Privacy rights

DRAFT — Under legal review. This text is pending Guilherme's legal review. It is published while that review is open, and it may change. It is not legal advice. A placeholder in square brackets is for counsel to complete before this notice comes down.

How to use this page

This page is the request channel for privacy rights, including the right to opt out of sale or sharing. It is at /privacy/do-not-sell. The full notice of categories, purposes, and retention is the Privacy page. The link "Do Not Sell or Share My Personal Information" opens this page so you can read the choice and send it. It does not sell anything, and sending the form is not a purchase.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. You can still tell us not to. If we later start a sale or a share, a request we already have will be treated as an opt-out of that sale or share.

The form on this page emails the privacy contact. This draft does not store the message in the product and does not write the body to a log. [LAWYER: replace this sentence when a privacy-request record exists. Do not log the body.]

United States

If the CCPA or another US state privacy law applies to you, you may ask:

• to know the categories and the specific pieces of personal information we collected about you, the sources, the purposes, and the categories of third parties we disclosed it to
• to know that we did not sell or share it
• to correct inaccurate personal information
• to delete personal information, subject to the legal exceptions below
• to opt out of sale or sharing, which this page does
• not to be discriminated against for asking
• to appeal a refusal, by replying to the privacy contact [LAWYER: some states require a formal appeal. Name the states and the appeal deadline.]

We will answer a CCPA request within 45 days. We may take another 45 days if the request is complex, and we will tell you why inside the first 45 days. We do not charge a fee unless the request is manifestly unfounded or excessive. [LAWYER: confirm you want that statutory fee exception.]

An account administrator can download the ZIP export of their own account from Settings. That export is the access and portability path for the account. It does not include password hashes or session tokens. Correct the signed-in profile in Settings.

Do Not Sell or Share

"Sell" and "share" have the CCPA meanings. Share means disclosing personal information for cross-context behavioral advertising, whether or not money changes hands. A disclosure to Hostinger, to Stripe, or to [LAWYER: legal name of the transactional email provider], limited to hosting, payment, or email, is not a sale and is not a share when the contract forbids those providers from using the data for their own purposes.

Sending the form means: do not sell my personal information, and do not share it. We will honor that for the email address you give us. If we cannot match the email to an account, we still will not sell or share the details in the form, because we do not sell or share, and we do not keep the form.

We do not use sensitive personal information for a purpose that needs a separate limit request. The Privacy page explains that. [LAWYER: add a limit request on this form if that conclusion changes.]

Brazil

If the LGPD applies, you may ask the controller for:

• confirmation that we process your data, and access to it
• correction of incomplete, inaccurate, or outdated data
• anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed out of compliance
• portability to another provider, as the ANPD regulates it
• deletion of data processed on the basis of consent
• information about the public and private bodies with which we shared data
• information about the possibility of not consenting, and about the consequences
• revocation of consent, where consent was the basis
• review of a decision made solely by automated processing that affects your interests [LAWYER: the product does not make solely automated decisions about a person. Say so if that remains true.]

We will give a simplified confirmation promptly, and a complete declaration within 15 days of the request (LGPD Article 19). [LAWYER: if you rely on the small-agent rule, the simplified form may also take 15 days.]

Where we are only the processor of data a business stored, we will pass the request to that business, which is the controller, unless you are asking about your Nozzara user account.

You may also complain to the ANPD at https://www.gov.br/anpd.

What we need in order to act

Tell us the email address of the account, or the email address you want us to search. We match that address to the account. We may ask a second question only if we cannot reasonably match you. We will not ask for a copy of a government identity document in this draft. [LAWYER: set the verification standard. CCPA regulations forbid a burden that is heavier than the sensitivity of the data.]

Authorized agents

An authorized agent may send the form for you. In the note, the agent gives their name, the person's name, and whether they hold a power of attorney. We may ask the person to confirm that the agent is allowed to act, or ask the agent for signed permission, before we treat a know, correct, or delete request as the person's request (California Code of Regulations, title 11, section 7063).

For a Do Not Sell or Share request, we may take the request from the agent and confirm it with the person. A power of attorney under the probate law does not need that extra confirmation. [LAWYER: confirm this matches the current regulation.]

Under the LGPD, a legal representative may exercise the data subject's rights. We may ask for evidence of that authority.

What this draft does not delete

A deletion request is not carried out in this build. The form, or an email to the privacy contact, is the request. The account, the subscription, and the data stay. Downgrade, the end of a trial, and suspension also do not delete data.

When deletion is later carried out, we will delete personal information we are not required to keep. We may keep billing, tax, security, and dispute records for the periods on the Privacy page, and we may keep a backup until the backup cycle ends. [LAWYER: do not publish the deletion promise until the product can keep it. Do not publish "we do not delete" as the final policy.]

Non-discrimination

We will not deny the service, charge a different price, or provide a different level of service because you exercised a privacy right. Plan limits and unpaid invoices are not discrimination.

Contact

Email the privacy contact shown on the Privacy page, or use the form on this page. The encarregado is [LAWYER: name, or the small-agent waiver and this same email]. The postal address is [LAWYER: postal address].