California Consumer Privacy Statement

Effective Date; Last Updated: September 24, 2026

This California Consumer Privacy Statement describes how Right Side Up and its subsidiaries (collectively, “Right Side Up,” “we,” “our,” and “us”) process personal information about residents of California. This Statement applies to you if you are a resident of California under the California Consumer Privacy Act, as amended, along with its implementing regulations (collectively the “CCPA”). Unless preempted by a superseding law, this section will apply in addition to provisions within Right Side Up’s Privacy Policy that may be applicable to California residents.

For purposes of this section, “personal information” has the meaning given in the CCPA but does not include information exempted from the scope of the CCPA. In some cases, we may provide a different privacy notice to certain categories of California residents, such as employees, contractors, and job applicants, in which case that notice will control.

This Statement applies to personal information we collect:

When you visit or use websites or portals operated by us or software applications;
Contact our customer service team;
Communicate with us; or
Otherwise interact with us.

If you have any questions, please contact us using the information provided under the Contact Us section below.

BY USING THE SITE OR OTHERWISE PROVIDING US WITH PERSONAL INFORMATION, YOU ARE CONSENTING TO THIS STATEMENT. PLEASE READ IT CAREFULLY.

1. Personal Information We Collect

In the twelve months preceding the effective date of this Statement, we have collected the following personal information from the sources set forth below:

Identifiers, such as your name, email address, phone number, home or postal address, driver’s license number, username, preferences; classification information, such as, for example, age and gender; and any other information that you add to or is associated with your account.
Commercial Information, such as service-related communications, or other communications we exchange when you contact us with questions, feedback, for support or otherwise, which may include recordings of customer support calls where permitted by law.
Location Information, such as your rough geo-location based upon your device’s IP address.
Online Activity Data, such as pages or screens you viewed, how long you spent on a page or screen, the online services you visited before browsing to the service, navigation paths between pages or screens, information about your activity on a page or screen, access dates and times, and duration of access.
Device Data, such as your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type, IP address, unique identifiers, language settings, mobile device carrier, radio/network information, and general location information derived from your IP address, such as city, state or region.
Inferential Information derived from personal information used to generate information about likely preferences or other characteristics about you.
Other Information we may collect which is not specifically listed here but compatible with collection and use as described in this Statement or as otherwise disclosed at time of collection.

2. Sources of Personal Information

In the twelve months preceding the effective date of this Statement, we have collected personal information from the following sources:

From You: We collect personal information that you provide directly to us.
Automatically: We collect personal information automatically when you visit our website or when you send us emails, including internet or electronic usage data and other information collected through technologies such as cookies, pixels, web beacons, and other similar technologies.
From Third Parties: We collect personal information including from vendors and service providers.

3. How We Use Personal Information

In the twelve months preceding the effective date of this Statement, we have used personal information for the following purposes:

Operate Our Sites: We use personal information to improve, customize and enhance the Sites by expanding their features and functionality and tailoring them to our users’ needs and preferences.
Service Delivery: We use personal information to:
- provide, operate, and improve the service and our business;
- verify your identity;
- establish and maintain your user profile on the service;
- enable security features of the service, such as by sending you security codes via email or SMS, and remembering devices from which you have previously logged in;
- enable personalization of your service account;
- facilitate payment in connection with using the service;
- communicate with you about the service, including by sending status updates, announcements, updates, security alerts, and support and administrative messages;
- understand your needs and interests, and personalize your experience with the service and our communications;
- provide support for the service, and monitor and improve our customer support responses and processes; and
- respond to your requests, questions, and feedback.
Research and Development: We use your personal information for research and development purposes, including to analyze and improve the services and our business. This helps us to improve and enhance the safety, security, and accessibility of the services and develop new features and products. As part of these activities, we may create aggregated, de-identified, or other anonymous data from personal information we collect. We make personal information into anonymous data by removing information that makes data personally identifiable to you. We may use this anonymous data and disclose it to third parties for lawful business purposes, including, for example, analyzing and improving the services and promoting our business.
Compliance and Protection: We may use personal information to:
- comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government agencies;
- protect our, your, or others’ rights, privacy, safety or property (including by making and defending legal claims);
- audit our internal processes for compliance with legal and contractual requirements and internal policies;
- enforce the terms and conditions that govern the services; and
- prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks, identity theft, and accidents.
Legal: We use personal information to comply with our legal obligations, including reporting requirements, and defend ourselves in legal proceedings, and protect our company and our property, employees, and others through legal proceedings.
Other Purposes: We use personal information for other reasons we may describe to you.

4. How We Disclose Personal Information

In the twelve months preceding the effective date of this Statement, we disclosed personal information with the following parties or as otherwise described in this Statement or at time of collection:

Service Providers: Companies and individuals that provide services on our behalf or help us operate the services or our business (such as information technology, information security, payment processing, hosting and cloud storage, customer relationship management and support, print and mail fulfillment, email delivery, advertising, marketing, data analytics, consumer research, and identity verification).
Affiliates: Businesses controlling, controlled by, or under common control with Right Side Up.
Professional Advisors: Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of professional services rendered.
Authorities and Others: Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.
Business Transactions: Information that we collect from our users, including personal information, is considered to be a business asset. Thus, if we are acquired by a third party as a result of a transaction such as a merger, acquisition or asset sale or if our assets are acquired by a third party in the event we go out of business or enter bankruptcy, some or all of our assets, including your personal information, may be disclosed or transferred to a third party acquirer in connection with the transaction.
Business Partners: Our research partners and other business partners.
Other Parties: We may disclose personal information to other parties we may describe to you if you consent to the disclosure or direct us to disclose your information.

5. Sale and Sharing of Personal Information

Our website may display general, non-personalized advertisements, but we do not serve personalized or targeted advertisements. However, our use of analytics and mobile measurement partners (such as Google Analytics) for analytics and attribution purposes may involve sharing certain information (such as device identifiers and app usage data) that could constitute a “sale” or “sharing” of personal information under the CCPA/CPRA and similar state laws.

California law requires that we tell you if we sell personal information with a third party for monetary or other valuable consideration. We do not do this. We also do not sell or share personal information of minors under the age of thirteen for monetary or other valuable consideration.

The chart below outlines disclosures we have made for business purposes to contractors/service providers as well as disclosures for cross-context behavioral advertising purposes:
‍

Category of Personal Information	Disclosure, for a Business Purpose to Contractors/Service Providers	Cross-Context Behavioral Advertising
Identifiers	Service Providers and Business Partners	Yes, via Cookies and Tracking Technologies
Commercial Information	Service Providers and Business Partners	Yes, via Cookies and Tracking Technologies
Location Information	Service Providers and Business Partners	Yes, via Cookies and Tracking Technologies
Online Activity Data	Service Providers and Business Partners	Yes, via Cookies and Tracking Technologies
Device Data	Service Providers and Business Partners	Yes, via Cookies and Tracking Technologies
Inferential Information	Service Providers and Business Partners	Yes, via Cookies and Tracking Technologies

6. Cookies and Similar Technologies

You can learn more about our use of cookies and other tracking technologies by reviewing our Privacy Policy.

7. California Resident Rights

7.1. Your Rights
As a California resident, you have the rights listed below and may exercise the rights by submitting a verifiable consumer request. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law.

Right to Know/Access: You can request the following information about how we have collected and used your personal information during the past twelve months:
- Categories of personal information that we have collected.
- Categories of sources from which we collected personal information.
- Categories of personal information we have disclosed about you for a business purpose and categories of recipients to which it was disclosed.
- Categories of personal information that we sold or, for cross-context behavior advertising, shared and categories of third parties to whom personal information was sold or, for cross-context behavior advertising, shared.
- Categories of third parties to whom personal information was disclosed for a business purpose.
- Business or commercial purposes for collecting, selling, or, for cross-context behavior advertising, sharing personal information.
- Specific pieces of personal information collected.
Right to Data Portability: You can request a copy of your personal information that we maintain.
Right to Correct: You can ask us to correct inaccurate personal information we have collected about you.
Right to Delete: You can ask us to delete personal information we have collected from you. Please be aware that certain information we have collected from you may still be retained for legal, accounting, security, information technology backup, and anti-fraud reasons, as well as for solely internal uses reasonably aligned with your expectation based on your relationship with us and compatible with the context in which you provided the information.
Right to Nondiscrimination: You are entitled to exercise the rights described above free from discrimination as prohibited by the CCPA.
Right to Opt-Out of Marketing Communications: You may opt out of marketing-related emails by following opt-out or unsubscribe instructions included in the emails, or by contacting us using the contact information provided below. You may continue to receive service-related and other non-marketing emails. If you receive text messages from us, you may opt out of receiving further text messages by replying STOP to the text messages.
Right to Opt-Out of Sale and, for Cross-Context Behavior Advertising, Sharing: You may opt out of sales or, for cross-context behavior advertising, sharing via cookies or tracking technologies. You can learn more about how to opt out at the Do Not Sell or Share My Personal Information page.
Right to Appeal: If we deny your request, or if we were unable to fulfill your request, you may appeal our decision by contacting us as described in the Contact Us sections, and provide a detailed reason for your appeal, as well as your state of residence.

7.2. How to Exercise Your Rights
To exercise your rights, please contact us as specified in the Contact Us section and:

Provide sufficient identifying information (including full name and email address) to allow us to reasonably verify you are the person about whom we collected and retained personal information, and/or your authority to make such request on behalf of the data subject; and
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Note that we will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request or to review and comply with the request, or as otherwise permitted by applicable law.

7.3. Authorizing Agents to Act on Your Behalf‍
You may authorize someone to act as your agent and submit a request on your behalf. Due to the sensitivity of such requests, you must verify the agent’s authorization before we will act. Accordingly:

You or your agent must supply other written permission for a specific agent to act on your behalf; and
We will use your email address or other available contact information to connect directly with you to verify agent identity and authority.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm with a level of confidence appropriate to the sensitivity of the information that the personal information we have collected and retained in our systems and databases relates to you.

8. California Shine the Light

The California Shine the Light law (Cal. Civ. Code § 1798.83) permits residents of California to request certain details about how their information is shared with third parties for the third-parties’ direct marketing purposes. If you are a California resident and would like to make such a request, please contact us using the information provided under the Contact Us section below, and include “CA Shine the Light” in the subject line of your email.

9. Sensitive Personal Information

We do not use or disclose sensitive information, as that term is defined by the CCPA.

10. How to Contact Us

If you have other questions about this Statement or our privacy practices please email us at security@rightsideup.co. You can also call us at 720-549-7324.

11. Changes to This Statement

We may make changes or updates to this Statement. We will notify you of any material changes to this Statement as required by law. Changes will also be posted on our website. Please check our site periodically for updates.