The short version
This notice supplements our Privacy Policy for California residents under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).
The headline points:
- We do not sell personal information.
- We do not share personal information for cross-context behavioral advertising.
- We do not process sensitive personal information for purposes beyond what's needed to deliver the service.
- You have rights to know, delete, correct, limit, and opt out — exercise them by emailing privacy@missionbroadcast.com.
- We don't discriminate against people who exercise these rights.
1. Who this applies to
This notice applies to "consumers" as defined by the CCPA — natural persons who reside in California. If you're a California resident, the rights and disclosures below apply to your personal information.
Some categories below may not apply to every type of user. Subscribers, account holders, missionaries themselves, and ordinary visitors of public missionary pages each interact with us differently; the disclosure below covers the full universe of what we may collect.
2. Categories of personal information we collect
In the 12 months preceding the "Last updated" date above, we have collected the following CCPA categories of personal information:
A. Identifiers
Name; email address; account identifier; subscriber email + name; IP address; cookie ID for session and pre-auth.
B. Customer records (Cal. Civ. Code § 1798.80)
Mailing address (for missionaries who opt to display a CAN-SPAM-compliant postal address; for account holders only as required by Stripe or tax law). Payment-instrument metadata (last 4 digits of card, expiry; full card data is held by Stripe, not by us).
C. Commercial information
Subscription tier, purchase history, add-on purchases, refund history.
D. Internet or network activity
Request logs (IP, user-agent, referrer, timestamp), interactions with our service, email-delivery events (delivered / opened / bounced / unsubscribed) from our outbound provider.
E. Geolocation
City-level inferred location from IP address (server-side logs only; not used for advertising). Map pin coordinates entered explicitly by a missionary or account holder for the public mission map — those are about the missionary's own travel, not the visitor's location.
F. Audio / electronic / visual information
Photos and attachments included with letters. Letter content (text and HTML).
G. Professional / employment
Not collected.
H. Education
Not collected.
I. Inferences
Not collected. We do not build profiles or draw inferences from your activity.
J. Sensitive personal information
We do not intentionally collect or process the categories defined as "sensitive personal information" under the CPRA (account log-in credentials with passwords, financial-account access credentials, precise geolocation, racial / ethnic origin, religious or philosophical beliefs, union membership, communications content not addressed to us, genetic or biometric data, health data, sex life or sexual orientation data).
Two clarifications: (a) we use Google OAuth, so we never see your password; (b) while a missionary's site is itself a religious context, we don't infer religious belief from any user's visit to it.
3. Sources we collect it from
- Directly from you. When you create an account, configure a site, subscribe to a list, send a letter to
letters@, send a command email, or use the forget-me flow. - From your browser / device, automatically — request metadata, cookies.
- From Stripe — payment metadata after you complete a checkout.
- From Brevo and SendGrid — email-delivery and inbound-parse events.
- From Nominatim (OpenStreetMap) — geocoded coordinates in response to address queries we make on your behalf.
4. Business purposes for collection
- Provide and maintain the Service.
- Process payments and manage subscriptions.
- Send transactional communications.
- Deliver, secure, and improve email deliverability.
- Comply with legal obligations.
- Detect, prevent, and respond to fraud, abuse, and security incidents.
- Conduct internal research and analytics to improve the Service. (We do not analyze individual letter content for this purpose.)
5. Categories of recipients
We disclose personal information to the following categories of recipients, only for the business purposes listed above:
- Service providers acting as our processors / sub-processors. The current list is enumerated by name in our Privacy Policy: Stripe (payments), Brevo (outbound email), SendGrid (inbound email), Google Firebase (auth / hosting / storage / database), Nominatim / OpenStreetMap (geocoding), Porkbun (domain registration for managed domains).
- Legal and regulatory authorities, where required.
- A successor entity, in the event of a merger, acquisition, or asset sale.
7. Sensitive personal information
As described in section 2, we do not intentionally collect or process sensitive personal information beyond what is strictly necessary to provide the Service. Therefore, the CPRA "right to limit use and disclosure of sensitive personal information" does not impose additional obligations beyond those already met by our default operations.
If you believe we are processing your sensitive personal information for any other purpose, contact privacy@missionbroadcast.com immediately and we will investigate.
8. Retention periods
Retention timelines are specified in our Privacy Policy. In summary:
- Letters / photos / subscribers / map data — for the missionary's active paid subscription, then a 30-day export window, then deletion (unless an Archive Keepalive subscription is active).
- Closed-account record — up to 7 years (for fraud-prevention, tax, and audit).
- Payment records — per Stripe and tax-law requirements (typically 7 years).
- Operational request logs — up to 90 days, then deleted or anonymized.
- Forget-me tombstones — indefinitely (the tombstone is a hash, not personal information).
9. Your CCPA / CPRA rights
As a California resident, you have the right to:
- Know what personal information we have collected, used, disclosed, and (if applicable) sold or shared about you.
- Delete the personal information we hold about you, with limited statutory exceptions (e.g., where we need to retain it for legal compliance, security, or fraud prevention).
- Correct inaccurate personal information we hold about you.
- Opt out of sale or sharing. Since we do not sell or share personal information, there is nothing to opt out of — but we honor the right and the Global Privacy Control (GPC) signal as confirmation.
- Limit the use and disclosure of sensitive personal information. See section 7.
- Non-discrimination. We will not deny service, charge a different price, or provide a different level of service because you exercise a CCPA right.
10. How to exercise your rights
Email privacy@missionbroadcast.com with the request you want to make. To protect your information, we may need to verify your identity before fulfilling the request. We will:
- Confirm receipt within 10 business days.
- Respond to verifiable requests within 45 days. We may extend by an additional 45 days when reasonably necessary — if we do, we'll tell you up front and explain why.
- Where we cannot fulfill a request (e.g., because we don't hold the information, or because a statutory exception applies), explain why in writing.
Subscribers can also use the forget-me flow directly to request deletion. Account holders can close their account from the Billing page.
11. Authorized agents
You may designate an authorized agent to make a CCPA / CPRA request on your behalf. We will require:
- Written permission from you, signed and dated, authorizing the agent to act on your behalf.
- Verification of the agent's identity.
- Verification of your identity, unless the agent presents a valid power of attorney under the California Probate Code.
12. Non-discrimination
We will not deny our services, charge you a different price or rate, provide a different level or quality of service, or suggest that any of those will happen because you exercised any of your CCPA / CPRA rights.
13. Do Not Sell or Share My Personal Information
As described in section 6, we do not sell or share personal information for cross-context behavioral advertising. There is no "sale" or "share" of your personal information to opt out of.
We honor the Global Privacy Control (GPC) browser signal as a valid opt-out preference. Because we do not engage in sale or sharing as defined by the CCPA, the practical effect on our systems is informational: receiving the signal confirms your preference, and we will not begin any sale or sharing activity as long as the signal is present.
If at any time we begin to "sell" or "share" personal information as those terms are defined under the CCPA, we will update this notice, post a "Do Not Sell or Share My Personal Information" link in our footer, and provide a working opt-out mechanism.
14. Annual metrics
The CCPA / CPRA requires businesses that buy, sell, share, or receive the personal information of 10 million or more California residents per year to disclose certain metrics about consumer-rights requests. Mission Broadcast does not currently meet that threshold. If we do in the future, we will publish the required metrics here.
15. Contact
For California-specific privacy questions, complaints, or requests:
Mailing address: DocGuy, LLC — [INSERT BUSINESS ADDRESS].