Your Privacy Rights Under California Law
If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information. This page describes those rights and explains how to exercise them.
Non-California residents: Please refer to our main Privacy Policy for information about our data practices.
We collect the following categories of personal information from California residents, for the business purposes described below:
| Category of Personal Information | Business Purpose for Collection | Retention Period |
|---|---|---|
| Identifiers Name, email, address, IP address, account name |
Provide services, account management, communication, security | As long as account active + 2 years |
| Customer Records Phone number, payment info, shipping address |
Order fulfillment, customer service, transaction processing | 7 years (tax/legal compliance) |
| Commercial Information Purchase history, product interests, assessment results |
Personalized recommendations, product improvement, analytics | 5 years |
| Internet Activity Browsing history, search history, interactions with website |
Analytics, site optimization, fraud prevention | 2 years (anonymized after 26 months) |
| Geolocation Data IP-based location (not precise GPS) |
Analytics, fraud prevention, regional compliance | 30 days in logs |
| Inferences Pet health profile, supplement preferences, predicted needs |
Personalized recommendations, service improvement | 3 years |
| Sensitive Personal Information Account login credentials, payment card information |
Authentication, transaction processing (no secondary use) | As required for purpose |
We collect this information directly from you, automatically through your use of our Site, and from third-party service providers (payment processors, shipping carriers).
SOBS Pets DOES NOT sell personal information. We do not exchange your personal information for monetary consideration. We also do not "share" personal information for cross-context behavioral advertising as defined under California law.
This disclosure covers the preceding 12 months from the effective date of this policy (February 12, 2025 - February 12, 2026).
We do not use automated decision-making technology, including profiling, that produces legal or similarly significant effects concerning California consumers.
As a California resident, you have the following rights under the CCPA/CPRA. These rights are subject to certain exceptions and verification requirements.
Request disclosure of categories and specific pieces of personal information collected.
Learn More →You have the right to request that we disclose the following information about our collection and use of your personal information over the past 12 months:
We may deny your request to know specific pieces of personal information if disclosure would:
You have the right to request that we delete any personal information about you that we have collected from you, subject to certain exceptions.
We may deny your deletion request if retaining the information is necessary for us or our service providers to:
Note: If we deny your deletion request, we will explain the reason for the denial and provide you with a method to appeal the decision.
You have the right to request that we correct inaccurate personal information that we maintain about you.
When you submit a request to correct information, we will:
We do not exchange personal information for monetary consideration. We also do not "share" personal information for cross-context behavioral advertising.
Because we do not sell or share your personal information, we do not maintain an opt-out mechanism. However, you may still submit a request to opt-out of future sales, and we will honor that request and retain it for at least 15 months as required by law.
We honor global privacy control signals. If you broadcast a Do Not Sell or Share preference via:
These signals will be honored as valid opt-out requests.
You have the right to limit the use of your sensitive personal information to that which is necessary to perform the services or provide the goods you requested.
We ONLY use sensitive personal information for the purposes of providing the services you requested:
We do NOT use sensitive personal information for any secondary purpose. Therefore, there is no additional use to limit.
We will not discriminate against you for exercising any of your CCPA/CPRA rights. This means we will not:
We may, however, offer financial incentives permitted by the CCPA that are reasonably related to the value of your data. We do not currently offer any such incentive programs.
In the preceding 12 months, we have collected the following categories of personal information from California consumers:
| Category | Collected? | Sources | Business Purpose | Retention |
|---|---|---|---|---|
| A. Identifiers Name, alias, address, email, IP, account name |
YES | Directly from you; automatically | Service delivery, account management, analytics, security | Account + 2 yrs |
| B. Customer Records (Cal. Civ. Code § 1798.80(e)) Phone, payment, signature, physical characteristics |
YES | Directly from you | Order fulfillment, customer service | 7 years |
| C. Protected Classification Characteristics Age, race, gender, etc. |
NO | N/A | N/A | N/A |
| D. Commercial Information Purchase history, product interests |
YES | Directly from you; derived from purchases | Recommendations, analytics, improvement | 5 years |
| E. Biometric Information Physiological, biological characteristics |
NO | N/A | N/A | N/A |
| F. Internet/Network Activity Browsing history, interactions with Site |
YES | Automatically via cookies, tracking technologies | Analytics, optimization, security | 26 months |
| G. Geolocation Data IP-based location |
YES | Automatically | Analytics, fraud prevention, regional compliance | 30 days |
| H. Sensory Data Audio, electronic, visual, thermal, olfactory |
NO | N/A | N/A | N/A |
| I. Professional/Employment Information Occupation, employer |
NO | N/A | N/A | N/A |
| J. Education Information Non-public education records |
NO | N/A | N/A | N/A |
| K. Inferences Pet health profile, supplement preferences |
YES | Derived from assessment and purchase data | Personalized recommendations | 3 years |
| L. Sensitive Personal Information Login credentials, payment card |
YES | Directly from you | Authentication, payment processing | As needed |
In the preceding 12 months, we have disclosed the following categories of personal information for a business purpose to the categories of third parties indicated:
Disclosed to: Payment processors, shipping carriers, email service providers, analytics providers
Disclosed to: Payment processors, shipping carriers, fraud prevention services
Disclosed to: Analytics providers, email marketing platforms (with consent)
Disclosed to: Analytics providers (Google Analytics, Microsoft Clarity)
Disclosed to: Analytics providers (anonymized)
Disclosed to: Not disclosed; used internally only
Disclosed to: Payment processors (PCI compliant), fraud detection services
Categories of personal information SOLD in past 12 months: NONE
Categories of personal information SHARED in past 12 months: NONE
Categories of third parties to whom information was sold: N/A
Categories of third parties to whom information was shared: N/A
Note on "Sharing": Some analytics providers may be considered "sharing" under the CPRA. We use Google Analytics and Microsoft Clarity with IP anonymization enabled. These providers act as our service providers and are contractually prohibited from using your information for their own purposes.
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, as described in this policy, or as required by applicable law.
| Data Category | Retention Period | Basis for Retention |
|---|---|---|
| Account Information | Duration of account + 2 years | Service provision, legal obligations |
| Order History | 7 years | Tax, warranty, legal requirements |
| Payment Information | Not stored; processed by payment processors | PCI DSS compliance |
| Health Assessment Data | 3 years from submission | Service improvement, customer support |
| Marketing Preferences | Until consent withdrawn + 30 days | Consent management |
| Website Analytics | 26 months (aggregated/anonymized thereafter) | Analytics, optimization |
| Customer Support Communications | 3 years | Quality assurance, dispute resolution |
Under the CPRA, "sensitive personal information" includes certain categories that require heightened protection. Our practices regarding sensitive information are as follows:
Collected: NO
Collected: YES - with passcode or security code
Purpose: Payment processing only
Disclosed: To PCI-compliant payment processors
Retention: Not stored on our servers
Collected: YES
Purpose: Authentication, account security
Disclosed: Not disclosed (hashed/salted)
Retention: Until account deletion
Collected: NO
Note: We collect IP-based location only (city/region level), not precise GPS coordinates.
Collected: NO - not directed at children
Note: We do not read the contents of your private communications.
Collected: NO
Our services are intended for pet owners who are at least 18 years old. If you are under 18, you may only use our services with the involvement of a parent or legal guardian.
If we were to sell personal information of minors under 16 (which we do not), we would be required to obtain affirmative authorization (opt-in) for:
If you believe we have inadvertently collected information from a minor under 16: Please contact us immediately at privacy@sobspets.com and we will promptly delete the information.
You may submit a verifiable consumer request through any of the following designated methods:
To verify your identity, we may request:
When submitting a request by mail, please include your full name, email address associated with your account (if applicable), a detailed description of your request, and any supporting documentation that will assist us in verifying your identity. We recommend sending via certified mail with return receipt requested.
To protect your privacy and security, we must verify your identity before fulfilling your request. Our verification process depends on the type of request and the sensitivity of the information.
Request: Right to Know (categories only), Right to Delete, Right to Correct
Verification: Email address + at least 2 data points matching our records
Request: Right to Know (specific pieces)
Verification: Email address + recent order number + signed declaration under penalty of perjury
Request: Any request from existing account holder
Verification: Successful login to account + email confirmation
We confirm receipt within 10 business days
We verify your identity
Within 45 days of receipt
Up to 45 additional days with notice
We will respond in the format you requested (mail or electronic delivery). If we cannot comply with your request, we will explain the reasons and provide appeal instructions.
We provide one free request per 12-month period. If requests are manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or refuse to act on the request.
If we deny your request, you have the right to appeal our decision.
Within 30 days of receiving our denial, submit an appeal to appeals@sobspets.com or via mail to our Privacy Office. Include your original request information and the reason you believe the denial was in error.
We will engage a different reviewer who was not involved in the original decision. We will respond within 45 days of receiving your appeal.
We will provide a written explanation of our appeal decision. If your appeal is denied, you may contact the California Attorney General's Office.
California Attorney General: oag.ca.gov/privacy
As required by the CPRA, we report annually on the consumer requests we received and processed.
We are committed to continuous improvement in our privacy practices and request handling.
For all CCPA/CPRA-related inquiries, please use the following designated contact methods:
When submitting requests by mail, please include your full name, contact information, a clear description of your request, and any information that will help us verify your identity. We recommend using certified mail with return receipt requested.
SOBS Pets is committed to protecting the privacy rights of California residents. This policy was prepared with reference to the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020.