US State Privacy Rights

This notice supplements our main Privacy Notice and explains the rights US residents have under state privacy laws including the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), the Texas Data Privacy and Security Act ("TDPSA"), and the comprehensive privacy laws of Oregon, Montana, Iowa, Tennessee, Indiana, Florida, Delaware, New Hampshire, New Jersey, Kentucky, Maryland, Minnesota, and Rhode Island.

1. Categories of personal information we collect

In the past 12 months we have collected the following categories of personal information from US residents, as defined by California Civil Code Section 1798.140:

• Identifiers — name, work email, IP address, account identifier.
• Customer records — billing contact, company name.
• Commercial information — purchase history, plan tier.
• Internet / network activity — pages viewed, queries run (when analytics consent given).
• Geolocation — approximate (city-level) derived from IP only.
• Inferences — none; we do not build behavioural profiles.
• Sensitive personal information — none collected for inferential purposes.

2. Sources, purposes, and recipients

Sources, purposes, and recipients are described in detail in our Privacy Notice sections 2-4. In summary: we collect from you directly, we use it to operate and improve the Service, and we share only with the sub-processors listed and only as needed to deliver the Service.

3. Your rights

Depending on the state where you reside, you have one or more of the following rights:

• Right to know / access the categories and specific pieces of personal information we have collected, the sources, the purposes, and the recipients.
• Right to delete personal information we have collected from you, subject to statutory exceptions (e.g. fraud prevention, legal hold).
• Right to correct inaccurate personal information.
• Right to data portability in a structured, commonly-used, machine-readable format.
• Right to opt out of sale or sharing of personal information. We do not sell or share.
• Right to opt out of targeted advertising. We do not engage in targeted advertising.
• Right to limit use of sensitive personal information (CPRA).
• Right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects. We do not engage in such profiling.
• Right to appeal a decision we make about your request (VA, CO, CT, MT, OR, TX, TN, IN, FL, DE, NH, NJ, KY, MD, MN, RI).
• Right to non-discrimination — we will not deny goods or services, charge different prices, or provide different quality because you exercised a privacy right.

4. How to exercise your rights

Email privacy@zenzolabs.com with the subject line "US Privacy Request". Tell us:

• Which right you are exercising;
• Your state of residence;
• Enough information for us to verify your identity (we will not use this information for any other purpose).

We respond within 45 days (CCPA/CPRA, VCDPA, CPA, CTDPA, others) and may extend once by 45 days where reasonably necessary. If we deny your request, we will explain why and how to appeal.

4.1 Authorised agents (California)

California residents may use an authorised agent to submit a request. We will verify the agent's authority (signed permission from you) and your identity before responding.

4.2 "Shine the Light" (California Civil Code Section 1798.83)

California residents may request a list of third parties to whom we disclosed personal information for those third parties' direct-marketing purposes in the preceding calendar year. We do not make such disclosures.

5. Global Privacy Control (GPC)

We honour the Global Privacy Control ("GPC") browser signal. When your browser sends a GPC signal we automatically treat it as an opt-out of sale, sharing, and targeted advertising for your browser, even though we do not sell, share, or advertise in this way. Learn more at globalprivacycontrol.org.

6. Do Not Sell or Share My Personal Information

We do not sell or share personal information for cross-context behavioural advertising. There is therefore nothing to opt out of. If our practice changes we will update this notice and provide an opt-out mechanism with at least 30 days' notice.

7. Children's information

The Service is a business-to-business product and is not directed to anyone under 16. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact privacy@zenzolabs.com and we will delete it.

8. Data retention

We retain US personal information for the durations described in Privacy Notice section 6. We do not retain personal information longer than is reasonably necessary for the purposes we collected it for.

9. Breach notification

If a security breach affects your personal information we will notify you in line with applicable state breach-notification law (typically without unreasonable delay and no later than 30-60 days depending on the state). Where required, we will also notify the relevant state Attorney General.

10. Contact & complaints

• Privacy contact: privacy@zenzolabs.com
• California residents may also complain to the California Privacy Protection Agency at cppa.ca.gov.
• Residents of other states may complain to their state Attorney General's consumer-protection office.