US State Privacy Notice

This notice supplements our Privacy Policy for residents of US states with consumer privacy laws, including California (the California Consumer Privacy Act as amended by the CPRA), Colorado, Connecticut, Virginia, Utah, Texas, Oregon and the other states with similar laws. Words such as "personal information", "sell", "share" and "targeted advertising" have the meaning those laws give them.

Many of these laws apply only to businesses above certain size thresholds — for example, the California law applies to businesses with annual gross revenue above US$26,625,000 or that buy, sell or share the personal information of 100,000 or more California consumers or households. As far as we are aware, FootballPlazza does not currently meet those thresholds, and several states exempt small businesses. We nevertheless offer the rights in this notice to all US residents, and we honour opt-out requests and the Global Privacy Control signal.

We do not sell personal information for money, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16.

The only processing that could count as "sharing" for cross-context behavioural advertising, or as "targeted advertising", is Google's advertising measurement, which runs only if we have switched on Google Tag Manager and you accept the Marketing cookie category. To opt out in this browser, use the button below or choose Cookie settings at the bottom of any page and switch off Marketing. Because this happens in your browser, repeat it on each browser and device you use.

Global Privacy Control (GPC): if your browser sends the GPC signal, we treat it as a valid request to opt out of sale, sharing and targeted advertising for that browser: Marketing stays off, even if you click "Accept all". You can also ask us to opt you out by emailing [privacyEmail — set in Administration].

In the past 12 months we have collected these categories of personal information, from you directly, from your browser and, for payment data, from Stripe. The purposes and retention periods are in the Privacy Policy.

• Identifiers: name, email address, account ID, and online identifiers such as session cookies, push-subscription addresses and, with your consent, Google Analytics cookie IDs.
• Customer records: membership, billing references and invoices (card details are held by Stripe, not by us).
• Commercial information: plans bought, renewals, plan changes, promotion codes used.
• Internet or other electronic network activity: sign-in sessions, security events and, with your consent, pages viewed and features used (Google Analytics).
• Approximate location: derived by Google from your IP address, only with Analytics or Marketing consent. We do not collect precise geolocation.
• Inferences: none. We do not profile people; our predictions are about football matches.
• Sensitive personal information: only your account password (stored as a one-way hash) and, if you enable it, your two-factor secret, used solely to sign you in. We do not use or disclose sensitive personal information for any other purpose.

For business purposes we disclose personal information to service providers and processors that are contractually limited to using it on our behalf: payment processing (Stripe), hosting ([hostingProvider — set in Administration]), email delivery ([emailProvider — set in Administration]), browser push services and, with your consent, analytics (Google). With your Marketing consent, Google's advertising measurement may act as a third party. We do not disclose personal information to data brokers.

Depending on the state where you live, you have the right to:

• know and access the personal information we hold about you, and receive a portable copy
• correct inaccurate personal information
• delete personal information, subject to exceptions such as tax records
• opt out of the sale or sharing of personal information, of targeted advertising and of profiling with legal or similarly significant effects (we do not do such profiling)
• limit the use of sensitive personal information (we already use it only to sign you in)
• not be discriminated against for using these rights: we never charge a different price or give a different level of service because you used them

Most of these you can do yourself in Account → Privacy & data (download your data, delete your account) and with Cookie settings in the footer.

Email [privacyEmail — set in Administration] from the address on your account, or by post to Tech Improvement Inc, Philadelphia, Pennsylvania, United States, and tell us what you would like us to do. We confirm receipt within 10 business days and respond within 45 days; where the law allows we may extend this by a further 45 days and will tell you why. To protect you, we verify requests by matching the email address on your account and may ask for a confirmation from that address. You may use an authorised agent; we may ask for proof of the authorisation and to verify your identity directly.

If we decline your request, you may appeal by replying to our decision with the subject "Privacy appeal". We will respond within 45 days (60 days where state law allows) and explain our reasons. If you are not satisfied, you can contact the Attorney General of your state, or for California the California Privacy Protection Agency (cppa.ca.gov).

We offer no financial incentive or price difference in exchange for personal information. We do not disclose personal information to third parties for their own direct-marketing purposes, so we receive no California "Shine the Light" (Civil Code section 1798.83) requests to answer; you may still ask us at [privacyEmail — set in Administration].