U.S. STATE PRIVACY NOTICE
Effective Date: June, 2025
This supplemental U.S. State Privacy Notice applies to “Consumers” in certain states with data privacy laws requiring such notice (collectively, the “U.S. State Privacy Laws”). This U.S. State Privacy Notice operates in conjunction with the Company’s Privacy Policy and other notices. In the event of a conflict between any other Company policy, statement, or notice and this U.S. State Privacy Notice, this U.S. State Privacy Notice will prevail as to Consumers and their rights under the applicable U.S. State Privacy Law. Capitalized terms used but not defined herein will have the meanings given to them in the Privacy Policy.
This U.S. State Privacy Notice is designed to provide you with notice of the Company’s data practices in connection with the Services and anywhere this U.S. State Privacy Notice is posed over the prior 12 months (from the Effective Date listed at the top of this U.S. State Privacy Notice), as required under some U.S. State Privacy Laws. Additionally, this U.S. State Privacy Notice also applies to our current data practices such that it is also meant to provide you with “notice at collection,” which is notice of the Personal Information the Company collects and the purposes for which the Company processes personal information, among other requirements of the U.S. State Privacy Laws. For any new or substantially different processing activities that are not described in this U.S. State Privacy Notice, we will notify you as legally required, such as at the point of collection. The Company reserves the right, in its sole discretion, to amend this U.S. State Privacy Notice at any time. When the Company makes changes to this U.S. State Privacy Notice, we will update the Effective Date to the date that this U.S. State Privacy Notice was last updated.
Please note that this U.S. State Privacy Notice does not apply to data that is not treated as “personal information” under U.S. State Privacy Laws or to the extent that data is subject to an exemption under the applicable laws. This U.S. State Privacy Notice also does not apply to information collected by third-party content, websites, applications, platform, code, and certain cookies and other tracking technologies (“Third-Party Services”).
- Collection, Use, and Disclosure of Personal Information. Generally, the Company collects, uses, and discloses the Customer’s Personal Information to provide the Services and as otherwise related to the operation of our business, which includes the purposes described in the Privacy Policy and listed below (“Processing Purposes”). This may include disclosing or otherwise making Personal Information available to the third parties that perform services for us (“Vendors”), including “Service Providers” and “Processors,” as defined under U.S. State Privacy Laws. Some of the Processing Purposes discussed below implicate “Sale,” “Sharing,” or “Targeted Advertising.” For more details on the meaning of Sale, Sharing, and targeted Advertising, and how to opt-out of them, please reference the Do Not Sell/Share/Target section below. Please note that the Processing Purposes depicted in the table are categorical descriptions to aid in readability and clarity.
- Processing Purposes. The Company collects, uses, discloses, and otherwise processes the Customer’s Personal Information in connection with the operation of our business, including for the following Processing Purposes:
- Registration. Information is used to register and manage the Customer’s account, including to allow access to and use of the Services, to process payments or credits, and to offer promotional programs.
- Improve the Website and Services. Information is used for analytical purposes and to enable the Company to improve the Website and Services, and to provide a tailored and optimized user experience.
- Individualization. Information is used to notify the Customer about special offers or services available from the Company or its affiliates and partners.
- Customer Service and Communication. Information is used to communicate with the Customer or facilitate communication between the Customer and the Company or its affiliates and partners; to conduct, monitor, and record interactions with the Company, Website and the Services; to host reviews, forum posts, photos, videos, and other content; to respond to requests, questions, and comments.
- Legal Compliance. Information is used to resolve disputes or troubleshoot problems; to prevent fraud and other potentially prohibited or unlawful activities; to comply with relevant laws and regulations; to respond to legal requests and protect the Company’s rights; to provide payment services, including detection and prevention of money laundering, fraud, and security incidents; to comply with the Company’s legal obligations; and to enforce any applicable terms of service. If the Company uses automated decision-making technologies to process Personal Information, the Company will implement appropriate measures required to safeguard the Customer’s rights, including Customer’s right to obtain human intervention.
- Advertising. Information is used to serve the Customer with relevant ads and to serve other customers who have similar profiles with relevant advertising through custom audiences and look-alike audiences. Information is also used to measure and track the effectiveness of advertising campaigns and carry out other administrative and accounting activities with respect to ad campaigns.
- Security. Information is used to detect threats and protect against malicious or fraudulent activity.
- Purposes Disclosed at Collection. The Company may use your information for a purpose not disclosed above. In that case, the purpose of the usage will be disclosed at the time the information is collected.
- Legitimate Business Purposes. The Company may use your information for legitimate business purposes that are compatible with the above purposes for collecting your personal data and that are not prohibited by law.
- Categories of Personal Information the Company Collects. The table below describes the categories of Personal Information we collect, as well as examples of types of data that fit those categories. The middle column lists Processing Purposes applicable to each category of Personal Information. The right column states the categories of recipients of those specific categories of Personal Information as part of disclosures for business purposes, as well as disclosures that may be considered a Sale or Sharing under certain U.S. State Privacy Laws.
- Processing Purposes. The Company collects, uses, discloses, and otherwise processes the Customer’s Personal Information in connection with the operation of our business, including for the following Processing Purposes:
INFORMATION | PROCESSING PURPOSE | RECIPIENTS |
Identifiers and contact information (including name, phone number, physical address, email address, mobile identification number, IP address, and cookie ID) |
| Disclosures for business purposes:
Sale/Sharing Recipients:
|
Personal records (such as name, signature, physical address, telephone number, education, current employment, employment history, bank account number, and credit card number) |
| Disclosures for business purposes:
Sale/Sharing Recipients:
|
Personal characteristics or traits (such as age and gender) |
| Disclosures for business purposes:
Sale/Sharing Recipients:
|
Transaction/Commercial Information (such as the Services used, purchased, or considered; Third-Party Business Partners’/Digital Businesses’ products or services considered; and other purchasing or consuming histories or tendencies provided by Business and Marketing Vendors); queries and responses to queries |
| Disclosures for business purposes:
Sale/Sharing Recipients:
|
Services Usage Information (such as search history, browsing history, and other interactions with the Website or Services) |
| Disclosures for business purposes:
Sale/Sharing Recipients:
|
Location Data (such as where you enable location-based features on you device, or we may infer your rough location via zip code) |
| Disclosures for business purposes:
Sale/Sharing Recipients:
|
Professional or Employment Information (such as job title, affiliated organization, professional expertise and experience, and education) |
| Disclosures for business purposes:
Sale/Sharing Recipients:
|
Inferences from Personal Information (we may infer your interest in certain content based on how you use the Website and Services) |
| Disclosures for business purposes:
Sale/Sharing Recipients:
|
Account information and password (we may store your account login in combination with a password in our systems) |
| Disclosures for business purposes:
Sale/Sharing Recipients:
|
Sensitive Personal Characteristics (such as race, ethnicity, and religious affiliation, when voluntarily provided) |
| Disclosures for business purposes:
Sale/Sharing Recipients:
|
- The Company may also disclose each category of Personal Information in the table to the following categories of recipients in a manner that does not constitute sale or sharing:
- To other parties at your direction or through your intentional action.
- To the government or private parties to comply with law or legal process.
- In connection with a corporate transaction, such as a divestiture, merger, consolidation, or asset sale, in which case we will transfer such information to the buyer or successor entity in any such corporate transaction.
- Additionally, our Vendors and the other recipients listed in the above table may, subject to contractual restrictions imposed by the Company and other legal obligations, use and disclose your Personal Information for business purposes. For example, our Vendors and the other categories of recipients may engage subcontractors to enable them to perform services for us or process for our business purposes.
- Processing Purposes Implicating Sale, Sharing, Targeted Advertising, and Profiling. When you provide us with Personal Information for the following Processing Purposes, we may use and disclose certain information provided for such purposes in a manner that may constitute Selling or Sharing, as well as Processing for purposes of Targeted Advertising. These Processing Purposes include:
- Providing the Website and Services.
- Facilitating your relationship with Third-Party Business Partners.
- Targeting advertisements.
- Ad measurement, attribution, and other ad administration.
- For purposes disclosed at the time you provide your personal information.
- Sources of Personal Information. As described in the Privacy Policy, we collect Personal Information directly from you or your device, Third-Party Digital Businesses, Third-Party Business Partners, Vendors, our affiliates and related entities, other individuals, other users of the Website and Services, and other third parties.
- Data Retention. The Company retains Personal Information for varying lengths of time depending on the context in which the data was collected and used. For a more detailed description of the Company’s data retention practices and to request a deletion, please consult the Privacy Policy.
- The Company may also disclose each category of Personal Information in the table to the following categories of recipients in a manner that does not constitute sale or sharing:
- Consumer Rights Requests. Subject to the requirements of a Verifiable Consumer request, as defined below, we provide Consumers who reside in states with applicable U.S. State Privacy Laws with the privacy rights described in this Section. Requests made by residents of states without such laws will be considered at the discretion of the Company. Where a state has passed a U.S. State Privacy Law that has not yet taken effect, requests made under such legislation will be considered at the Company’s discretion.
- Verifiable Consumer Request. As permitted by U.S. State Privacy Laws, any request you submit to us is subject to an identity verification process (“Verifiable Consumer Request”) as described in the Verifying Your Request section below. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify that you are the Consumer about whom we have collected Personal Information.
- Making a Request. To make a request, other than a Do Not Sell/Share/Target request, please submit your request to us by one of the methods below. For instructions on how to submit a Do Not Sell/Share/Target request, please refer to the Do Not Sell/Share/Target section below.
- Email: [email protected]
- Scope of Requests. Some information we maintain about Consumers that is technically be considered Personal Information may nevertheless not be sufficiently associated with the information that you provide when making your request. For example, if you provide your name and email address when making a request, we may be unable to associate that information with certain data collected through the Website or Services, such as clickstream data tied only to a pseudonymous browser ID. Where we are unable to associate such information with the information you provide, we will be unable to associate such information with you and, thus, cannot include it in our response to your request. If we cannot comply with a request, we will explain the reason why. We will use Personal Information provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses, unless you also consented to use for another purpose.
- Commercially Reasonable Response. We will make commercially reasonable efforts to identify Personal Information that we collect, process, store, disclose, and otherwise use and to respond to your privacy requests. We generally do not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded, or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining our decision. You will be provided a cost estimate and the opportunity to accept such fees before we charge you for a response.
- Verifying Your Request. When you make a request, we will verify that you are the person you claim to be, or, if you are seeking information on another person’s behalf, that you are authorized to make such a request. Additionally, we will compare the information you provide against our records to ensure that we possess Personal Information about you. At minimum, we ask that you provide your name and email address. Depending on the nature of the request and whether we have the email address you provided in our systems, we may request further information to verify that you are the Consumer making the request. We will not fulfill your Right to Know, Right to Delete, or Right to Correct request unless you have provided sufficient information for us to reasonably verify that you are the Consumer that is the subject of the request. The same verification process does not apply to opt-outs of Sale or Sharing, or limitation of Sensitive Personal Information requests, but we may authentication measures if we suspect fraud.
- Verification Standards. The verification standards we are required to apply for each type of request will vary. For certain requests, we may verify only two points of information, while other deletions or corrections may require a higher degree of certainty. If we cannot verify you for purposes of certain requests, we will still take certain actions as required by certain U.S. State Privacy Laws. For example, if you are a California Consumer:
- If we cannot verify your deletion request, we will refer you to this U.S. State Privacy Notice for a general description of our data practices.
- If we cannot verify your specific pieces request, we will treat it as a categories request.
- Authorizing an Agent. You may designate an authorized agent to submit a request on your behalf by submitting a request in the manner set forth above. If you are an authorized agent who would like to make a request, the U.S. State Privacy Laws require that we ensure that your request is a Verifiable Consumer Request and allow us to request further information to ensure that the Consumer has authorized you as their agent for this request. Generally, we will ask that an agent provide proof that the Consumer has authorized the request and, as permitted under U.S. State Privacy Laws, we may also require the Consumer to either verify their own identity or directly confirm with us that they have authorized the request.
- Your Consumer Privacy Rights. In addition to the consumer privacy rights set out in the Privacy Policy, Consumers who reside in certain states also have the following rights.
- Appeal Rights. Residents of Colorado, Connecticut, Florida, Montana, Oregon, Texas, Virginia, and other states have the right to appeal a decision regarding a privacy request. Those Consumers may exercise this right by responding to the email we send in response to your request and following the instructions in such email.
- Right to Limit Processing of Sensitive Personal Information. Certain Personal Information qualifies as sensitive data or Sensitive PI under the U.S. State Privacy Laws, which we refer to in this U.S. State Privacy Notice as “Sensitive PI”. Residents of certain states must give consent for U.S. News to process their Sensitive PI. If you give such consent, you subsequently have the right to opt-out of certain processing of Sensitive PI if it is used or disclosed beyond certain internal business purposes. Where applicable, we will treat such an opt-out request as a revocation of any consent that you may have provided to your processing of Sensitive PI.
- Right to Know; Categories or Confirmation of Processing. If you are a California resident, you have the right to request that we provide you with certain information about our collection, use and disclosure of your Personal Information over the 12-month period prior to the request date, related to categories of Personal Information. You can request that we confirm whether we are processing your personal information, and disclose to you:
- The categories of Personal Information we collected about you.
- The categories of sources for the Personal Information.
- Our business or commercial purpose for collecting or selling that Personal Information.
- A list of the categories of Personal Information disclosed for a business purpose in the prior 12 months.
- A list of the categories of Personal Information sold or shared about you in the prior 12 months and, for each of the above, the categories of recipients.
- Right to Know; Specific Pieces. You have the right to request a transportable copy of the specific pieces of Personal Information we collected about you. In some states, such as California, this includes the right to Personal Information collected in the 12-month period preceding your request. Please note that Personal Information is retained by us for various time periods, so there may be certain information that we have collected about you that we do not even retain for 12 months (and thus, it would not be able to be included in our response to you). Based on your state of residence, we may apply a limit on the number of “Right to Know” requests you make over a particular time period, as permitted under U.S. State Privacy Laws.
- Right to Delete. You have the right to request that we delete any of your Personal Information that we have collected directly from you, subject to certain exceptions which we will explain if they apply. After we confirm that your deletion request is a Verifiable Consumer Request, subject to permitted retention exceptions, we will carry out one or more of the following: (i) permanently erase your Personal Information on our existing systems with the exception of archived or back-up systems, (ii) deidentify your Personal Information, or (iii) aggregate your Personal Information with other information. In our response to your request to delete, we will tell you the method for deleting your Personal Information. Where legal exceptions apply to your request for deletion, we will tell you which one(s) and limit retention to the permitted purpose(s).
- Right to Correct. You have the right to request that we correct inaccuracies that you find in your personal information maintained by us. Your request to correct is subject to our verification (discussed above) and the response standards in the applicable U.S. State Privacy Laws.
- Oregon Residents: Third Parties. Oregon residents have the right to request a list of third parties (non-Service Providers/Processors) to which we have disclosed personal information.
- Do Not Sell/Share/Target. Under the various U.S. State Privacy Laws, Consumers have the right to opt-out of certain processing activities. California and certain other states have opt-outs specific to Targeted Advertising activities – which California’s law refers to as “cross-context behavioral advertising”, and others simply as Targeted Advertising – which involve the use of Personal Information from different businesses or services to target advertisements to you. California provides Consumers the right to opt-out of Sharing, which includes providing or making available Personal Information to third parties for such Targeted Advertising activities, while other states provide Consumers the right to opt-out from processing Personal Information for Targeted Advertising more broadly. There are broad and differing concepts of the Sale of Personal Information under the various U.S. State Privacy Laws, all of which at a minimum require providing or otherwise making available Personal Information to a third party.
- Third Parties. Third-Party digital businesses, including social media platforms, analytics companies, data brokers, third-party advertisers, and other tech companies that offer digital advertising services (“Third-Party Digital Businesses”) may associate cookies, web beacons (also known as pixel tags) and other similar technology (“Tracking Technologies”) on the Website or Services that collect Personal Information when you use or access the Website or Services, or otherwise collect and process Personal Information that we make available about you, including digital activity information. Giving access to Personal Information on the Website or Services, or otherwise, to Third-Party Digital Businesses could be deemed a Sale and/or Sharing and could implicate Targeted Advertising under some state laws. Therefore, we will treat such Personal Information collected by Third-Party Digital Businesses (e.g., cookie ID, IP address, and other online IDs and internet or other electronic activity information) as such, and subject to the opt-out requests described above. In some instances, the Personal Information we make available about you is collected directly by such Third-Party Digital Businesses using Tracking Technologies on the Website or Services or our advertisements that are served on third-party sites (which we refer to as “cookie PI”). However, certain Personal Information which we make available to Third Party Digital Businesses is information that we have previously collected directly from you or otherwise about you, such as your email address (which we refer to below as “non-cookie PI”).
- Opt-Out. When you opt-out pursuant to the instructions below, it will have the effect of opting you out of Sale, Sharing, and Targeted Advertising, as applicable, under all of the various applicable state laws. Instructions for opting out are below. Please note that there are distinct instructions for opting out of cookie PI and non-cookie PI, which we explain further, below.
- Opt-out for non-cookie PI. If you would like to submit a request to opt-out of our processing of your non-cookie PI (e.g., your email address) for Targeted Advertising, or opt-out of the Sale or Sharing of such data, make an opt-out request via email to [email protected].
- Opt-out for cookie PI. If you would like to submit a request to opt-out of our processing of your cookie-related PI for Targeted Advertising, or opt-out of the sale/sharing of such PI, you can exercise an opt-out request by emailing [email protected]. You must exercise your preferences on each of our websites and apps you visit, from each browser you use, and on each device that you use. Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be effective and you will need to enable them again via our Consent Management Platform.
- Additional Cookie Choices. Third-Party Digital Businesses may use cookies and other Tracking Technologies to recognize your device and/or to collect and record information about your visits to the Website or Services and other websites to facilitate feature functionality, measure the effectiveness of ads, track page usage and paths followed during visits, and provide interest-based advertisements to you. These companies may provide this data to us. If you would like more information about this practice and to know your choices about certain kinds of online interest-based advertising, please visit National Advertising Initiative Consumer Opt Out, Digital Advertising Alliance Your AdChoices , or AdChoices for your mobile device. The Company does not provide any assurances that these third-party tools, programs or statements are complete or accurate.
- Global Privacy Control (“GPC”). Some of the U.S. State Privacy Laws require businesses to process GPC signals. GPC signals are signals sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of Sale, Sharing and/or Targeted Advertising, such that the GPC signal effectively automatically communicates such requests. To use GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable GPC. To our knowledge, we have configured our websites to receive and honor GPC signals pursuant to the specification and implementation instructions at https://globalprivacycontrol.org. We will apply GPC signals as a Do Not Sell/Share/Target requests as to cookie PI. Due to technical limitations, we are unable to apply GPC signals to non-cookie PI; however, you can make a Do Not Sell/Share/Target request as to non-cookie PI at our webform as just described above. Notably, when you are visiting our website on a particular device and browser, we will apply the GPC signal and corresponding Do Not Sell/Share/Target as to cookie-PI only to that specific device and browser. You must re-enable GPC if you visit our website on a different device and/or browser. We are required by certain U.S. State Privacy Laws to state that we do not: (1) charge a fee for use of our websites if you have enabled GPC; (2) change your experience with our websites if you use GPC; or (3) display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to GPC (except that we may from time-to-time display on our website or consent management platform that you have enabled GPC).
- Right to Non-Discrimination; Incentive/Loyalty Programs. You have the right not to receive discriminatory treatment, as prohibited by U.S. State Privacy Laws, for the exercise of your privacy rights.
- Our Rights and Others’. Notwithstanding anything to the contrary, we may collect, use, and disclose your Personal Information as required or permitted by applicable law and this may override your rights under U.S. State Privacy Laws. In addition, we need not honor any of your requests to the extent that doing so would infringe upon our or any other person or party’s rights or conflict with applicable law.
- Other California Notices. In addition to CCPA rights, certain Californians are entitled to certain other notices, including those described below.
- Third Party Marketing and Your California Privacy Rights. California’s “Shine the Light” law permits California residents to request certain information regarding our disclosure of Personal Information to third parties for their own direct marketing purposes. Separate from your CCPA rights described above, you have the following additional rights regarding disclosure of your information to third parties for their own direct marketing purposes. We may from time to time elect to share certain “personal information” (as defined by California’s “Shine the Light” law) about you with third parties for those third parties’ direct marketing purposes. California Civil Code § 1798.83 permits California residents who have supplied personal information, as defined in the statute, to us to, under certain circumstances, request and obtain certain information regarding our disclosure, if any, of personal information to third parties for their direct marketing purposes. If this applies, you may obtain the categories of personal information shared and the names and physical addresses of all third parties that received personal information for their direct marketing purposes during the immediately prior calendar year (e.g., requests made in 2025 will receive information about 2024 sharing activities). To make such a request, please provide sufficient information for us to determine if this applies to you, attest to the fact that you are a California resident and provide a current California physical address. You may make this request by contacting us at [email protected]. Any such request must include “Shine the Light California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year. As these rights and your CCPA rights are not the same and exist under different laws, you must exercise your rights under each law separately.
- California Minors. Although the Website and Services are not directed at people under 18, any California residents under the age of eighteen (18) who have registered to use the Website or Services, and who posted content or information on the Website or Services, can request removal by contacting us at [email protected], detailing where the content or information is posted and attesting that you posted it. We will then make reasonably good faith efforts to remove the post from prospective public view or anonymize it, so the minor cannot be individually identified to the extent required by applicable law. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished or archived content by search engines and others that we do not control.
- Notice for Nevada Residents. Users of the Website and Services, who are Nevada consumers, have the right to submit a verified request that the Company does not sell such Nevada consumer’s covered information. Such right is further described, and the terms are defined, in Nevada Revised Statutes 603A (the “Nevada Internet Privacy Law”). The Company does not currently sell any covered information as defined in the Nevada Internet Privacy Law. Nevada consumers may register an email address to which identity verification instructions will be delivered if the Company begins selling covered information, as defined by the Nevada Internet Privacy Law, in the future. Any Nevada consumer who wishes to so register should send his/her email address and a request to register to [email protected] with “Nevada Do Not Sell Request” in the subject line and the message of the email. Should a Nevada consumer’s registered email address subsequently change, such Nevada consumer must contact [email protected] to inform the Company of such change (specifying the Nevada consumer’s old and new email addresses), as the Company will not search any other records in the event a registered email address is no longer valid.
- Contact Us. If you have any questions about the Privacy Policy or the U.S. State Privacy Notice, or to exercise any of the rights stated therein, you may contact us at:
Jessa and Waffle, LLC d/b/a Source of Sources
350 West 42nd St.
New York, NY 10036