Privacy Notice for California Residents

*Last Modified January 13, 2020

This Privacy Notice for California Residents supplements and is expressly made part of the Privacy Policy through incorporation by reference and applies solely to all visitors, users, and others who reside in the State of California (“consumers” or “you”).  We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (CCPA).  Terms defined in the CCPA have the same meaning when used in this Notice.

California Residents’ Rights

In addition to the rights outlined in Pronto’s Privacy Policy, the California Consumer Privacy Act (CCPA) gives California residents specific rights related to their personal information as described below.  Hit Labs, Inc., maker of Pronto, does not sell consumers’ personal information.

Right to Access Personal Information

The CCPA gives California residents the right to access the last 12 months of their personal information.  If we receive and confirm a verifiable consumer request, we will disclose to the requesting party:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you.

Right to Deletion

Subject to certain limitations, California residents may also have the right to have us delete their personal information.  This is sometimes called the “right to be forgotten.”  If Pronto receives a verifiable consumer request to delete a consumer’s personal information, we must comply unless we must retain the personal information for one of the following reasons:

• Provide goods or services to the consumer.
• Detect or resolve security or functionality-related issues.
• Comply with the law or protect rights provided by law (g., free speech rights).
• Conduct research in the public interest.
• Safeguard the right to free speech.
• Carry out actions for internal purposes that the consumer might reasonably expect.

To exercise your rights under the CCPA, make a request by email at support@pronto.io or by mail:

Hit Labs, Inc.
2000 W Ashton Blvd., Ste. 425
Lehi, Utah 84043

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period.  Any disclosures we provide will only cover the 12-months prior to the request. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt.  If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights.  Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

Information We Collect

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information“). In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:

 

Category	Examples	Collected
A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	Yes
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	Yes
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	No
D. Commercial information.	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Yes
E. Biometric information.	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	No
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	Yes
G. Geolocation data.	Physical location or movements.	No
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	No
I. Professional or employment-related information.	Current or past job history or performance evaluations.	No
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	Yes
K. Inferences drawn from other personal information.	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	No

As explained in the Privacy Policy, we obtain the categories of personal information listed above from the following categories of sources:

• Directly from you. We may collect and store personal information when you register for our Service or provide it to us in some other manner.
• Data collected through use of the Service. We collect information about how you use the Service (as defined in the Privacy Policy), your actions on the Service, and content you post to the Service, including the groups you belong to, your interaction with others on the Service, and any content you provide through in-app messages or other functionality (“User Content”).

Personal information does not include:

• Publicly available information from government records.
• “Deidentified” or aggregated consumer information.
• Information excluded from the CCPA’s scope, such as
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

Use of Personal Information

We may use, or disclose the personal information we collect for one or more of the following business purposes:

• to operate, maintain, and provide to you the features and functionality of the Service;
• to send you Service-related emails or messages (e.g., account verification, messages and schedules, change or updates to features of the Service, technical and security notices);
• to analyze trends to better understand how users are using the Services and improve them; and
• to prevent or address service, security, technical issues or at a Customer’s request in connection with customer support matters.

For more information about your communication preferences, see “Control Over Your Information” in the Privacy Policy.  We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information

We may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We share your personal information with the following categories of third parties:

• Hosting
• Customer support (e.g., bug tracking, crash reporting)
• Analytics