Template · PRIVACY POLICY

Privacy policy · US multi-state (CCPA/CPRA · VCDPA · TDPSA · CO/CT)

Template body

# Privacy Policy

**Effective date:** {{effective_date}}
**Last reviewed:** {{last_reviewed}}

## 1. Scope
This policy applies to {{site_domain}}, operated by {{controller_name}}. It addresses the requirements of California (CCPA/CPRA), Virginia (VCDPA), Texas (TDPSA), Colorado (CPA), Connecticut (CTDPA), and other US state privacy laws as they come into force.

## 2. Categories of personal information collected (last 12 months)

| Category | Examples | Source | Purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, email, IP | You + auto | Account, support | Hosting, email vendor |
| Internet activity | Page views, clicks | Auto | Analytics | Analytics vendor |
| Commercial info | Purchase history | You | Order fulfilment | Payment processor |
| Geolocation | City-level (from IP) | Auto | Localisation | None |
| Sensitive PI | None collected | — | — | — |

## 3. Sale and sharing of personal information
We do **not** sell personal information for monetary value. We **do share** identifiers and internet activity for cross-context behavioural advertising. You may opt out via:

- The link [Do Not Sell or Share My Personal Information](/privacy/dont-sell-or-share/)
- A Global Privacy Control (GPC) browser signal — automatically honoured
- An IAB GPP universal opt-out signal (`usnatv1`)

## 4. Your rights

| Right | California | Virginia | Texas | CO/CT |
|---|---|---|---|---|
| Know / Access | Yes | Yes | Yes | Yes |
| Delete | Yes | Yes | Yes | Yes |
| Correct | Yes | Yes | Yes | Yes |
| Opt-out of sale/share | Yes | Yes | Yes | Yes |
| Opt-out of profiling | Yes (ad-related) | Yes | Yes | Yes |
| Limit use of sensitive PI | Yes | — | — | — |
| Universal opt-out (GPC/UOOM) | Mandatory | Optional | Mandatory | Mandatory |

To exercise, submit a request via {{dsr_url}} or email {{dsr_email}}. We respond within 45 days. We do not discriminate based on requests.

## 5. Retention
{{retention_section}}

## 6. Sensitive personal information
Per CPRA §1798.121: we do not collect sensitive PI as defined. If we did, we would limit its use to disclosed purposes only.

## 7. Children
We do not knowingly collect data from anyone under 16 without verifiable parental consent (where required).

## 8. Notice of right to financial incentives
{{financial_incentive_section_or_none}}

## 9. Authorized agents
California residents may use authorized agents per §1798.130. We require power-of-attorney verification.

## 10. Changes
Material changes will be notified by email and updated here.

## 11. Contact
{{controller_name}}, {{controller_address}}. Email: {{privacy_email}}.

Variables to fill in