Binding policy. Plain language where we can. No surprises buried in footnotes.Last updated: 2026-04-23
We publish changes here before they take effect.
This notice supplements our Privacy Policy and applies to California residents under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
Your rights
If you are a California resident you may:
Know what personal information we hold about you, including the categories, sources, purposes of use, and sub-processors we share it with.
Access a copy of your personal information in a portable, machine-readable format.
Delete your personal information, subject to the narrow legal exceptions below.
Correct inaccurate personal information.
Opt out of sale or sharing of your personal information. There is nothing here for that right to switch off: Confinity does not "sell" personal information, and does not "share" it for cross-context behavioural advertising. We do not currently read the Global Privacy Control (GPC) header, because we hold no sale-or-share processing for it to stop; if that ever changes, honouring GPC ships in the same release as the change.
Limit use of sensitive personal information. Confinity processes sensitive personal information only to operate the service you requested; we never use it for marketing inference.
Be free from retaliation for exercising these rights.
How to exercise a right
Sign in and open Settings → Privacy. Two of these rights are self-service there: Request an export gives you a portable copy of your data, and Delete your account starts a deletion with a 7-day window in which you can call it off. For correction, or for an access request in some other form, email privacy@confinity.com and a person handles it.If you cannot sign in (for example because you have lost access), email privacy@confinity.com from the email on file, or from a verifiable parent/guardian account for minors. We ask for enough information to match your identity to the account and no more.We respond to verified requests inside the 45-day statutory window, plus a 45-day extension where necessary. We will email you before taking any extension.
Authorised agents
You can designate an authorised agent to make a request on your behalf. The agent must provide their written authorisation and we may separately verify the consumer's identity.
Opt-out signals
We do not read the Global Privacy Control (GPC) signal today. Nothing in our stack inspects it. This section previously said we honoured it, which contradicted the paragraph above and was wrong on its own terms: there is currently no sale-or-share processing for GPC to switch off. If that ever changes, GPC handling ships in the same release as the change rather than after it.
Categories of personal information
The categories we collect, the sources, the purposes, and the recipients are listed in our Privacy Policy and Sub-processors page. Please keep those pages open alongside this one if you are preparing a formal DSAR.
Legal exceptions to deletion
Even after a valid deletion request we may retain the minimum personal information required to:
Complete the transaction for which the data was collected.
Detect or prevent security incidents, fraud, or illegal activity.
Comply with a legal obligation.
Enable internal uses compatible with the context in which the information was provided.
We do not use "legitimate business purpose" as a generic excuse to retain content; any retention we do is named and bounded.
Contact
privacy@confinity.com. Mark the subject line "CCPA" so the request is routed to the DSAR queue.