Privacy Policy

California Consumer Rights (CCPA/CPRA Notice)

This section supplements our Privacy Policy and applies to California residents. It describes the rights you have under the California Consumer Privacy Act, as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and how to exercise them.

Categories of personal information we collect, share, or sell

In the past 12 months, we have collected the following categories of personal information (as defined in Cal. Civ. Code § 1798.140(v)):

• Identifiers, name, email, business email, phone number (when you provide them via forms).
• Commercial information, services you inquired about, engagement history.
• Internet or network activity, pages viewed, referrer, browser and OS (via first-party Umami analytics).
• Geolocation (coarse), approximate city/region from IP address.
• Inferences, service interest categories drawn from the above.

We do not sell your personal information for money. We do "share" personal information for cross-context behavioral advertising in the CCPA sense when third-party analytics or ad-tech tags load on our site. Where a third-party tag is present, its provider may combine our visit data with data from other sites you visit. Where possible we contract for that provider to act as a "service provider" under Cal. Civ. Code § 1798.140(ag), which limits how they may use your data.

Categories of third parties with whom we share personal information

Categories of personal information sold or shared, and purposes

For each category we share (as defined by CCPA §1798.140(ah)) we disclose the category of third-party recipient and the business or commercial purpose:

We do NOT sell personal information for money. Any "sharing" (as CCPA defines it for cross-context behavioral advertising) is limited to the situations listed above, and where possible we contract for the recipient to act as a "service provider" under Cal. Civ. Code § 1798.140(ag).

We disclose personal information to:

• Email service providers, Resend, for transactional and marketing email delivery.
• Analytics providers, our self-hosted Umami instance (analytics.willhitestrategy.org), Cloudflare Web Analytics.
• Hosting and infrastructure, Cloudflare (CDN, DNS, DDoS protection), our own VPS providers.
• Payment processors, Stripe, for paid engagements (only when you pay us).
• Professional service providers, accountants, attorneys, and other advisors bound by confidentiality.
• Law enforcement or regulators, where legally compelled.

Your rights

As a California resident you have the right to:

• Know what personal information we collect, use, disclose, or sell about you.
• Delete the personal information we hold about you (subject to lawful exceptions).
• Correct inaccurate personal information we hold about you.
• Opt out of the sale or sharing of your personal information, including via the Do Not Sell or Share My Personal Information link.
• Limit the use of sensitive personal information, we do not currently use sensitive personal information for purposes that would trigger this right, but if that changes we will honor requests.
• Non-discrimination, we will not deny you services, charge different prices, or provide a different level of quality because you exercised a CCPA/CPRA right.

How to exercise your rights

You have three options:

• Web form, willhitestrategy.com/do-not-sell/ for opt-out and limit-use requests.
• Email, [email protected] with the subject line "CCPA request".
• Toll-free number, (707) 664-1540. Leave a voicemail with your name and callback number.

We will confirm receipt within 10 business days and respond substantively within 45 days. If we need to extend that window (up to 90 days total), we will let you know why in writing.

Global Privacy Control

Your browser can send a Global Privacy Control (Sec-GPC:1) signal that we treat as a valid consumer request to opt out of sale or sharing of personal information from the browser that sent the signal. You do not need to submit a separate opt-out form if you have GPC enabled. Learn more at globalprivacycontrol.org.

How we verify your identity

To protect your data we must verify that a request comes from you. For a request tied to an account we already have (email, phone, or lead form submission), we will match at least two identifiers you provide against records we hold. For a request from someone we have never contacted, we may ask for additional information sufficient to confirm identity. If we cannot verify identity, we will treat the request as an opt-out only (since opt-out does not require verification under 11 CCR § 7026).

Authorized agents

An authorized agent may submit a request on your behalf. We may require: (a) written proof that you have authorized the agent (a signed letter is sufficient); (b) that you verify your own identity directly with us; and (c) that you confirm that the agent has authority to act. A power of attorney under Cal. Prob. Code § 4000 et seq. also suffices.

Sensitive personal information

We do not knowingly collect sensitive personal information (Social Security number, precise geolocation, biometric data, contents of communications, etc.) beyond what a consumer voluntarily submits to us through a contact form or engagement. Where sensitive PI is provided, we use it only for the purpose the consumer submitted it and do not use it for inferring characteristics.

Changes to this notice

We will update the date below if we make material changes to this section. Last updated: 2026-07-08.

Contact

Questions about this notice or a CCPA/CPRA request: [email protected] or write to us at Willhite Strategy Group, 1275 4th Street, Santa Rosa, CA 95404.