Which Hat We Are Wearing
This matters before anything else, because it decides who you ask.
If you registered for a seminar, a class or an appointment and received an email or a text about it, the business that ran that event is the "business" under the CCPA. OPVII is its "service provider". We hold that data on their instruction, we do not use it for anything of our own, and we will pass your request to them rather than act on their records without being told to.
If you hold an account with us, or you are simply visiting this website, OPVII is the "business" for that information and this notice applies to us directly.
What We Collect, And Why
These are the statutory categories from Cal. Civ. Code 1798.140. The table says which ones we actually collect, so the categories we do not touch are as visible as the ones we do.
We do not collect sensitive personal information as the CPRA defines it, which means no government identifiers, no financial account credentials, no precise geolocation, no racial or ethnic origin, no religious beliefs, no union membership, no genetic or biometric data, no health information and no contents of your mail or messages to other people. Because we do not collect it, the right to limit its use has nothing to operate on.
| Category | Collected | Where It Comes From | Why |
|---|---|---|---|
| Identifiers | Yes | You, or the business that registered you | Running your account and sending event messages |
| Customer Records | Yes | You, at checkout | Billing and tax records |
| Commercial Information | Yes | Your account activity | Plan history, invoices and support |
| Internet Activity | Yes | Your browser, our servers | Site analytics, email opens and clicks, abuse prevention |
| Geolocation | Approximate Only | Your IP address | Fraud prevention and deciding which privacy notice to show |
| Professional Information | Only If Entered | A customer typing it into a field | Whatever that customer collected it for |
| Sensitive Personal Information | No | Not Collected | Not Applicable |
| Biometric Information | No | Not Collected | Not Applicable |
| Audio Or Visual Information | No | Not Collected | Not Applicable |
| Education Information | No | Not Collected | Not Applicable |
| Inferences And Profiles | No | Not Created | We build no profile about any individual |
Selling And Sharing, Answered Precisely
We have never sold personal information for money or for anything else of value, and we do not. No part of this business is funded by passing your data to anybody.
Sharing is a narrower and more technical word. The CPRA uses it to mean disclosing personal information for cross-context behavioral advertising, and the answer depends entirely on which part of our service you are in.
Inside a workspace, the attendee portal, and every signed-in page: no. Those pages carry no analytics tag and no advertising tag at all. Registrant data is never disclosed for advertising, never used to build an audience, and never used to train a model.
On our public marketing pages: yes, treat the answer as yes. We run Google Analytics and Google Ads conversion and remarketing tags so we can tell which pages and which ads bring in customers, and in California that is most sensibly treated as sharing for cross-context behavioral advertising. We would rather tell you that than rely on a narrow reading in our own favor.
We do not knowingly sell or share the personal information of anybody under 16.
Turning That Off
Select Your Privacy Choices in the footer of any page. It opens the cookie choice on the page you are on, and choosing Essential Only switches off the analytics and advertising tags immediately. No account, no email, no form.
If your browser sends a Global Privacy Control signal, we treat that as a valid opt-out request on its own and switch those tags off before you are asked anything. You do not have to find the link.
Opting out never changes the price you pay, the plan you can buy, or the support you get. The Cookie Policy names every cookie involved.
Who We Disclose Information To
We disclose personal information to service providers who need it to run the platform: hosting, the network edge, email delivery, SMS delivery, and payment processing. Each is bound by a written contract that limits them to performing that service and forbids retaining, using or disclosing the information for anything else.
Every one of them is named at /subprocessors, with what it receives and where it operates. That register is the authoritative list: if a provider is not on it, it does not receive your information.
We may also disclose information when the law requires it, or to protect our rights or somebody's safety. We do not disclose personal information to third parties for their own direct marketing, which also answers the Shine the Light law at Cal. Civ. Code 1798.83.
Your Rights
As a California resident you have the right to know what we collect about you and to receive a copy of it, the right to correct it when it is wrong, the right to have it deleted, the right to opt out of its sale or sharing, the right to limit the use of sensitive personal information, and the right not to be treated worse for exercising any of them.
You can also ask for the specific pieces of information we hold, the categories of sources, the business purpose for collecting it, and the categories of third parties we disclosed it to, for the twelve months before your request and, on request, further back than that.
The right to limit sensitive personal information is listed for completeness. We do not collect any, so there is nothing for it to restrict.
How To Make A Request
Write to dev@opvii.local with the words "California Privacy Request" in the subject line and tell us which right you are exercising. You can also call the number in the site header.
We will confirm receipt within ten business days and respond within 45 days. If we need more time we may take another 45, and we will tell you why before the first 45 are up. There is no fee.
We will ask for enough information to match your request to our records with reasonable certainty, because handing somebody else's registration history to the wrong person is the worse failure. We will not ask you to create an account to make a request, and we will not ask why you are asking.
If we have to deny a request, we will tell you which exception applies rather than simply declining.
Using An Authorized Agent
You can appoint somebody to make a request for you. We will ask for written permission signed by you, and we may still contact you directly to confirm you asked for it and to verify your identity. An agent holding a valid power of attorney does not need to do the second part.
How Long We Keep It
Account and workspace records are kept for as long as the account is open, and then deleted on request or on our ordinary schedule. Administrative audit records are kept two years and security events seven. Billing records are kept as long as tax law requires.
Opt-out records outlive the data they relate to, deliberately. If we deleted the record that a number asked not to be contacted, we would lose the only evidence protecting the person who asked.
Other States
Virginia, Colorado, Connecticut, Utah, Texas and the other states with comprehensive privacy laws give their residents a closely similar set of rights, including access, correction, deletion, portability and an opt-out of targeted advertising.
We handle a request from any of those states the same way we handle a California one, through the same address, on the same timeline. You do not need to work out which law applies to you before writing to us.
Contact
Questions about this notice, or about any request you have made, go to dev@opvii.local. If you believe we have mishandled something we would like the chance to fix it, and you are free to complain to the California Privacy Protection Agency or the California Attorney General whether or not you give us that chance.