California Consumer Privacy Act (CCPA) Notice

Last Updated: December 28, 2025

This California Consumer Privacy Act (“CCPA”) Notice applies solely to California residents (“consumers”) and supplements the information contained in the Boston Made, Inc. (“Boston Made,” “we,” “us,” or “our”) Privacy Policy. We adopt this Notice to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (CPRA), and any terms defined in the CCPA/CPRA have the same meaning when used in this Notice.

1. Personal Information We Collect

We collect information that identifies, relates to, describes, references, or is reasonably capable of being associated with a particular consumer or household (“Personal Information”). Personal Information does not include:

• Publicly available information from government records
• Deidentified or aggregated information
• Information excluded from CCPA scope (e.g., HIPAA-protected data)

In the past 12 months, we may have collected the following categories of Personal Information:

• Identifiers — name, email address, postal address, account information, IP address
• Customer records information — billing details, service records
• Commercial information — purchase history, transaction data
• Internet or other electronic activity — browsing data, interactions with our website
• Geolocation data — general location derived from IP
• Audio/visual data — if you contact support by phone or video
• Professional or business-related information — when provided for account creation or service engagement
• Inferences — profile data created to improve service experience

We do not knowingly collect sensitive personal information unless explicitly provided and required for a business purpose, and only in compliance with law.

2. Sources of Personal Information

We collect Personal Information from:

• You, when you provide it to us
• Website and app activity
• Business partners and service providers
• Analytics and advertising services

3. How We Use Personal Information

We may use or disclose Personal Information for the following business purposes:

• Providing products, digital services, and customer support
• Processing transactions and billing
• Operating, securing, and improving our website and systems
• Communicating about services, updates, and account activity
• Detecting and protecting against fraud or security incidents
• Internal analytics and reporting
• Complying with legal and regulatory obligations

We do not use your Personal Information for automated decision-making that produces legal or similarly significant effects.

4. Sharing & Disclosure of Personal Information

We may disclose Personal Information to:

• Service providers and contractors
• Payment processors
• Cloud hosting and data storage vendors
• Professional advisors
• Legal authorities when required

We require third parties to use Personal Information only for permitted business purposes and to protect it appropriately.

Sale or Sharing of Personal Information

Boston Made does not sell Personal Information for money.

However, certain online analytics or advertising activities may be considered “sharing” under California law. Where applicable, you may exercise your right to opt-out of such sharing (see Section 7 below).

We do not knowingly sell or share Personal Information of minors under 16.

5. Retention of Personal Information

We retain Personal Information only as long as reasonably necessary to:

• Provide products and services
• Comply with legal obligations
• Resolve disputes
• Enforce our agreements

Retention periods vary based on the nature of the data and applicable law.

6. Your Rights Under the CCPA

As a California resident, you have the following rights — subject to certain exceptions and verification requirements:

Right to Know / Access

You may request that we disclose:

• The categories and specific pieces of Personal Information we have collected about you
• The categories of sources of that information
• The business or commercial purpose for collecting or sharing it
• The categories of third parties we disclose it to

Right to Delete

You may request deletion of Personal Information we collected from you.

Right to Correct

You may request correction of inaccurate Personal Information.

Right to Opt-Out of Sharing

You may opt-out of Personal Information being shared for cross-context behavioral advertising.

Right to Limit Use of Sensitive Personal Information

Where applicable, you may request limitations on the use of sensitive data.

Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

7. How to Submit a Privacy Request

You may exercise your CCPA rights by contacting us through:

📧 Email: hello@bostonmade.com
📍 Mailing Address: Boston Made, Inc., 8 Grafton Street, Suite 210, Worcester, MA 01608

We will verify your identity and respond within the timeframe required by California law.

You may also authorize an agent to submit a request on your behalf, subject to verification.

8. Children’s Data

Our services are not intended for children under 16, and we do not knowingly collect Personal Information from them.

9. Changes to This Notice

We may update this Notice from time to time. The “Last Updated” date reflects the most recent revision. Continued use of our website or services after changes signifies acceptance of the updated Notice.

10. Contact Us

If you have questions about this CCPA Notice or our privacy practices, please contact us:

Boston Made, Inc.
hello@bostonmade.com

A Plain-Language Guide to Your California Privacy Rights

Privacy notices can be dense. This section is offered for convenience, to explain in everyday terms how California privacy rights generally work. It does not change or replace the Notice above, and it is general information rather than legal advice.

What the law covers

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents more control over personal information that businesses collect about them. It focuses on transparency (knowing what is collected and why), choice (opting out of certain sharing) and control (accessing, correcting and deleting information).

How a request typically works

1. You submit a request using one of the contact methods listed in the Notice.
2. The business confirms receipt. California regulations generally call for businesses to acknowledge requests to know, delete or correct within a set number of business days.
3. Your identity is verified. To protect you, businesses must take reasonable steps to confirm that the person making a request is the consumer the information is about.
4. The business responds. The law generally allows businesses 45 calendar days to respond to verified requests, with a possible extension in some circumstances if the consumer is notified.

Tips for Submitting a Clear Request

• Say which right you are exercising, such as access, deletion, correction or opting out of sharing.
• Use the email address or account details you have used with the business, so your records can be located.
• Be specific when asking for a correction. Explain what is inaccurate and what the correct information should be.
• Keep a copy of your request and any reply for your records.
• Watch for follow-up messages, which may ask for information needed to verify your identity.

Understanding Key Terms

• Personal information: information that identifies, relates to or could reasonably be linked to you or your household.
• Sensitive personal information: a category under California law that includes items such as government identification numbers, precise geolocation and certain account log-in details.
• Selling: exchanging personal information for money or other valuable consideration, as defined in the law.
• Sharing: under California law, disclosing personal information for cross-context behavioral advertising, which means ads targeted based on activity across different websites or services.
• Service provider: a company that processes information on a business’s behalf under a contract that limits how the information can be used.
• Authorized agent: a person or business you designate to submit a request for you.

Other Ways to Manage Your Privacy Online

Beyond submitting requests, a few everyday steps help you control how information about you is used across the web:

• Review cookie and privacy settings in your browser and on the sites you visit.
• Consider browser tools or settings that send an opt-out preference signal, such as Global Privacy Control, which California regulations recognize as a way for consumers to communicate opt-out choices.
• Adjust ad personalization settings in the major platforms and devices you use.
• Use strong, unique passwords and multi-factor authentication to protect your accounts.

Common Questions

Do I need to create an account to make a request?

California law generally does not require consumers to create an account solely to submit a privacy request.

Can someone else make a request for me?

Yes, an authorized agent may submit a request on your behalf, subject to verification as described in the Notice.

Where can I learn more?

The California Privacy Protection Agency and the California Attorney General publish consumer information about these rights on their official websites.