CCPA / CPRA

Overview

The California Consumer Privacy Act, as amended by the CPRA, gives California consumers rights over the personal information a business collects about them: the right to know what is collected, to delete it, to correct it, and to opt out of its sale or sharing. It applies to businesses that meet its thresholds. ControlBird is designed to support your obligations as a business, and the way you run it shapes how much personal information we hold at all. Self-hosted, we hold none of your operational data; on the managed cloud, we hold only what the service needs.

Key requirements

Notice at collection

Tell consumers what categories of personal information you collect and the purposes for it.

Right to know and access

Let consumers see the personal information collected about them.

Right to delete and correct

Honour consumer requests to delete or correct their personal information.

Opt out of sale or sharing, and non-discrimination

Let consumers opt out of the sale or sharing of their data, and do not penalise them for exercising their rights.

How ControlBird aligns

We do not sell or share personal information

ControlBird does not sell personal information or share it for cross-context behavioural advertising, so the opt-out right has nothing to act on. This is stated in our privacy policy.

Minimal personal information

On the managed cloud the personal information we hold is limited to account and billing details. Self-hosted, that information stays entirely on your own systems and we hold none of it, which keeps the consumer relationship and its data with you.

Honouring access, deletion, and correction

Self-hosted, you fulfil consumer requests directly from your own data. On the managed cloud you can request access to, deletion of, or correction of the account data we hold through our privacy team, as set out in the privacy policy.

Non-discrimination and security

We do not change the service or its pricing because someone exercises a privacy right, and personal information is protected by hashed credentials, role- and attribute-based access control, and TLS.

Your obligations as a business

CCPA applies to your business and how it handles consumer data. The notice at collection, the consumer request process, and any service-provider agreements remain yours to operate. ControlBird provides a service that holds little personal information and gives you the option to hold it all yourself. ControlBird is not a certification.