Do Not Sell or Share My Personal Information

The position, in plain words

Crate does not sell your personal information. Crate does not share it for cross-context behavioral advertising. Both of those phrases mean what the California Consumer Privacy Act says they mean, which is wider than most people expect: a sale does not need money to change hands, and sharing covers handing data to an advertising business so it can follow you between sites. Neither happens here.

Crate has not sold or shared personal information in the preceding twelve months, and does not sell or share the personal information of anybody under 16 in any circumstances.

Crate does not run an advertising network, does not set advertising cookies, does not embed advertising pixels and does not pass merchant or buyer data to an advertising platform. If that ever changes, this page changes first and the change is announced before it takes effect, not after.

Record an opt-out anyway

The right does not depend on us having something to opt out of, so the mechanism is here and it works. California requires a business to offer at least two ways to make the request, so there are two, and neither of them asks you to create an account.

Email [email protected] with the words opt out in the subject line, or use the contact form and choose privacy as the subject. Tell us the email address and, if you have one, the store the request relates to. We will confirm receipt and act within 30 days, which is shorter than the 45 days the law allows.

Crate will not ask you to verify your identity for an opt-out, because the law does not require verification for this request and asking for more data in order to process a privacy request is the wrong direction. We do have to be able to reach you to confirm it is done.

An authorized agent may submit the request for you with written permission signed by you. We may ask you to confirm directly that you gave that permission, which is what protects you from somebody else claiming to act for you.

Global Privacy Control

Global Privacy Control is a setting your browser or a browser extension sends with every request, saying you opt out of the sale and sharing of your personal information. Several US state laws require it to be treated as a valid opt-out. Crate honors it everywhere, including in countries where no law obliges us to, because honoring an opt-out signal globally is safer and simpler than deciding case by case whose signal counts.

When crate sees the signal it treats that browser as opted out. If you are signed in, crate applies it to your account as well, so it survives you switching to a different browser.

Turning it on is a setting in some browsers and a small extension in others. Crate does not distribute one, does not detect which browser you use in order to recommend one, and gains nothing either way.

Limit the use of my sensitive personal information

California gives you a right to limit how a business uses sensitive personal information. For most of the categories the law names, crate has nothing to limit. Crate does not collect government identifiers, precise geolocation, racial or ethnic origin, religious or philosophical belief, union membership, health, sex life or sexual orientation, and does not read the contents of your mail or your messages.

The one category crate does hold is your account log-in and password, which California counts as sensitive personal information. Crate uses it to sign you in and to keep the account secure. Those are uses the statute lists as permitted without an opt-out, and crate does not use them to infer any characteristic about you, does not profile on them and does not disclose them.

The control is published anyway. Send the same request to [email protected], or through the contact form, and crate will confirm in writing what sensitive personal information it holds about you and what it is used for.

Which states this covers

California is the state that gives this right its name, and the right to opt out of targeted advertising and the sale of personal data now exists in Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Nebraska, New Hampshire and New Jersey as well, several of which also require a universal opt-out signal to be honored.

Crate does not check which state you live in before honoring a request. The list above is here so you can see your own law named, not so we can decide whether to answer you. Everybody gets the same answer in the same 30 days.

Nothing changes for you because you asked

Exercising any of these rights costs you nothing, does not change the price of your plan, does not slow your store down and does not reduce the service you get. Crate offers no financial incentive in exchange for personal information, so there is no incentive program to explain and no compensation to calculate.

If your data is in a store built on crate

If you bought something from a store running on crate, that merchant decides what happens to your data and crate acts on their instructions as their service provider. Send the request to the merchant first. Crate will pass it on and help them carry it out, and under the service provider terms in our data processing addendum crate cannot sell that data, share it or use it for its own purposes regardless.