U.S. State Privacy Rights & CCPA Notice

1. Who this applies to

This notice supplements our Privacy Policy and applies to residents of U.S. states with a consumer privacy law, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, and to residents of other states as similar laws take effect. Where a term like "personal information," "sell," or "share" is used, it has the meaning given by the law that applies to you.

It applies to information we control. Information you submit through a contact form on a small-business website we host is controlled by that business; direct those requests to the business, and we will help them respond.

2. Personal information we collect

In the last 12 months we have collected the following categories (see the Privacy Policy for specifics and sources):

3. Why we collect it

To provide, bill for, support, secure, and improve the website build-and-hosting service; to communicate with you about your project; to keep records; and to comply with law. We do not use it for profiling, targeted advertising, or automated decisions that produce legal or similarly significant effects.

4. What we disclose, and to whom

We disclose personal information only to service providers / processors that act on our behalf under contract — the providers listed in our Subprocessors page (hosting, payments, email, AI assistance, backups, embedded maps). We may also disclose information to comply with law or legal process, to enforce our terms, or in a merger or asset sale. We do not disclose personal information to third parties for their own purposes.

5. We do not sell or share

We have not sold personal information and have not shared it for cross-context behavioral advertising in the preceding 12 months, and we do not do so. Because we do not sell or share, there is nothing to opt out of for that purpose — but you may still submit an opt-out request and we will record it. We do not sell or share the personal information of consumers we know to be under 16.

6. Sensitive personal information

We do not intentionally collect sensitive personal information (such as Social Security or government ID numbers, precise geolocation, account log-in plus password, race or ethnicity, health, sex life or sexual orientation, or contents of your mail or messages). We only use the limited information we do collect for the purposes in Section 3, which do not require a "limit the use of my sensitive personal information" right — but you may still ask us to minimize what we hold.

7. Your rights

• Right to know / access — the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients.
• Right to delete — ask us to delete personal information we collected from you, subject to legal exceptions (for example, records we must keep for tax).
• Right to correct — ask us to fix inaccurate personal information.
• Right to opt out of sale, sharing, or targeted advertising — we don't do these, but we will honor the request.
• Right to limit use of sensitive personal information — see Section 6.
• Right to appeal — if we deny a request (Section 11).
• Right to non-retaliation — Section 12.

8. How to submit a request

Two verified methods:

• The Data Request form at 99websites.co/data-request, or
• Email privacy@99websites.co with your request type and the email associated with your information.

We will confirm receipt within 10 business days and respond to a verified request within 45 days. We may extend once by another 45 days (CCPA) or as your state's law allows, and will tell you why. Your first request in a 12-month period is free.

9. Verification & authorized agents

To protect your information we must verify that a request comes from you. We will match the information in your request against what we hold and may ask for additional confirmation by email. An authorized agent may submit a request on your behalf with written permission signed by you; we may still contact you to confirm.

10. Global Privacy Control

We recognize the Global Privacy Control (GPC) browser signal. When we detect it, we treat it as a request to opt out of any sale, sharing, or non-essential cookies for that browser. Because we do not sell or share, GPC mainly keeps optional cookies off; you do not need to be logged in for us to honor it.

11. Appeals

If we decline your request, we will explain why. You may appeal by replying to our decision email or writing to privacy@99websites.co with "Appeal" in the subject. We will respond to an appeal within 45–60 days depending on your state. If we deny the appeal, you may contact your state Attorney General — for California, the California Privacy Protection Agency or the Attorney General.

12. No retaliation

We will not deny you service, charge you a different price, or provide a different quality of service because you exercised a privacy right.

13. Contact