California Privacy Notice

This California Privacy Notice supplements the global Privacy Policy with the additional disclosures California residents are entitled to under the CCPA (Cal. Civ. Code §1798.100 et seq.), as amended by the CPRA. It covers what personal information we collect on the loomaru.com website, where it comes from, what we use it for, who we share it with, and how to exercise your California-specific rights.

If you are a customer of one of our merchant clients (e.g., you bought something from a Loomaru-served store), the merchant is the controller of your purchase data — please exercise your rights with the merchant directly. Loomaru processes that data transiently as a service provider on the merchant's behalf and retains nothing.

Loomaruis operated by Vadim Sharapov, sole proprietor, based at Zikova 1023, Prague, Czech Republic. For California residents who visit this website, Loomaru is the "business" under CCPA §1798.140(d). For shoppers who purchased from a merchant using our revenue recovery service, Loomaru acts as a "service provider" under §1798.140(ag) and the merchant is the business — see Sections 6 and 12 of the Privacy Policy for the service-provider details.

In the past 12 months, we have collected the following categories of personal information about California residents who visit loomaru.com (CCPA §1798.130(a)(5)(B)):

We collect the categories above from the following sources:

• Directly from you — when you submit a contact form, book a call via the embedded scheduler, or send us an email.
• Automatically as you use the site — IP address and user-agent are sent by your browser on every request; consent-gated analytics tags collect page-view + interaction events only after you accept tracking.
• From third parties — for B2B prospect outreach, we may obtain professional contact information (name, business email, company, job title) from public-record and B2B-data providers (Apollo, Store Leads). This applies to potential merchant clients, not to consumer shoppers.

We use the categories of personal information above for the following business purposes (CCPA §1798.140(e)):

• Operating, maintaining, and securing loomaru.com.
• Responding to your inquiries, scheduling calls, and providing the requested service.
• Generating non-personalized aggregate analytics about website usage (consent-gated).
• Measuring the effectiveness of our marketing (consent-gated).
• Conducting B2B outbound outreach to prospective merchant clients, in line with applicable email marketing law.
• Detecting security incidents, debugging, complying with legal obligations, and enforcing our Terms.

We disclose the categories of personal information above for business purposes to the following categories of recipients (CCPA §1798.130(a)(5)(C)):

• Service providers — managed application hosting, managed data & identity platform, embedded scheduling, transactional email, analytics + advertising tag providers (Google LLC, Meta Platforms, Inc.) once you accept tracking. Each is bound by a written data-processing agreement that restricts the use of personal information to the purpose for which we share it.
• Legal recipients — courts, regulators, and law-enforcement when required by law or to defend legal claims.

For the named provider list and DPA / SCC / DPF references, see Privacy Policy §9 — Sub-Processors.

Retention periods per category match the global privacy policy. The summary:

• Identifiers + commercial information — until the purpose is fulfilled, plus 12 months.
• Internet activity (analytics) — per the third-party tag provider's retention policy, configured to the shortest available window.
• Consent audit log — 36 months from the consent event, automatically purged. Stored fields: a randomized pseudonymous identifier, truncated IP prefix, user-agent family, referrer origin, UTC timestamp.

For the full retention table, see Privacy Policy §11 — Data Retention.

California residents have the following rights under the CCPA, as amended by the CPRA:

• Right to Know (§1798.110) — request the categories and specific pieces of personal information we have collected about you, the sources we collected it from, the purposes for which we collected it, and the categories of recipients we have disclosed it to.
• Right to Delete (§1798.105) — request deletion of personal information we have collected from you, subject to the statutory exceptions (e.g., we may retain information to detect fraud or comply with a legal obligation).
• Right to Correct (§1798.106) — request that we correct inaccurate personal information we maintain about you.
• Right to Opt-out of Sale or Sharing (§1798.120) — direct us to stop "selling" or "sharing" your personal information as those terms are defined by the CCPA. We do not sell personal information for monetary consideration. Some adtech signals enabled by our consent-gated tags may qualify as "sharing" for cross-context behavioral advertising — exercise your opt-out via the button below or through the universal Global Privacy Control browser signal, which we honour.
• Right to Limit Use of Sensitive Personal Information (§1798.121) — see Section 9 below; we do not collect sensitive personal information as defined by §1798.140(ae), so this right is moot.
• Right to Non-discrimination (§1798.125) — we will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised any of your CCPA rights.
• Right to Opt-out of Profiling (CCPA §1798.185(a)(15)) — see Section 9 below; we do not engage in profiling that produces legal or similarly significant effects, so this right is moot.
• Right to designate an Authorized Agent (§1798.135) — you may use an authorized agent to make a request on your behalf. See Section 11.

Three negative-state disclosures required by, or aligned with, the CCPA / CPRA:

• No financial incentives. Loomaru does not offer financial incentives (discounts, coupons, loyalty rewards, or any other benefit) in exchange for personal information, the sale of personal information, or the retention of personal information (CCPA §1798.125(b)). Pricing is publicly disclosed and the same regardless of whether you exercise any CCPA right.
• No sensitive personal information collected. Loomaru does not collect sensitive personal information as defined by CCPA §1798.140(ae) — no government identifiers, no financial account credentials, no precise geolocation, no biometric, race, religion, health, sexual-orientation, or genetic data, and no contents of non-public communications. The "Right to Limit Use of Sensitive Personal Information" under §1798.121 is therefore moot for our processing.
• No automated profiling that produces legal or similarly significant effects. Loomaru does not use personal information to make automated decisions that produce legal effects (e.g., loan decisions) or similarly significant effects (e.g., employment, housing, insurance, education-access decisions) about you. The "Right to Opt-out of Profiling" described in CCPA §1798.185(a)(15) is therefore moot for our processing.

Two options. Both are equally easy to use, in line with CCPA §7026(c) (opt-out friction must not exceed opt-in friction):

Single-click opt-out — for opt-out of sale or sharing, use the button below. The click records your opt-out in the audit log, flips the Google Consent Mode v2 + Meta Pixel signals to denied for this browser, and surfaces an on-screen receipt. The button is also visible in the footer of every Loomaru marketing page when our edge geo-detection sees a California request.

Email request — for Right to Know, Right to Delete, Right to Correct, or any other CCPA right, email vadim@loomaru.com with a description of your request.

Verification. To protect your information, we will verify your identity before fulfilling a Right to Know, Delete, or Correct request. We typically verify by asking you to confirm information already in our records (e.g., the email address used to contact us). For sensitive requests we may ask for additional verification proportionate to the sensitivity. We will not require you to create a Loomaru account to make a request.

Response time. We respond to verifiable requests within 45 days as required by CCPA §1798.130(a)(2), with a single 45-day extension where reasonably necessary (we will tell you in the first response if we need the extension and why).

You may use an authorized agent to submit a request on your behalf (CCPA §1798.135(b)). The agent must provide written permission from you and we will verify your identity directly with you. If you have provided the agent with a power of attorney pursuant to California Probate Code §§4000–4465, we will not require this additional verification step.

We may update this notice from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of the page reflects the most recent revision. We will not reduce your rights under this notice without giving prior notice via the loomaru.com homepage and (for merchant clients) email.