Legal

California Privacy Rights (CCPA/CPRA)

Additional disclosures and rights for California residents.

Last updated: August 11, 2026

Your Rights Under California Law

The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give California residents specific rights regarding personal information:

• Right to Know — what categories of personal information we collect, sources, purposes, and third parties we share with.
• Right to Access — a copy of the specific pieces of personal information we hold about you.
• Right to Delete — request deletion of your personal information, subject to legal exceptions.
• Right to Correct — request correction of inaccurate information.
• Right to Opt Out — opt out of the sale or sharing of personal information for cross-context behavioral advertising.
• Right to Limit — limit use of sensitive personal information to necessary purposes.
• Right to Non-Discrimination — we will not discriminate against you for exercising these rights.

Categories of Personal Information We Collect

In the past 12 months we have collected the following categories:

• Identifiers (name, email, address, phone, IP, device ID)
• Personal records (billing/shipping information)
• Commercial information (purchase history)
• Internet activity (browsing, search, interaction data)
• Geolocation (approximate, from IP)
• Inferences (preferences, characteristics)
• Sensitive personal information (only when voluntarily provided, e.g. dietary restrictions)

Sources of Personal Information

• Directly from you (account creation, orders, quizzes, support).
• Automatically (cookies, pixels, log files).
• Third parties (payment processors, carriers, analytics/ad partners).

Purposes for Collection

• Order fulfillment and customer service.
• Personalization and recommendations.
• Marketing (with consent).
• Fraud prevention and security.
• Legal compliance.
• Analytics and site improvement.

Categories of Third Parties We Share With

• Payment processors (Stripe, PayPal).
• Shipping carriers (UPS, FedEx, USPS).
• Analytics providers (Google Analytics).
• Advertising partners (Google Ads, Meta).
• Hosting/infrastructure (BigCommerce, Cloudflare).
• Legal authorities when required by law.

Sale/Sharing of Personal Information

We do not sell personal information for money. Under CPRA's broad definition, our use of advertising cookies (Google Ads, Meta Pixel) may constitute "sharing" for cross-context behavioral advertising. You have the right to opt out. See our Do Not Sell or Share My Personal Information page.

How to Exercise Your Rights

Submit a request through one of the following:

• Email privacy@thrivetemarket.com with subject "California Privacy Request."
• Complete the form on our Contact page.
• Toll-free phone: 1-800-000-0000 (business hours PT).

We will verify your identity before responding and respond within 45 days (extendable to 90 days for complex requests). You may designate an authorized agent to submit requests on your behalf.

Shine the Light

California's "Shine the Light" law permits residents to request certain information regarding disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing without your consent.

Retention

We retain personal information as long as necessary for the purposes described in our Privacy Policy, typically 7 years for order records, until account deletion for account data, and up to 24 months for cookie/tracking data.