California Privacy Notice

This notice applies to California residents and is provided pursuant to the California Consumer Privacy Act of 2018 ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"). It explains what categories of personal information we collect about California residents, our purposes for collection, and your specific rights under California law.

1. Categories of personal information we collect

In the past twelve months we have collected the following CCPA-defined categories from California residents who subscribe to Edgebrief:

• Identifiers:email address, IP address, account identifier, Stripe customer ID.
• Customer records:billing name, billing address (held by Stripe on our behalf), payment status.
• Commercial information:subscription plan, billing history, products purchased.
• Internet or other electronic network activity : server access logs, login events, email open/click events from transactional email sent by us.
• Inferences:categorization of your competitors' paid-search activity in the form of the brief itself. (This is analysis we generate; it is not derived from any profile of you.)

We do not collect any of the following CCPA categories: sensitive personal information, geolocation data beyond IP-level country, biometric data, audio or visual recordings, or information from a consumer's commercial or publicly available record sources outside of the public Google search data we capture for your tracked keywords.

2. Sources of personal information

• Directly from you,when you sign up, edit Settings, or contact us.
• From Stripe,for billing and tax records related to your subscription.
• From Resend,for delivery and engagement metrics on emails we send you.
• From server logs,automatically when you access our marketing site, signup, or Settings.

3. Business or commercial purpose for collection

• To provide and operate the Service (deliver the weekly brief).
• To process payments and prevent fraud.
• To respond to your support requests.
• To improve the Service and detect abuse.
• To comply with legal and tax obligations.

4. Categories of third parties we share with

We share each category of personal information only with the service providers necessary to operate the Service, contractually bound to use it solely for the purpose we direct:

• Identifiers + customer records → Stripe (payments), Supabase (database).
• Identifiers + commercial information → Resend (email delivery).
• Internet activity → Vercel (hosting), Railway (worker hosting).
• Brief inputs and outputs to Anthropic (Claude API), processed ephemerally for the sole purpose of generating your weekly brief. We do not send private or customer-identifying data; only the public ad data we captured for your tracked keywords and brand-name searches, plus the names of the competitors you have chosen to track. Anthropic does not retain or train on this data per our agreement with them.

We do not sell personal information and we do not share personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

5. Retention

We retain personal information only as long as necessary for the purposes described above. See our Privacy Policyfor the specific retention schedule.

6. Your California rights

If you are a California resident, you have the right to:

• Know what personal information we have collected, the sources, the purposes, and the categories we share with.
• Access the specific pieces of personal information we hold about you.
• Delete personal information we have collected from you, subject to limited legal exceptions.
• Correct inaccurate personal information we hold about you.
• Opt out of sale or sharing for cross-context behavioral advertising. We do not sell or share for that purpose, so there is nothing to opt out of, but we honor opt-out preference signals (Global Privacy Control) by default.
• Limit use of sensitive personal information. We do not collect sensitive personal information.
• Non-discrimination. We will not deny service, charge a different price, or provide a different level of service for exercising any CCPA right.

7. How to exercise your rights

Email privacy@edgebrief.io from the address on your account, or write to: Pactx, Inc., Attn: Privacy.

We will verify your request by matching the email used against the account on file. For deletion requests we may ask for a confirming reply from that email address before proceeding.

You may also designate an authorized agent to make a request on your behalf. The agent must provide signed written permission from you and proof of their identity. We may still ask you to verify your identity directly.

8. Response timeline

We will confirm receipt within 10 business days and respond substantively within 45 days, with one possible 45-day extension if reasonably necessary, in which case we will notify you of the extension and the reason.

9. Do Not Sell or Share My Personal Information

We do not sell or share your personal information for cross-context behavioral advertising. If our practices ever change, we will update this notice and provide the required opt-out link before any such sharing begins.

10. Contact

Pactx, Inc. d/b/a Edgebrief
privacy@edgebrief.io