US State Privacy Notice
This notice supplements our Privacy Policy for individuals in US states with a comprehensive consumer privacy law — including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states whose laws have since come into effect or take effect after this notice was last updated. Where a right described here is specific to one state's law, we honour it for residents of that state; where it isn't specific to any one law, we apply it to all US states as a matter of practice.
Business contact: Kristiyan Tsvetanov, trading as Warmerly, 318 Shady Lane, Birmingham, B44 9EB, England, United Kingdom. Requests under this notice go to privacy@warmerly.com.
1. Categories of personal information we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers | Name, email address, account identifiers, IP address. | Directly from you, when you create an account or connect a mailbox. |
| Customer records | Billing name and address, payment method on file (held by Stripe, not us). | Directly from you and our payment processor, Stripe. |
| Commercial information | Your subscription plan, billing history, and usage of paid features. | Directly from you and generated by the service as you use it. |
| Internet or network activity | Pages viewed, browser type, timestamps, and — only if you accept non-essential cookies — analytics and attribution cookie data. | Automatically, from your browser and device. See our Cookie Policy. |
| Geolocation data (approximate) | Country or region, inferred from IP address. We do not collect precise device geolocation. | Automatically, from your IP address. |
| Professional or employment-related information | Job title, employer, and business contact details — either your own, in your account, or a third party's, in the business-contact database or your campaign/mailbox data. | Directly from you, or from public sources for business-contact data (see our Prospect Privacy Notice). |
| Mailbox and messaging content | Contents of connected mailboxes and connected LinkedIn/WhatsApp/Instagram accounts, and warmup mail exchanged with other customers' mailboxes. | From you, via the connections you authorise, and from the third parties who correspond with you or with other customers in the warmup network. |
| Inferences | AI classification of inbox messages as leads, spam, or not relevant; confidence scores on email addresses generated by our email finder. | Generated internally from the categories above, using the AI processing described in our Privacy Policy §3. |
We do not collect the following categories, which some state laws also enumerate:
- Protected classification characteristics (race, religion, health, sexual orientation, etc.)
- Biometric identifiers
- Precise (device-level) geolocation
- Non-public education records
2. Categories of personal information disclosed, and to whom
We disclose personal information to the service providers listed on our Sub-processors page — hosting, billing, transactional email, AI processing, and the LinkedIn/WhatsApp/Instagram integration providers among them — each under a contract that restricts them to processing it on our behalf, for our purposes, and prohibits them from selling it or using it for their own independent purposes. That is a service-provider disclosure, not a sale or a share, under every state law this notice covers.
Do we sell personal information? No. We have never sold personal information, and we do not exchange it for money or other valuable consideration with anyone.
Do we share personal information for cross-context behavioral advertising? By default, no — analytics and advertising cookies (Google Analytics, and our marketing conversion pixel) do not load or transmit anything until you affirmatively accept non-essential cookies, or unless your browser has not sent a Global Privacy Control signal that we honour as a standing opt-out. If you do accept them, Google Analytics receives cookie-based identifiers and page/conversion events; we do not currently run interest-based advertising campaigns or send Google any identifier explicitly tied to your name or email (see our Cookie Policy). Because some state definitions of "share" are broad enough to capture cookie-based analytics/advertising identifiers even without an active ad campaign, we treat declining cookies, or sending a Global Privacy Control signal, as an opt-out of any sharing that could otherwise occur through those cookies — see section 3.
We do not disclose personal information to data brokers, and we do not disclose sensitive personal information for purposes beyond what is necessary to provide the service.
3. Your rights
Depending on your state of residence, you have the right to:
- Know / access — request the categories and specific pieces of personal information we hold about you.
- Correct — request correction of inaccurate personal information.
- Delete — request deletion of your personal information, subject to exceptions (e.g. information we must keep for legal or security reasons).
- Opt out of sale or sharing — although we do not sell personal information, you can opt out of any cookie-based sharing described in section 2 by declining non-essential cookies on our Cookie Policy banner, or by sending a Global Privacy Control signal from your browser, which we honour automatically as a standing opt-out — no separate request needed.
- Limit use of sensitive personal information — we do not use sensitive personal information for purposes beyond providing the service, so there is nothing further to limit.
- Non-discrimination — we will not deny you service, charge you a different price, or provide a different level of quality because you exercised a right under this notice.
- Portability — request a copy of your data in a portable format.
To exercise any of these, email privacy@warmerly.com from the email address on your account (or describe your relationship to us if you don't have an account) and tell us which right you're exercising. We will verify your request using information we already hold about you before acting on it, and respond within 45 days, with one 45-day extension where the law allows it and we tell you why.
4. Appeals
If we decline a request — in whole or in part — you can appeal by replying to our decision email, or emailing privacy@warmerly.com with "Appeal" in the subject line and the original request. We will respond to an appeal within 60 days. If we uphold our original decision, we will explain why and, where your state provides one, tell you how to escalate to your state Attorney General or other regulator.
5. Authorized agents
You may use an authorized agent to submit a request on your behalf. To act on a request, we need: (a) written proof that you have authorized the agent to act for you (a signed permission statement is sufficient), and (b) confirmation directly from you that you authorized the agent, which we may seek by contacting you at the email address on your account. We may deny a request from an agent who cannot provide both.
6. Retention
We retain personal information for the periods set out in our Privacy Policy §8 (or, for business-contact data, our Prospect Privacy Notice §5) — those are the same retention schedules that apply under this notice; we don't keep a separate, longer schedule for US residents.
7. Changes
We will post any updates to this notice on this page and update the date above. Material changes will be notified by email where we have one for you.
8. Contact
Kristiyan Tsvetanov, trading as Warmerly, 318 Shady Lane, Birmingham, B44 9EB, England, United Kingdom. Email privacy@warmerly.com for any request or question under this notice.