US Privacy Notice

Who this notice is for

This notice adds to our Privacy Policy for residents of the United States. It covers the California Consumer Privacy Act as amended by the CPRA (CCPA), the California Online Privacy Protection Act (CalOPPA), and the consumer privacy laws of other states, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others.

Several of these laws apply only to businesses above certain size or data-volume thresholds, which DevProofs may not meet. We give the rights below to every US resident anyway.

Information we collect

In the past 12 months we have collected these categories of personal information:

We do not collect sensitive personal information, such as Social Security numbers, financial account logins, precise geolocation, or health or biometric data. Card payments are handled by Stripe or PayPal, and we never see full card numbers. We disclose each category to our service providers (Cloudflare, Google, Anthropic and, for payments, Stripe or PayPal) for the business purposes above. Retention periods are listed in ourPrivacy Policy.

No sale or sharing

We do not sell personal information, and we do not share it for cross-context behavioral advertising.We have not done so in the past 12 months. We do not use personal information for targeted advertising or for profiling that produces legal or similarly significant effects, and we have no actual knowledge of selling or sharing data of anyone under 16.

Your state privacy rights

• Know and access: the categories and specific pieces of personal information we hold about you, its sources, purposes, and who we disclose it to.
• Delete: personal information we collected from you, subject to legal exceptions, such as invoices we must keep.
• Correct: inaccurate personal information.
• Portability: receive your information in a portable, readily usable format.
• Opt out: of the sale or sharing of personal information, targeted advertising and profiling. We do none of these, but you may still send the request and we will record it.
• Limit sensitive personal information: we don't collect any.
• Non-discrimination: we will not deny you services, charge different prices, or provide a different quality of service because you used these rights.

Making a request

1. Email hello@devproofs.com with the subject "US privacy request". Tell us which right you want to use and your state of residence.
2. We confirm receipt within 10 business days. We verify your identity by matching information we already hold, usually a reply from your email address. We will never ask for sensitive documents.
3. We respond within 45 days. If we need more time, we may extend this once by up to 45 days and will tell you why.
4. Authorized agents may make a request on your behalf with your signed permission. We may still ask you to confirm your identity directly.
5. Appeals: if we decline your request, reply with the word "Appeal" within 60 days. We decide appeals within 45 days (60 days in Colorado). If you disagree with the outcome, you may contact your state Attorney General.

California disclosures

• CalOPPA: this notice and our Privacy Policy describe what we collect, who we share it with, how you can review and change your information, how we respond to Do Not Track signals, and how we tell you about changes (by updating the date at the top of the page).
• Shine the Light (Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their own direct marketing.
• Metrics: we will publish request metrics here if we ever become required to under Cal. Code Regs. tit. 11, § 7102.

Global Privacy Control and Do Not Track

We honor the Global Privacy Control (GPC) signal automatically. When your browser sends it, we treat it as a valid request to opt out of the sale and sharing of your personal information and turn off all optional cookies, with no account or form needed. We treat Do Not Track signals the same way. We don't track visitors across third-party websites over time.

Emails, calls and texts

• CAN-SPAM: our business emails identify us, use honest subject lines, include our postal address, and tell you how to opt out. Reply "no thanks" and we stop within 10 business days, usually the same day.
• TCPA: we do not make automated or prerecorded calls or send automated texts. Giving us your phone number on our form only lets us call you about your request.

Children (COPPA)

This website and our services are for businesses and are not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has sent us information, email us and we will delete it.