Legal · Do not sell or share

Do not sell or share. CCPA rights.

Effective 2026-10-12

The headline. SweetNote does not sell or share Personal Data for cross-context behavioral advertising under the California Consumer Privacy Act and California Privacy Rights Act (CCPA / CPRA). We do not engage in "Targeted Advertising" or "Profiling in furtherance of solely automated decisions" under any comparable US state consumer-privacy law now in force, including VCDPA, CPA, CTDPA, TDPSA, UCPA, OCPA, TIPA, MTCDPA, DPDPA, Iowa CDPA, NH DPA, NJ DPA, MN CDPA, MD ODPA (including its heightened sensitive-data provisions), RI DTPPA, KY CDPA, IN CDPA, NDPA, and FDBR. The opt-out rights below are honored as a matter of course; this page documents them for the record.

1. What we process and why

SweetNote is a data processor under CCPA / CPRA: we process Personal Data on the documented instructions of brand customers ("Customers") who use the platform to deliver video-gift campaigns to their recipients. The categories of Personal Data we process and our limited purposes are documented in detail in the privacy notice (Section 2) and the Data Processing Agreement (Section 4).

Under CCPA / CPRA terminology, SweetNote processes Personal Data as a "Service Provider" to Customer's Business. Personal Data is processed only for the limited business purposes described in the underlying contract; it is not retained, used, sold, shared, or disclosed for any other purpose.

2. We do not sell or share

SweetNote has not sold and does not sell Personal Data within the meaning of CCPA / CPRA. SweetNote does not "share" Personal Data within the meaning of CPRA, that is, we do not transfer Personal Data to third parties for cross-context behavioral advertising. The cross-tenant industry benchmark described in DPA Section 4 is published only as aggregate de-identified data at sample-floor thresholds (k ≥ 10 other contributing brands per cell — the comparator excludes the brand reading it, so eleven brands in total — and n ≥ 25 recipients per cell) and never identifies individual recipients; it is not a “sale” within the meaning of Civil Code §1798.140(ad) because no Personal Information is disclosed to a third party for monetary or other valuable consideration in connection with it.

Specifically, SweetNote does not:

Sell or rent recipient lists or recipient Personal Data to anyone, ever.
Combine Customer's Personal Data with other Customers' Personal Data except for the published cross-tenant industry benchmarks, which publish only at sample-floor thresholds (k ≥ 10 other contributing brands per cell — the comparator excludes the brand reading it, so eleven brands in total — n ≥ 25 recipients per cell) and never identify individual brands or individual recipients.
Engage in cross-site or cross-app behavioral advertising.
Use third-party advertising pixels, retargeting cookies, or session-replay tools on the recipient-facing reveal page.
Enrich Customer-supplied recipient data with demographic, firmographic, or behavioral inference from any third-party source.

3. Sensitive Personal Information (SPI)

SweetNote processes no Sensitive Personal Information (SPI) on Customer's behalf in the B2B pipeline. Recipients can rely on this as an architectural commitment, not just a policy preference: no biometric identifiers are captured (see DPA §14.1), and SweetNote does not infer or attach demographic, financial, health, sexual orientation, or political-belief data to any recipient record.

4. Rights you can exercise

Under CCPA / CPRA, recipients located in California have the right to:

Know: request information about the Personal Data SweetNote processes about you, the categories of sources, the business purpose, and the categories of third parties (subprocessors) with whom it is shared.
Delete: request deletion of your Personal Data, subject to lawful exceptions.
Correct: request correction of inaccurate Personal Data.
Opt out of sale (Cal. Civ. Code §1798.140(ad)): SweetNote does not sell Personal Data; the opt-out is honored as a matter of course.
Opt out of sharing for cross-context behavioral advertising (Cal. Civ. Code §1798.140(ah)): SweetNote does not share Personal Data for this purpose; the opt-out is honored as a matter of course.
Limit use of SPI: SweetNote does not process SPI on Customer's behalf in the B2B service.
Non-discrimination (Cal. Civ. Code §1798.125): you will not receive different service for exercising any right above.

Equivalent rights under every comparable US state consumer-privacy law now in force, VCDPA, CPA, CTDPA, TDPSA, UCPA, OCPA, TIPA, MTCDPA, DPDPA, Iowa CDPA, NH DPA, NJ DPA, MN CDPA, MD ODPA, RI DTPPA, KY CDPA, IN CDPA, NDPA, FDBR, and any successor statute, are honored on the same procedure.

5. How to exercise these rights

For data SweetNote processes on behalf of a Customer (recipient names, addresses, engagement events): direct your request to the brand whose campaign you are part of; that brand is the data controller. SweetNote supports the brand in fulfilling your request within 10 business days.

For data SweetNote holds for its own purposes (workspace accounts, Terms of Service acceptances, enquiries and billing details, listed in Section 1.1 of the privacy notice), or if you cannot determine which Customer to contact: email legal@thesweetnote.com. We respond within 10 business days.

SweetNote honors the Global Privacy Control (GPC) signal as a valid opt-out indicator on any surface where it is set.

6. Authorized agent

You may designate an authorized agent to make a request on your behalf. We will require written authorization signed by you and may require additional verification of your identity to fulfill the request. Direct authorized-agent requests to legal@thesweetnote.com.

7. Changes to this disclosure

This disclosure is reviewed at least annually. The canonical version is published at thesweetnote.com/legal/do-not-sell.