This document is provided as a comprehensive draft and is not legal advice. Have it reviewed by qualified counsel before relying on it.
This California Privacy Notice supplements our Privacy Policy and applies only to residents of California ("consumers" or "you"). We provide it to comply with the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (together, "CCPA/CPRA"). Terms defined in the CCPA/CPRA have the same meaning here.
1. Information we collect
In the preceding twelve (12) months we have collected the following categories of personal information:
- A. Identifiers — name, email, phone number, postal address, IP address, account name, case reference numbers. Collected: YES.
- B. Personal information described in Cal. Civ. Code § 1798.80(e) — name, address, telephone number, date of birth. We do not collect financial account or card numbers. Collected: YES.
- C. Characteristics of protected classifications — age (from date of birth) and household relationships declared on a roster. Collected: YES, only to verify household composition.
- D. Commercial information — records of verifications ordered by Clients. Collected: YES.
- E. Biometric information — fingerprints, faceprints, voiceprints. Collected: NO.
- F. Internet or other network activity — pages viewed, sign-in history, device and browser data. Collected: YES.
- G. Geolocation data — location of the declared residence and geotags on field photographs of a property exterior. Collected: YES, only for an open, consented case.
- H. Sensory data — exterior photographs of a property taken during documented field confirmation. Collected: YES, only for an open, consented case.
- I. Professional or employment information — business email, role, company and license number of Client Users and access applicants. Collected: YES.
- J. Non-public education information. Collected: NO.
- K. Inferences — the verification outcome for a declared address (Verified, Discrepant or Unverifiable). Collected: YES, not used for profiling or advertising.
- L. Sensitive personal information — account sign-in credentials (stored hashed). Collected: YES, used only to secure your account.
[CONFIRM WITH COUNSEL: category list against current data flows before publishing.]
2. Sources of personal information
- Directly from you: when you request access, sign in, give consent to a verification, submit a dispute or subject-rights request, or set your communication preferences.
- From Clients: when an approved Client opens a case and submits a Subject's declared address and household roster.
- Automatically: through server logs and strictly necessary cookies when you use our site or console.
- From third parties, only for an open case with a permissible purpose and Subject consent: postal and change-of-address registries, utility footprints, property and tax rolls, licensed data providers and identified field agents.
- From service providers: sign-in providers (such as Google) when you choose to sign in with them.
3. Use of personal information
- To perform verifications a Client requested under a declared permissible purpose, after Subject consent.
- To send consent links, service messages and, if you opted in, marketing emails or texts.
- To produce assurance reports and maintain a reproducible evidence chain.
- To handle disputes, corrections and privacy requests.
- To create, maintain and secure accounts, including two-factor authentication and audit logging.
- To detect security incidents and protect against fraud or illegal activity.
- To debug, test and improve our services.
- To comply with law and respond to lawful requests.
5. No sale or sharing of personal information
ResidenceProof does not sell personal information and does not share it for cross-context behavioral advertising. We have not done so in the preceding twelve (12) months, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.
We honor Global Privacy Control (GPC) signals as a request to opt out of sale or sharing.
6. Your rights under the CCPA/CPRA
Right to know and data portability. You may request the categories and specific pieces of personal information we collected about you, its sources, our purposes, and the categories of recipients, covering the preceding 12 months, in a portable format.
Right to delete. You may request deletion of personal information we collected from you, subject to exceptions — for example, to complete a requested service, resolve an open dispute, detect security incidents or fraud, comply with a legal obligation, or other internal uses compatible with the context in which you provided it.
Right to correct. You may request that we correct inaccurate personal information, including by disputing a verification result.
Right to limit use of sensitive personal information. We use sensitive personal information only as permitted by the CPRA (to secure your account and provide the service), so no separate limit request is needed — you may still submit one and we will confirm it in writing.
Right to opt out of sale or sharing. We do neither; you do not need to opt out, but you may still submit an opt-out request and we will record it.
Right to non-discrimination. We will not deny you services, charge different prices, or provide a different level or quality of service because you exercised these rights.
7. How to exercise your rights
Submit a request by any of these methods:
- Use the request form at the bottom of this page — no email needed.
- Email rights@residenceproof.com with the subject line “California Privacy Rights Request”.
- Use our Subject Rights page at residenceproof.com/subject-rights.
- Call [PHONE NUMBER].
Only you, a person you authorize, or a parent or guardian for a minor may make a request. You do not need an account. Access and portability requests may be made twice in a 12-month period.
If a Client requested your verification, we act as its service provider; we may route your request to that Client and help it respond.
8. Verification of requests
We must verify your identity before responding. We match details you provide against information already on file — for example, the email or phone number used, the declared address, or a case reference — and we use that information only to verify the request. We will never ask for your full Social Security number.
9. Response timing and format
We confirm receipt within 10 business days and respond within 45 calendar days. If we need more time (up to another 45 days), we will tell you why in writing. We deliver responses electronically or by mail, at your choice. Requests are free unless excessive, repetitive or manifestly unfounded; if a fee applies, we will explain why and give an estimate first.
10. Authorized agents
You may use an authorized agent. The agent must provide your signed written permission, and we may ask you to verify your identity directly and confirm the authorization. We may deny requests from agents who cannot show they are authorized.
11. Retention
We keep each category of personal information only as long as needed for the purposes above, the Client's documented retention policy, dispute resolution and legal compliance, then delete or de-identify it. Consent and opt-out records are generally kept at least five years. [CONFIRM RETENTION PERIODS WITH COUNSEL.]
12. “Do Not Track” signals
Apart from honoring Global Privacy Control as described above, we do not respond to browser “Do Not Track” signals because no uniform standard exists.
13. “Shine the Light” law
California Civil Code § 1798.83 lets California residents request, once a year and free of charge, information about personal information disclosed to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.
14. Minors
Our services are for businesses and adults, and cases may only be opened for Subjects aged 18 or older. A household roster may list a minor's name, relationship and age when declared by a Client; we use it only to verify household composition and never sell or share it.
15. Changes to this notice
We review this notice at least every 12 months. When we update it, we post the new version here with a new effective date.
16. Contact information
Privacy rights requests: rights@residenceproof.com. General privacy questions: support@residenceproof.com. Phone: [PHONE NUMBER]. Mail: ResidenceProof, [MAILING ADDRESS].