California Privacy Notice (CCPA/CPRA)

This California Privacy Notice supplements our Privacy Policy and applies solely to residents of California (“consumers”) with respect to AlphaSmith, Inc. [legal entity TBD]. It describes the categories of personal information we handle and the rights afforded under the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”). Effective date: April 17, 2026.

Categories of personal information collected

In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers (name, email, IP address, user IDs, account identifiers).
• Customer records (billing address, last four digits of payment cards as reflected by Stripe).
• Commercial information (subscription plans, transaction history).
• Internet and network activity (usage logs, page views, device and browser metadata).
• Geolocation data limited to approximate IP-based location.
• Inferences drawn from the above to compute analytics for your account (for example, which features you use).
• Sensitive personal information limited to account credentials (stored as hashes) and two-factor secrets.

Sources

We collect personal information directly from you, automatically through your use of the Services, and from service providers (such as Stripe for billing).

Purposes of processing

We use the categories listed above to provide and secure the Services, process transactions, communicate with users, compute analytics and AI predictions, comply with law, and improve our products. See the full purposes in our Privacy Policy.

Disclosure of personal information

We disclose the categories listed above to service providers and contractors who process the information on our behalf under written contracts that restrict their use, including Stripe, SendGrid, Anthropic, and our hosting providers. We also disclose information when required by law or to protect our rights and users.

No sale or share of personal information

We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising. We do not knowingly sell or share personal information of consumers under 16 years of age.

Your rights

• Right to know. You may request categories and specific pieces of personal information we have collected about you.
• Right to delete. You may request deletion of personal information we collected from you, subject to statutory exceptions.
• Right to correct. You may request correction of inaccurate personal information.
• Right to opt out. You may direct us not to sell or share your personal information. We do not sell or share, so there is nothing additional to do, but we will honor any Global Privacy Control signal we receive.
• Right to limit use of sensitive personal information. You may direct us to limit the use of sensitive personal information to purposes necessary to provide the Services.
• Right to non-discrimination. We will not discriminate against you for exercising your rights.

Submitting requests

Submit requests by emailing privacy@alphasmith.ai. We will verify your identity using information reasonably available, including access to your registered email address. You may designate an authorized agent to submit a request by providing written permission that we can verify.

Retention

We retain personal information only for as long as necessary for the purposes described in our Privacy Policy or as required by law.

Contact

Questions about your California privacy rights? Contact privacy@alphasmith.ai.