California Privacy Notice (CCPA / CPRA)

Last Updated: May 22, 2025

This page supplements the information contained in the Picaboo Privacy Policy and applies solely to visitors, users, and others who reside in the State of California (“consumers” or “you”). We adopt this notice to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA/CPRA”), and any terms defined in the CCPA/CPRA have the same meaning when used in this notice.

1. Notice at Collection

We collect the categories of personal information listed in the table below. For each category, we also describe (i) the business or commercial purpose for which the information was collected or disclosed and (ii) whether the information was shared with any third parties for a business purpose in the past 12 months.

CCPA Category	Examples (may include)	Purpose(s) of Collection & Use	Disclosed for a Business Purpose?	Retention Period*
Identifiers	name, postal address, email address, IP address	account creation, order fulfillment, customer support, fraud prevention	Yes – payment processors, ship?to carriers	While account remains active + 7 yrs for legal compliance
Commercial Information	purchase history, order value	fulfill orders, analytics, loyalty offers (opt-in)	Yes	While account remains active
Internet / Electronic Activity	cookies, device IDs, browsing history on our site	site functionality, security, personalised offers (with consent)	Yes – analytics providers	26 mos
Geolocation Data	coarse location derived from IP address	regional pricing, tax calculation, fraud detection	Yes	2 yrs
Audio/Visual	photos uploaded to make products	core photobook service	No (stored only on our secure systems)	Until project deletion + 30 days backup
Inferences	preferences, interests	product recommendations (with consent)	No	Until consent withdrawn

* Picaboo may retain information longer where required to comply with legal obligations or defend legal claims.

We do not collect or use Sensitive Personal Information for inferring characteristics about you, nor do we knowingly sell or share such information.

2. Your CCPA/CPRA Rights

Subject to certain exceptions, California residents have the following rights:

Right to Know – Request that we disclose the personal information we collect, use, disclose, or share.
Right to Delete – Request deletion of personal information we have collected about you.
Right to Correct – Request correction of inaccurate personal information.
Right to Opt-Out – Direct us not to sell or share personal information for cross-context behavioural advertising. Picaboo does not sell personal information for money. If our use of cookies or analytics tools constitutes a “sale” or “share,” you can opt-out at any time via the “Do Not Sell or Share My Personal Information” link in the footer.
Right to Limit Use of Sensitive Personal Information – Not applicable (we do not process it for inference).
Right to No Retaliation – We will not discriminate against you for exercising your rights.

3. Submitting Requests

You (or your authorized agent) may submit a verifiable consumer request by one of the following methods:

Email: privacy@picaboo.com.

We will verify requests by matching the information you provide with records we hold and may request additional information to confirm your identity. If we cannot verify your identity, we may be unable to respond fully to your request.

4. Changes to This Notice

We may update this California Privacy Notice from time to time. When we do, we will post the revised notice on this page with an updated “Last Updated” date.