Documents

CCPA Policy

Last updated: Sep 9, 2020

This CCPA Policy is incorporated by reference into the Substack Privacy Policy, and applies only to California consumers and the Personal Information of California consumers. If you are a California resident, the processing of certain personal data about you may be subject to the California Consumer Privacy Act (“CCPA”) and other applicable California state privacy laws. If you have any questions about whether this CCPA Policy applies to you, please contact us at privacy@substackinc.com. Any capitalized terms not defined in this CCPA Policy have the same meaning given to them in our Privacy Policy and/or the CCPA.

No Sale of Personal Information

We do not sell personal information.

Individual Rights

The CCPA provides California consumers with several individual rights with respect to Personal Information. Note that these rights apply to individual consumers, not to companies. This section describes those rights in detail and provides information on how to exercise those rights.

Exercising Your Rights

To exercise any of the rights described in this section, please contact us at privacy@substackinc.com with (i) a complete description of your request, including the specific right(s) you wish to exercise and (ii) sufficient information about you so we can confirm that your request is a verifiable customer request, including at a minimum your name and email address. Once we have received your verifiable consumer request, we will respond consistent with applicable law. 

You may also make a request by mail by sending the information specified above to:

Substack CCPA Requests

548 Market Street

PMB 72296

San Francisco, CA, 94104

Please note that you may also designate an authorized agent to make a request on your behalf. In order for us to process a request from your authorized agent, we must (i) confirm that the agent is a natural person or business entity registered with the Secretary of State that you have authorized to act on your behalf, (ii) receive from you a copy of the written authorization that provides the authorized agent to act on your behalf, and (iii) verify your identity by asking you to provide us sufficient information in order to do so.

Your Right to Know

You have a right to know what personal information we use, disclose, or sell. We provide that information here in our CCPA policy as well as in our privacy policy.

Access and Data Portability Rights

You have a right to request information about our collection, use, and disclosure of your personal information over the prior 12 months, and ask that we provide you with the following information:

  1. Categories of and specific pieces of personal information we have collected about you.

  2. Categories of sources from which we collect personal information.

  3. Purposes for collecting, using, or selling personal information.

  4. Categories of third parties with which we share personal information.

  5. Categories of personal information disclosed about you for a business purpose.

  6. If applicable, categories of personal information sold about you and the categories of third parties to which the personal information was sold, by category or categories of personal information for each third party to which the personal information was sold.

Deletion Rights

You have the right to request that we delete Personal Information about you that we have collected, subject to certain exceptions. 

You may also access, edit, or delete certain of your Personal Information through your account settings. Please review our Privacy Policy, in the section titled “What Personal Information can I access?,” for more details.

The Right to Opt Out

You have the right to opt out of the sale of your personal information. Were we ever to sell personal information, we would provide information on our opt out process here.

Non-Discrimination Rights

You have the right not to receive discriminatory treatment for the exercise of your rights under the CCPA.

Personal Data Collected

The list below describes the category of Personal Information we collect by reference to the categories specified by the CCPA:

Category: Identifiers

We collect: Your name, IP address, email address and Twitter handle

Source(s): You; automatic collection (IP address only); Substack writers who migrate subscribers to our platform (email address only)

Category: Customer Record Information

We collect: Your name, your email address, your user bio, your subscriptions and unsubscriptions, your settings and preferences with our service, reactions you submit to posts and comments (“likes”), user comments, user photos, user profile information, public Twitter profile information, and publication and authorship information, your search history on the Website

Source(s): You; Twitter (with your permission)

Category: Commercial information

We collect: Records of products/services purchased by you on the Website

Source(s): You

Category: Internet or other network activity

We collect: Browsing history, search history, and interaction data on your use of our Website and from links in Substack emails

Source(s): You; automatic collection

Category: Geolocation data

We collect: Your IP address

Category: You; Automatic collection (see our Privacy Policy for more information on tracking technologies we use for automatic data collection)

Category: Sensory Data

We collect: User photos, Twitter profile photo

Category: You, Twitter (with your permission)

Please see our Privacy Policy for more information on tracking technologies we use for automatic data collection. We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing notice.

Use of Personal Information

In the last 12 months, we have used or disclosed certain Personal Information we collected for the following business purposes:

Business Purpose: To provide, support, and develop our website, products, and services

Categories of Personal Information: Identifiers, Customer Record Information, Sensory Data, Internet of other network activity

Business Purpose: To create, maintain, customize, and secure your account with us

Categories of Personal Information: Identifiers, Customer Record Information

Business Purpose: To process your requests, purchases, transactions, and payments and prevent transactional fraud

Categories of Personal Information: Commercial Information 

Business Purpose: To directly respond to your requests or inquiries, including to investigate and address your concerns and monitor and improve our responses, or to otherwise meet the reason for which you provided the information.

Categories of Personal Information: Identifiers, Customer Record Information, Commercial Information, Sensory Data, Internet or other network activity

Business Purpose: To help maintain the safety, security, and integrity of our website, products and services, databases and other technology assets, and business

Categories of Personal Information: Identifiers

We may further disclose each category of Personal Information to our affiliates, to our professional advisors, in connection with our compliance and protection activities and in connection with business transfers as described in our Privacy Policy.

Changes to this CCPA Policy

We reserve the right to amend this CCPA Policy at our discretion and at any time. When we make changes to this CCPA Policy, we will post the updated notice on the Website and update the CCPA Policy effective date at the top of the page. By accessing or using the Website and/or the Services, you acknowledge that you have read this CCPA Policy and, to the extent it applies to you, that you agree to the practices described in this CCPA Policy.

Contact Us

You may contact us by emailing us at privacy@substackinc.com.