US State Privacy Notice

The short version

This summary is for convenience. The full text below controls.

1.About this notice

1.1Who this notice covers

In this US State Privacy Notice, "Zinstruct," "we," and "us" mean [Exact registered entity name], a Colorado limited liability company doing business as Zinstruct, with its mailing address at 2403 E 28th Ave, Denver, CO 80205, USA. "You" means the individual this notice describes. Other capitalized terms, such as Creator, Member, Services, Creator Site, Member Data, and Personal Data, have the meanings given in the Terms of Service.

This notice applies to you if you live in a state listed in Section 1.2 and that state's law applies to our processing of your Personal Data. It covers the same people and the same Personal Data as the Privacy Notice: Creators and their Authorized Users, Partners, visitors to zinstruct.com, prospective Creators, people who contact us, and Members only where we act as controller. It supplements the Privacy Notice. If the two conflict for a resident of a listed state, this notice controls.

1.2States covered

As of the effective date, this notice addresses the comprehensive privacy laws of these states:

California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

When another state's comprehensive privacy law takes effect and applies to us, we will honor the rights that law gives its residents and update this notice.

1.3If you are a Member

For Member Data, the Creator whose Creator Site you use is the "business" or "controller" under US State Privacy Laws. Zinstruct is the Creator's "service provider" or "processor." This notice does not describe how a Creator uses Member Data. The Creator's own privacy notice does.

• To exercise a right over Member Data, contact the Creator.
• If you send the request to us instead, we forward it to the Creator it concerns, or tell you how to reach that Creator. We then help the Creator respond, as the Data Processing Addendum requires.
• For the limited Personal Data about Members that we control, described in Section 2.2 of the Privacy Notice, this notice applies and you can make requests to us directly.

1.4Notice at collection for California residents

This notice, together with the Privacy Notice, is our notice at collection under the California Consumer Privacy Act. Section 3 lists the categories of Personal Data we collect, the purposes, and how long we keep it. Section 4 explains whether we sell or share it.

2.Definitions used in this notice

These terms apply in this notice. Where a state's law defines a term differently, the state's definition controls for residents of that state.

• Authorized Agent. A person or business entity that you authorize to submit a privacy request on your behalf, as Section 8.5 describes.
• Opt-Out Preference Signal. A signal that your browser, device, or extension sends to tell websites that you want to opt out of Sale, Sharing, or Targeted Advertising. Global Privacy Control (GPC) is one example. Some state laws call this a "universal opt-out mechanism."
• Profiling. Any automated processing of Personal Data to evaluate, analyze, or predict aspects of a person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
• Sale. Disclosing Personal Data to a third party for money or other valuable consideration, as US State Privacy Laws define "sale" or "sell." It does not include disclosure to a service provider or processor acting on our behalf.
• Sensitive Data. Personal Data that a US State Privacy Law treats as "sensitive data" or "sensitive personal information." Examples include precise geolocation, racial or ethnic origin, religious beliefs, health information, sex life or sexual orientation, citizenship or immigration status, genetic or biometric data, neural data, government identifiers, account login credentials combined with a password, and Personal Data of a known child.
• Sharing. Disclosing Personal Data to a third party for cross-context behavioral advertising, as the California Consumer Privacy Act defines "share."
• Targeted Advertising. Showing you advertisements based on Personal Data obtained from your activity over time across websites or online applications that are not ours, as US State Privacy Laws define "targeted advertising."
• US State Privacy Laws. The comprehensive consumer privacy laws of the states listed in Section 1.2 and their implementing regulations, each as amended.

3.Personal Data we collect, use, and disclose

3.1Categories, sources, purposes, and recipients

The table covers the 12 months before the "Last updated" date. The first column uses the category names in our other Policies. The second column maps each one to the categories in the California Consumer Privacy Act.

Service providers and processors may use Personal Data only to provide services to us, under written contracts that meet the requirements of US State Privacy Laws. The Sub-processor List names the providers that process Member Data for Creators. We use providers in the same categories for the Personal Data this notice covers. The Privacy Notice explains each purpose in more detail.

We collect only the Personal Data that is reasonably necessary and proportionate for the purposes in this table. If we want to use Personal Data for a new purpose that is not reasonably necessary to, or compatible with, these purposes, we will ask for your consent first where the law requires it.

3.2How long we keep each category

We keep each category of Personal Data for the periods in [Retention schedule]. In setting those periods, we consider the criteria in Section 8 of the Privacy Notice, such as how long you keep an Account and how long the law requires us to keep records.

4.Sale, Sharing, and Targeted Advertising

[Sale or sharing status]

Whatever this status, you can opt out of any Sale, Sharing, or Targeted Advertising of your Personal Data, now or in the future, using the methods in Section 8.2 and Section 8.3.

We do not disclose Personal Data to third parties for their own direct marketing purposes under California Civil Code § 1798.83 unless this section says so. California residents may ask us about such disclosures by writing to the address in Section 15.

5.Sensitive Data and minors' data

5.1Sensitive Data

• Account login credentials. We collect your Account login and password, which California treats as sensitive personal information. We use and disclose them only to authenticate you, keep the Services secure, and for the other purposes California regulations permit without offering a right to limit. We do not use Sensitive Data to infer characteristics about you. For that reason, we do not offer a "Limit the Use of My Sensitive Personal Information" link.
• Other Sensitive Data. We do not ask you for other Sensitive Data. Where a US State Privacy Law requires your consent before we process Sensitive Data, we will ask for it first, and you can withdraw it at any time. If you choose to include Sensitive Data in Creator Content, a support request, or another communication, we process it only to provide the Services and respond to you.
• Location. The location we derive from your IP address is approximate. We do not collect precise geolocation.
• Card numbers. Stripe collects full payment card numbers. We do not store them.

5.2Minors' data

If we know, or willfully disregard, that you are under 18, we do not sell your Personal Data, share it, or use it for Targeted Advertising. We also do not process it for Profiling in furtherance of decisions that produce legal or similarly significant effects, or for any purpose other than the one disclosed when we collected it, unless we first obtain the consent that the applicable law requires.

6.Profiling, automated decisions, and AI training

6.1Profiling and automated decisions

[Profiling and automated decision-making status]

Where a US State Privacy Law gives you the right to opt out of Profiling in furtherance of decisions that produce legal or similarly significant effects, or to question or contest the result of such a decision, you can exercise that right as Section 8 explains.

Community AI generates sentiment-based insights about a Creator's Community for that Creator. Those insights are Member Data, which the Creator controls, as Section 1.3 explains.

6.2Training AI models

[AI training policy]

The AI Terms explain how Community AI and other AI features work.

7.Your rights

7.1Rights under US State Privacy Laws

Depending on your state, you may have some or all of these rights, subject to the exceptions in your state's law:

• Access. Confirm whether we process your Personal Data and get access to it.
• Know. Learn the categories of Personal Data we have collected about you, the categories of sources, the purposes, and the categories of third parties to which we disclosed it.
• Correct. Correct inaccurate Personal Data, taking into account the nature of the data and the purposes of processing.
• Delete. Delete Personal Data we collected from you or about you.
• Portability. Get a copy of your Personal Data in a portable and, where technically feasible, readily usable format.
• Opt out. Opt out of Sale, Sharing, Targeted Advertising, and Profiling in furtherance of decisions that produce legal or similarly significant effects.
• Third-party list. Get a list of the specific third parties, or categories of third parties, to which we have disclosed or sold your Personal Data.
• Consent for Sensitive Data. Give or withhold consent before we process your Sensitive Data, and withdraw it at any time.
• Appeal. Appeal our decision on your request, as Section 9 explains.
• Non-discrimination. Exercise these rights without being discriminated against, as Section 10 explains.

7.2California residents

If you live in California, you have the right to:

• know the categories and specific pieces of Personal Data we have collected about you, the categories of sources, our business or commercial purposes, and the categories of third parties to which we disclosed it. You can ask about Personal Data we collected in the 12 months before your request, and also about Personal Data collected on or after January 1, 2022, unless providing it would be impossible or involve a disproportionate effort;
• delete Personal Data we collected from you;
• correct inaccurate Personal Data;
• opt out of Sale and Sharing;
• limit the use of your sensitive personal information to the purposes California law permits, which, as Section 5.1 explains, is already how we use it; and
• not receive discriminatory treatment for exercising these rights.

7.3Colorado residents

If you live in Colorado, you have the right to:

• confirm whether we process your Personal Data and access it;
• correct inaccuracies in your Personal Data;
• delete your Personal Data;
• get your Personal Data in a portable and, where technically feasible, readily usable format, up to twice per calendar year;
• opt out of Targeted Advertising, Sale, and Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you;
• give or withhold consent before we process your Sensitive Data; and
• appeal our decision on any of these requests, as Section 9 explains.

You can opt out through an Opt-Out Preference Signal that the Colorado Attorney General recognizes, such as Global Privacy Control, as Section 8.3 explains.

7.4Residents of other covered states

If you live in another state listed in Section 1.2, your rights are those your state's law provides, drawn from the list in Section 7.1. Some states give additional rights, such as the right to get a list of the specific third parties to which we disclosed your Personal Data, or the right to question the result of a profiling decision and learn the reasons for it. We honor each right your state's law gives you.

8.How to exercise your rights

8.1How to submit a request

Send your request by either method:

• Email: support@zinstruct.com, with "Privacy Request" in the subject line.
• Mail: the address in Section 15.

Tell us which right you want to exercise, your state of residence, and the name and email address associated with your Account or your interactions with us. You do not need to create an Account to make a request. If you have an Account, we may ask you to confirm the request by logging in.

If you are a Member asking about Member Data, see Section 1.3.

8.2Your Privacy Choices and opt-out requests

Where we engage in Sale, Sharing, or Targeted Advertising, or in Profiling that you have a right to opt out of, you can opt out in any of these ways:

• use the "Your Privacy Choices" link in the footer of zinstruct.com;
• send an Opt-Out Preference Signal, as Section 8.3 explains; or
• email support@zinstruct.com with "Privacy Request: Opt Out" in the subject line.

You do not need to verify your identity to opt out. We may ask for information needed to apply your choice to your Account, and we may deny a request we reasonably believe is fraudulent, and tell you why. We act on opt-out requests as soon as feasibly possible. For California residents, we act no later than 15 business days after we receive the request, and we notify any third party to which we sold or shared your Personal Data after you submitted the request and before we acted on it, as California regulations require.

Opting out on one browser or device applies to that browser or device. If we can associate your request with your Account, we also apply it to your Account. We show you whether we have processed your opt-out request, for example in your privacy settings.

8.3Opt-Out Preference Signals

We treat an Opt-Out Preference Signal, such as Global Privacy Control, as a valid request to opt out of Sale, Sharing, and Targeted Advertising for the browser or device that sends it. The Colorado Attorney General recognizes Global Privacy Control as a universal opt-out mechanism under the Colorado Privacy Act.

• If you are logged in, or we can otherwise associate the signal with you, we also apply it to your Account.
• We do not ask for more information to process the signal.
• When we detect the signal, we display whether we have honored it, for example with a message such as "Opt-Out Preference Signal Honored" or a setting in your privacy choices.
• If the signal conflicts with a privacy setting in your Account, we honor the signal. We may tell you about the conflict and give you the chance to confirm your setting.

To learn how to turn on Global Privacy Control, visit https://globalprivacycontrol.org.

8.4Verifying your identity

Before we act on a request to access, know, correct, or delete, we verify that the request comes from you. We ask only for information we need to do this. We use it only to verify your identity and to keep records of your request, and we delete it as soon as practical after we finish, except as the law requires us to keep it.

• If you have an Account, we may verify you through your existing Account authentication, such as by asking you to log in or confirm from the email address on your Account.
• If you do not have an Account, we match information you give us against information we already hold. The more sensitive the request, the more information we need.
  • To learn the categories of Personal Data we hold, we match at least two data points.
  • To get specific pieces of Personal Data, or to delete Sensitive Data, we match at least three data points, and for California residents we may also require a signed declaration under penalty of perjury that you are the person whose Personal Data you are requesting.
• If we cannot verify you, we tell you and explain why. For a California request to know specific pieces of Personal Data that we cannot verify, we treat it as a request to know categories. For a deletion request we cannot verify, we deny the request and tell you that you can still opt out of Sale and Sharing.

We never disclose a Social Security number, driver's license or other government identification number, financial account number, health insurance or medical identification number, Account password, or security question and answer in response to a request. We tell you if we hold that type of data without disclosing the data itself.

8.5Authorized Agents

You can use an Authorized Agent to submit a request for you.

• What the agent must provide. Written permission signed by you that authorizes the agent to act for you, or a valid power of attorney. For California requests, a business entity acting as an agent must be registered with the California Secretary of State.
• What we may ask you to do. Unless the agent holds a power of attorney valid under your state's law, we may ask you to verify your own identity directly with us, or to confirm directly with us that you gave the agent permission.
• Opt-out requests. An Authorized Agent can submit an opt-out request for you, including through a technology or Opt-Out Preference Signal where your state's law allows. We may ask for proof of the agent's authority, and we may deny a request from an agent that does not provide it.
• Parents and guardians. A parent or legal guardian can make a request for a known child under 13. A guardian or conservator can make a request for a person under guardianship or conservatorship.
• Agent responsibilities. An Authorized Agent must use your Personal Data only to fulfill your request, verify your identity, or prevent fraud, and must keep it secure.

8.6Timing and fees

• Acknowledgment. For California residents, we confirm receipt of a request to know, delete, or correct within 10 business days and explain how we will process it.
• Response. We respond without undue delay and within 45 days after we receive your request. Where reasonably necessary, taking into account the complexity and number of requests, we may extend that period once by up to 45 additional days. If we do, we tell you within the first 45 days and explain why.
• Denials. If we decline to act on a request, in whole or in part, we tell you why and how to appeal.
• Fees. We do not charge for requests. Where your state's law allows, we may charge a reasonable fee, or decline to act, if a request is manifestly unfounded, excessive, or repetitive, such as a second request of the same type within 12 months where the law permits us to charge for it. If we do, we tell you why.
• Records. We keep records of requests and our responses for at least 24 months, as California regulations require.

9.How to appeal our decision

If we decline to act on your request, in whole or in part, you can appeal. The same process applies to residents of every state listed in Section 1.2.

1. Send your appeal. Reply to our decision, or email support@zinstruct.com with "Privacy Appeal" in the subject line. Include the date of our decision and why you disagree. You can also appeal by mail to the address in Section 15.
2. If we did not respond. If we do not respond to your request within the time Section 8.6 describes, you can treat that as a denial and appeal.
3. Review. We review your appeal and the original request.
4. Our response. We tell you in writing what action we took or did not take on your appeal, and why.
   • Colorado residents: we respond within 45 days after we receive your appeal. Where reasonably necessary, taking into account the complexity and number of requests serving as the basis for the appeal, we may extend that period by up to 60 additional days. If we do, we tell you within the first 45 days and explain why.
   • Residents of other states: we respond within the time your state's law requires.
5. If we deny your appeal. We tell you how to contact your state's Attorney General to submit a complaint. Colorado residents can contact the Colorado Attorney General at https://coag.gov.

10.Non-discrimination and financial incentives

We will not discriminate against you for exercising a privacy right. For example, we will not deny you the Services, charge you a different price or rate, or provide a different level or quality of Services because you exercised a right, except as the law permits.

Financial incentives and loyalty programs: [Financial incentive programs]

11.De-identified data

When we de-identify Personal Data, including to create Aggregated Data, we take reasonable measures to ensure it cannot be associated with an individual. We publicly commit to maintain and use it only in de-identified form and not to attempt to re-identify it, except to test whether our de-identification processes work as the law permits. We contractually require anyone who receives de-identified data from us to make the same commitment.

12.Children

The Services are not directed to children under [Minimum age]. We do not knowingly collect Personal Data from children under that age. If you believe a child under that age has given us Personal Data, contact us at support@zinstruct.com and we will take steps to delete it. Creators whose Creator Content targets children must comply with the Children's Online Privacy Protection Act (COPPA) and every other applicable law, and must not use the Services in a way that causes Zinstruct to collect Personal Data from children without the consent the law requires.

Section 5.2 explains how we treat Personal Data of people we know are under 18.

13.Governing law

Nothing in this section limits any right that the privacy law of the state where you live gives you and does not allow to be waived, or your right to complain to your state's Attorney General or other regulator.

14.Changes to this policy

We review this notice at least once every 12 months and update it when our practices or the law change. When we update it, we post the updated version in the Policy Center and change the "Last updated" date at the top.

If a change is material, we will notify you by email or through the Services at least [Change notification period] before it takes effect, unless the law requires a change to take effect sooner. If a change would let us process Personal Data we have already collected for a purpose that is not reasonably necessary to, or compatible with, the purposes we disclosed, we will ask for your consent first where the law requires it.

15.Contact us