CRMish

California Privacy Notice

Effective date: 2026-05-28 · DRAFT v4 — counsel review required

> Not legal advice. Working draft. This Notice supplements the Privacy Policy and applies to California residents under the California Consumer Privacy Act of 2018 ("CCPA") as amended by the California Privacy Rights Act of 2020 ("CPRA").

1. Who this applies to

This Notice applies to you if you are a California resident interacting with CRMish (operated by JAS Operations LLC dba CRMish). It describes:

  • The categories of personal information we collect about you (§2).
  • How we use, share, and retain it (§3–§5).
  • Your rights as a California resident and how to exercise them (§6).

For everything else, see our Privacy Policy.

2. Personal information we collect

We collect the following categories of personal information about California residents, mirroring the CCPA categorization scheme:

| CCPA category | Examples | Collected? | |---|---|---| | A. Identifiers | Name, email address, account username, IP address | Yes | | B. Customer record information (Cal. Civ. Code § 1798.80) | Name, billing address, payment method (held by Stripe) | Yes | | C. Protected classification characteristics | Race, religion, etc. | No | | D. Commercial information | Subscription tier, transaction history, communications about purchases | Yes | | E. Biometric information | Fingerprints, voiceprints, etc. | No | | F. Internet or network activity | Browsing within the Service, feature interaction, access logs | Yes | | G. Geolocation data | Approximate location inferred from IP and timezone setting | Yes (city-level) | | H. Sensory data | Audio, video | No | | I. Professional or employment-related | Title, employer (if you choose to add to a Coach Mode profile) | Yes, optional | | J. Education information | Schools, degrees | No | | K. Inferences | Derived attributes like activity level, streak status | Yes | | L. Sensitive personal information (CPRA) | Account login credentials, precise geolocation, race/ethnicity, religion, contents of mail/email/messages, health, sex life, sexual orientation, genetic data | Account login credentials only. We do not collect the others. |

We collect this information from:

  • You directly (account signup, settings, content you submit).
  • Your browser automatically (server logs, cookies — see Cookie Policy).
  • Third parties you authorize (e.g., webhook ingest from ClickFunnels).
  • Our service providers (e.g., Stripe for billing references).

3. Purposes of collection and use

We use personal information about California residents for the business purposes listed in the Privacy Policy §4, including:

  • Providing and operating the Service.
  • Authentication and account security.
  • Billing through Stripe.
  • Sending transactional and (where opted-in) product-update email.
  • Improving the product through aggregated, anonymized analytics.
  • Detecting and preventing fraud and abuse.
  • Complying with legal obligations.

We do not use personal information for any purpose materially different from those disclosed in this Notice and the Privacy Policy without further notice.

4. Sharing, "selling," and "sharing" of personal information

Under the CCPA/CPRA, "sale" means exchanging personal information for money or other valuable consideration. "Share" means disclosing personal information to a third party for cross-context behavioral advertising.

4.1 We do NOT sell personal information.

4.2 We do NOT share personal information for cross-context behavioral advertising.

4.3 We DO disclose personal information to service providers and contractors for business purposes.

The categories of personal information we disclose to service providers, and the categories of recipients, are described in the Sub-processor List.

4.4 We have NOT sold or shared the personal information of minors under 16.

5. Retention

We retain personal information about California residents for the periods described in the Privacy Policy §10:

| Category | Retention | |---|---| | Active account data | While the account is active | | Deleted account data | Within 30 days from production, within 90 days from backups | | Server logs | Up to 30 days | | Webhook audit log | Up to 12 months | | Billing records | As required by tax law (typically 7 years) | | Push subscriptions | Until you toggle off or the browser endpoint expires | | Coaching messages | For the lifetime of the relationship + 90 days |

6. Your California rights

You have the following rights as a California resident. We do not discriminate against you for exercising them.

6.1 Right to know

You can request that we disclose:

  • The categories of personal information we have collected about you.
  • The categories of sources from which we collected it.
  • The business or commercial purposes for collecting it.
  • The categories of third parties with whom we have disclosed it.
  • The specific pieces of personal information we have collected.

6.2 Right to delete

You can request that we delete personal information we have collected from you, subject to legal exceptions (e.g., we may retain information necessary to complete a transaction, detect fraud, comply with law).

6.3 Right to correct

You can request that we correct inaccurate personal information about you. You can correct most account information yourself in Settings.

6.4 Right to limit use of sensitive personal information

The only sensitive personal information we collect is account login credentials. We use these only for authentication. You do not need to take any action to limit this use.

6.5 Right to opt out of "sale" or "sharing"

We do not sell or share personal information as those terms are defined under CCPA/CPRA. There is no opt-out required for you. We will honor any Global Privacy Control (GPC) signal we receive as an opt-out for any future sale or sharing.

6.6 Right to non-discrimination

We will not deny you the Service, charge you a different price, or provide you a different level or quality of the Service because you exercised your CCPA/CPRA rights.

6.7 Right to data portability

When you make a Right-to-Know request, we will provide the requested personal information in a portable and (to the extent technically feasible) readily-usable format that allows you to transmit it to another entity.

7. How to exercise your rights

7.1 By email

Email privacy@crmish.io with the subject line "California Privacy Request — [type]" (e.g., "California Privacy Request — Know", "California Privacy Request — Delete").

Include in your message:

  • Your name and the email associated with your CRMish account.
  • The specific right(s) you are exercising.
  • Enough detail for us to verify your identity (we may follow up).

7.2 Authorized agents

You may designate an authorized agent to make a request on your behalf. We may require the agent to provide written permission signed by you, and we may verify your identity directly with you.

7.3 Response timing

We will confirm receipt of your request within 10 business days and respond substantively within 45 calendar days, extendable by an additional 45 days if reasonably necessary with notice.

7.4 Verification

We will verify your identity using information already associated with your account (email match, password reset proof, etc.). For sensitive requests (deletion, correction of significant data), we may require additional verification.

7.5 No fee

We do not charge a fee for processing California privacy requests, except where a request is manifestly unfounded or excessive, in which case we will explain the basis for any fee.

8. Notice of financial incentives

We do not currently offer financial incentives or programs that involve the collection, use, sale, or sharing of personal information in exchange for compensation or quality differences.

9. Children

The Service is not directed at children under 13 (see Privacy Policy §12). We do not knowingly sell or share personal information of any consumer we know to be under 16.

10. Updates

We will update this Notice at least once every 12 months as required by California law, or earlier when our practices materially change.

11. Contact

| For | Email | |---|---| | California privacy requests | privacy@crmish.io | | Toll-free designated method | (toll-free number to be added if required by call volume — until then, email is the designated method) |

Document version: california-privacy-v1 · Last updated 2026-05-28.