
See Privacy Policy §2. In short: provide the directory and lead service, prevent fraud, comply with law, improve the Site.
3. Sale and sharing of personal information
Under CCPA/CPRA definitions, we do not "sell" personal information for monetary value. We do "share" personal information in two narrow ways:
- With venue advertisers who purchase your lead. This is consensual sharing — you explicitly requested quotes from venues in your category and city, and the TCPA consent checkbox covers the disclosure.
- With limited service providers (Cloudflare, Resend, Twilio, Stripe, GA4) acting on our behalf under contractual confidentiality. CCPA does not classify these as "sales" or "sharing".
We do not share information for cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals from California visitors as an opt-out request — see §6 below.
4. Your CCPA / CPRA rights
If you are a California resident, you have the right to:
- Know what personal information we have collected about you, the categories of sources, the purposes, and the categories of third parties we shared it with.
- Delete personal information we have collected from you (subject to legal exceptions, e.g., TCPA retention).
- Correct inaccurate personal information.
- Opt out of the "sale" or "sharing" of personal information.
- Limit use of sensitive personal information (we don't collect any beyond what §1 above lists).
- Non-discrimination — we will not deny service, charge different prices, or provide a different level of service because you exercised any of these rights.
- Data portability — receive your information in a structured, machine-readable format.
5. How to exercise your rights
- Submit a request via the Privacy Requests portal (preferred — fastest).
- Or email [email protected] with subject "CCPA Request" and your request type.
We verify identity via email magic link plus one additional piece of information (last 4 of phone on file, OR last lead/invoice ID, OR a selfie holding government ID for higher-risk requests). We acknowledge requests within 10 days and fulfill within 45 days. We may extend by another 45 days when reasonably necessary (with notice to you).
You may also designate an authorized agent in writing. Provide written permission and an identity proof for the agent.
6. Global Privacy Control (GPC)
We honor the Global Privacy Control
browser signal (HTTP Sec-GPC: 1 header) as a valid opt-out
of "sale" and "sharing" for California residents. When detected, we
automatically apply the opt-out and display a confirmation in the footer.
No further action required from you.
7. "Do Not Sell or Share My Personal Information"
Every page of this Site carries a "Do Not Sell or Share My Personal Information" link in the footer. It goes to Cookie Preferences § Do Not Sell or Share, where one click opts your browser out of the advertising and analytics categories, including any cross-context behavioral advertising that counts as "sharing" under the CPRA. We do not sell personal information for money.
The opt-out is stored in your browser (the corp_consent
cookie), so it applies per browser and per device. To opt out across all of
them at once, enable Global Privacy Control (§6) — we honor it on arrival,
with no interaction needed. To act under your name rather than your browser,
use Data requests.
8. Retention
See Privacy Policy §6.
9. Children's information
We do not knowingly collect personal information from California residents under 16. If you believe we have, contact [email protected] and we will delete promptly.
10. Contact
California-specific questions: [email protected] (subject "CCPA").
11. Annual disclosures
In the prior 12 months, we have not "sold" personal information of California residents. We have "shared" personal information for the purposes described in §3 above. We do not disclose California residents' personal information for direct marketing purposes (no "Shine the Light" disclosures to make).