US State Privacy Notice

This notice supplements our Privacy Policy for individuals in US states with a comprehensive consumer privacy law — including California (CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states whose laws have since come into effect or take effect after this notice was last updated. Where a right described here is specific to one state's law, we honour it for residents of that state; where it isn't specific to any one law, we apply it to all US states as a matter of practice.

Some state laws do not apply to information about people acting in a business or employment capacity, or to businesses below certain size thresholds. We describe our practices here regardless, and we do not claim an exemption as a reason to refuse a request we can reasonably meet.

Notice at collection. This notice, together with our Privacy Policy, is our notice at collection: it describes the personal information we collect, why, how long we keep it, and whether it is sold or shared.

Business contact: Warmerly. Requests under this notice go to our privacy request form or privacy@warmerly.com.

1. Categories of personal information we collect, and to whom we disclose them

In the last 12 months we have collected the categories below, and disclosed each of them for a business purpose to the categories of recipient shown.

We do not collect the following categories, which some state laws also enumerate:

• Protected classification characteristics (race, religion, health, sexual orientation, etc.)
• Biometric identifiers
• Precise (device-level) geolocation
• Government identifiers such as Social Security, driver's licence or passport numbers
• Non-public education records

Beyond the recipients in the table, we may disclose any category to professional advisers, to authorities where the law requires it, to anyone you direct us to, and to a buyer or successor of the business. The service providers we use are listed on our Sub-processors page. Each is bound by a contract that restricts it to processing personal information on our behalf and for our purposes, and prohibits it from selling it or using it for its own purposes.

2. Why we collect and use it

We use each category above for the following business purposes:

• providing the service you signed up for, and the features you use;
• billing, payments and account administration;
• customer support, including our AI support assistant;
• security, integrity, and preventing spam, fraud and abuse;
• finding and fixing errors;
• understanding how our website and product are used, and improving them;
• telling you about Warmerly, where you have agreed to hear from us;
• complying with the law and protecting our legal rights.

We use sensitive personal information only as needed to provide the service you requested, to keep it secure, and for the other purposes the law allows without an opt-out. We do not use it to infer characteristics about you.

3. Selling and sharing

Customer and visitor data. We do not sell the personal information of our customers or website visitors, and we do not share it for cross-context behavioral advertising or use it for targeted advertising. Google Analytics runs only with the advertising consents switched off, and we do not send Google or any advertising platform an identifier tied to your name or email address.

Business-contact data. Our lead finder lets Warmerly customers search, and export for their own outreach, business contact information held in our database — company details, and the email addresses, phone numbers and addresses businesses publish, and, where our email finder has been used, individuals' names and likely work email addresses. Making that information available to customers who pay for our service may be treated as a "sale" under California law. It is not shared for cross-context behavioral advertising. Anyone can opt out of it, and ask for their details to be removed from the database, whichever state they live in — see section 4. What we hold and where it comes from is described in our Prospect Privacy Notice.

We do not knowingly sell or share the personal information of anyone under 16. We do not offer financial incentives or different prices in exchange for personal information.

4. Your rights

Depending on your state of residence, you have the right to:

• Know / access — request the categories of personal information we hold about you, the sources, our purposes, the categories of recipient, and the specific pieces of information. Where your state provides it, you can also ask for a list of the specific third parties we have disclosed it to.
• Correct — request correction of inaccurate personal information.
• Delete — request deletion of your personal information, subject to exceptions (e.g. information we must keep for legal or security reasons).
• Portability — request a copy of your data in a portable format.
• Opt out of sale or sharing — use our privacy request form and choose "Opt out of sale/sharing", or email us. Opt-out requests do not require you to verify your identity.
• Opt out of targeted advertising and profiling — we do not carry out targeted advertising, or profiling that produces legal or similarly significant effects, so there is nothing to opt out of; you may still ask.
• Limit use of sensitive personal information — we use it only for the purposes in section 2 that the law permits, so there is nothing further to limit.
• Non-discrimination — we will not deny you service, charge you a different price, or provide a different level of quality because you exercised a right under this notice, and we will not retaliate against an employee, applicant or contractor for doing so.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing for that browser, and as a standing decline of all non-essential cookies — the analytics and attribution cookies described in our Cookie Policy are not set. No separate request is needed.

How to make a request. Use our privacy request form or email privacy@warmerly.com, and tell us which right you're exercising. If you have an account, write from the email address on it; if you don't, tell us the email address or company domain the request concerns.

Verification. Before acting on a request to know, access, correct or delete, we verify it by matching it to information we already hold — usually by confirming that you control the email address concerned. We use anything you give us for verification only for that purpose. If we cannot verify a request, we will tell you why.

Timing. We confirm receipt within 10 business days and respond within 45 days, with one 45-day extension where the law allows it and we tell you why. We act on opt-out requests as soon as we can, and within 15 business days.

5. Appeals

If we decline a request — in whole or in part — you can appeal by replying to our decision email, or emailing privacy@warmerly.com with "Appeal" in the subject line and the original request. We will respond to an appeal within 45 days, or within any longer period your state allows where we tell you we need it. If we uphold our original decision, we will explain why and tell you how to contact your state Attorney General or other regulator.

6. Authorized agents

You may use an authorized agent to submit a request on your behalf. To act on a request, we need: (a) written proof that you have authorized the agent to act for you (a signed permission statement is sufficient), and (b) confirmation directly from you that you authorized the agent, which we may seek by contacting you at the email address on your account. We may deny a request from an agent who cannot provide both. This does not apply where the agent holds a valid power of attorney, or where the request is to opt out.

7. Retention

We retain personal information for the periods set out in our Privacy Policy §8 (or, for business-contact data, our Prospect Privacy Notice §5) — those are the same retention schedules that apply under this notice; we don't keep a separate, longer schedule for US residents.

8. Changes

We will post any updates to this notice on this page and update the date above. Material changes will be notified by email where we have one for you.

9. Contact

Warmerly. Email privacy@warmerly.com for any request or question under this notice.