California Privacy Notice

This notice supplements our Privacy Policy and applies only to California residents.

Notice for California Residents

This section applies only if you are a California resident. The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you certain rights regarding your personal information. These rights are similar to those we offer all users (see "Your Rights and Choices" in our Privacy Policy), but this notice provides the specific disclosures required under California law.

We do not sell your personal information or share it for cross-context behavioral advertising or targeted advertising purposes (as defined by the CCPA). We have not done so in the past 12 months and do not plan to. We also do not use or disclose sensitive personal information (if any is collected) beyond permitted business purposes that allow no opt-out under the CCPA.

Your California Privacy Rights

You may have the right to:

Know / Access: Request details about the personal information we collect, use, disclose, or sell/share about you, including categories and specific pieces (up to twice in a 12-month period).
Delete: Request deletion of your personal information, subject to legal exceptions (e.g., needed for legal compliance or disputes).
Correct: Request correction of inaccurate personal information we hold.
Opt-Out of Sale/Sharing: Direct us not to sell or share your personal information. As noted, we do not sell or share it for advertising/analytics purposes.
Limit Use of Sensitive Information: If we use sensitive personal information beyond permitted purposes, you can limit it (we do not currently do this).
Non-Discrimination: Exercise these rights without facing discrimination, such as denied service, price increases, or reduced quality (though we may offer different terms for different data practices if permitted).

To exercise these rights, email privacy@castlehq.app with your request. We may verify your identity (e.g., by matching account details or asking for proof) to protect your information. Authorized agents may submit requests on your behalf with proof of authorization and your verification. We respond within 45 days (extendable by 45 days if needed) and provide information free of charge (up to twice yearly; fees may apply for excessive requests).

Categories of Personal Information We Collect and Handle

Over the past 12 months, we have collected the following categories of personal information (as defined by CCPA/CPRA) from California residents:

Identifiers (name, email, organization name, IP address).
Commercial information (billing/subscription details via Paddle, though we don't store card data).
Internet/electronic activity (browser/OS details, page visits, usage patterns for analytics).
Geolocation data (approximate from IP for security/fraud prevention).
Professional/employment info (organization name, role implied from account).
Other information you provide (support messages, feedback, uploaded content like avatars).

We collect this from you directly (account signup, usage, support) and indirectly (analytics tools, hosting logs). We use it to provide/maintain/improve Services, billing, security, and compliance. We disclose it only to service providers (e.g., DigitalOcean, Paddle, Resend, Anthropic/OpenAI) for operational needs, or as required by law. No sales or sharing for advertising purposes have occurred.

For retention details, see "Deletion and Retention Practices" in our Privacy Policy. We keep data only as needed for the purposes described or legal obligations.

Shine the Light Disclosure

Under California's Shine the Light law (Cal. Civ. Code § 1798.83), California residents may request information about our disclosure of certain personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing. To inquire, email privacy@castlehq.app.

If you have questions about this notice or your California rights, contact privacy@castlehq.app.