US State Privacy Statement

This document sits under the Privacy Policy and does three things: it works out which US state privacy laws apply to EdgeQuote today; it states the position on "selling" and "sharing" that decides whether an opt-out link is required; and it records the Nevada duties that apply to us because we operate from Nevada. The breach-notification and security-programme duties are in a separate document, breach-notification-and-wisp.md, because they apply whether or not any of the laws here do.

1. Which comprehensive state privacy laws apply to us today

Every US comprehensive privacy law applies only above a threshold, measured on the business, not on the user. The figures below are the statutory thresholds as at drafting; the lawyer should confirm the inflation adjustments and any new statutes.

Conclusion. No comprehensive state privacy law applies to EdgeQuote by threshold today. The Privacy Policy nonetheless grants the California-level rights to everyone (know, access, correct, delete, portable copy, opt out, non-discrimination, appeal) because doing so costs nothing operationally, keeps the documents true if the thresholds are later crossed, and is what Contractors in those states will ask for.

Watch-list. The figures that would change the answer: 100,000 leads from residents of any one state in a year (Virginia-style laws), 35,000 for the low-threshold states, or USD 25 million revenue (California, Utah). Review annually and whenever a large agency Contractor joins.

2. Do we "sell" or "share" personal information? — No

The opt-out duties, the "Do Not Sell or Share My Personal Information" link, and Global Privacy Control handling all turn on whether personal information is "sold" (disclosed for money or other valuable consideration) or "shared" (disclosed for cross-context behavioural advertising). The definitions are broad enough to catch ordinary advertising and analytics cookies. Our position:

• We run no advertising or analytics technology of any kind (Cookie Statement).
• Sub-processors (Vercel, Neon, Resend, Twilio, Cloudflare, and Stripe when live) receive data only to provide services to us under written contracts that restrict their use. They are service providers / contractors under Cal. Civ. Code §1798.140(ag) and (j), and disclosures to them are not sales.
• Webhook delivery sends lead data to a destination the Contractor chose, on the Contractor's instruction, for the Contractor's own purposes. That is the Contractor's disclosure to their own vendor, made through us as service provider, not a sale by us.
• Delivering a lead to the Contractor is the service the Homeowner asked for; the Contractor is the business the consumer is dealing with, not a third party buying data.
• Nothing is disclosed to data brokers, list vendors, or advertisers.

Therefore: no "Do Not Sell or Share" link is required; no "Limit the Use of My Sensitive Personal Information" link is required (we collect no sensitive personal information as defined: no SSN, precise geolocation, account credentials with password, racial or health data, or biometrics; a postal code is not precise geolocation); and a Global Privacy Control signal is honoured trivially, because everyone is already opted out. If any advertising or analytics tag is ever added, this section and the Privacy Policy become false, and the developer checklist in the Cookie Statement applies.

3. The California layer, mapped to where it lives

California requires specific disclosures. Each is already in the Privacy Policy; this table is the audit trail.

4. Nevada — duties that apply because we are here

NRS 603A.300–360 (online privacy notice and opt-out). An "operator" of a website that collects covered information from Nevada consumers and has a sufficient nexus with Nevada must post a privacy notice and honour verified requests not to sell covered information. We are established in Nevada, so the nexus is not in doubt. The notice must state (NRS 603A.340): the categories of covered information collected; the categories of third parties with whom it may be shared; a process for consumers to review and request changes; whether a third party may collect covered information about a consumer's online activities over time and across different websites (no); the effective date; and the designated request address for opt-out of sale. All of these are in the Privacy Policy (§2, §7, §11, §3, the version line, and §11's Nevada paragraph, respectively). A verified opt-out request must be answered within 60 days, extendable by 30 with notice; since we sell nothing, the answer is a confirmation.

NRS 603A.210 (reasonable security). A data collector must implement and maintain reasonable security measures. The WISP in breach-notification-and-wisp.md is that programme.

NRS 603A.215 (payment cards). A data collector that accepts payment cards must comply with the PCI DSS. When billing launches, card entry happens in Stripe's hosted element and no card data touches our systems, which keeps us in the lightest self-assessment category (SAQ A); the accountant and Stripe's dashboard confirm the attestation annually. [Applies only when billing launches.]

NRS 603A.220 (breach notification) is in the breach document.

NRS 603A.040 ("personal information") is narrower than the GDPR's: name plus SSN, driver's licence, account number with access code, medical or health-insurance identifier, or a username/email with a password. EdgeQuote holds none of those elements, which matters for Section 1 of the breach document.

5. Other US laws that touch the Service

• Dark patterns. California, Colorado and Connecticut regulations, and the FTC, treat consent obtained through manipulative design as invalid. The Subscription Terms checklist and the Marketing Playbook set the rules; nothing on the Service uses urgency timers, hidden costs, pre-ticked boxes, or obstructive cancellation.
• Telephone and messaging (TCPA and state mini-TCPAs) are covered in the Marketing Playbook. SMS from the Service goes to Contractors only, about their own leads, at their own request.
• Automated decision-making and profiling. We do none. California's ADMT regulations (adopted 2025, phasing in from 2027), Colorado's profiling opt-out and the GDPR's Art. 22 therefore impose nothing today; the Privacy Policy §11 says so in terms so that the position is on record.
• Employees. California's CPRA covers employee data; EdgeQuote has no employees. Re-check on the first hire.

6. Rest of world, briefly

Our users are in the US, the EU and the UK. If Contractors sign up from elsewhere, the GDPR-standard approach in this pack covers most of what the following require, with these extras to note:

• Canada (PIPEDA; Quebec Law 25): consent-based model; Quebec requires a French-language notice (the Homeowner Notice already exists in French), a designated privacy officer whose title and contact are published (the privacy contact in the Privacy Policy would serve), a privacy impact assessment before transferring Quebecers' data outside Quebec, and "privacy by default" settings. CASL governs any marketing email (Marketing Playbook §3).
• Switzerland (FADP 2023): closely aligned with the GDPR; the Privacy Policy already names Switzerland in transfers. A Swiss representative is required only above thresholds we are far from.
• Australia (Privacy Act): the small-business exemption (turnover below AUD 3 million) applies to us today.
• Brazil (LGPD), India (DPDP Act), China (PIPL): not targeted. If a Contractor from any of them appears, review before serving them: India's consent-manager model and China's data-localisation and separate-consent rules cannot be satisfied by this architecture without changes.

---

NOTES FOR YOUR LAWYER

1. Thresholds. Section 1 concludes that no comprehensive state law applies by threshold. Confirm the current inflation-adjusted CCPA revenue figure, the Texas/Nebraska small-business reading, and whether any statute enacted since drafting (the list grows every session) has a threshold we would cross.
2. "Consumer" counts for the threshold. For the 100,000-consumer test we count Homeowners (leads) and Contractors; the count is per state of residence, which we approximate by the postal code entered. Confirm that approach.
3. Service-provider status. Section 2 treats sub-processors as service providers and webhook deliveries as the Contractor's own disclosure. Confirm both, and confirm that each vendor DPA contains the §1798.140(ag)(1) terms (the placeholder in Section 3).
4. Nevada nexus. We read NRS 603A.330 as squarely applying because the operator is in Nevada. Confirm, and confirm the notice elements map as stated in Section 4.
5. Two request methods. We rely on the online-only exception to the toll-free-number requirement. Confirm it applies to a service embedded on third-party websites.
6. GPC. Because we do not sell or share, the Privacy Policy says a GPC signal changes nothing. Confirm that a statement is enough and that no technical acknowledgement is expected of a business that does not sell or share.

WHAT THIS DOES NOT COVER

• The Contractor's own obligations under their state's privacy law toward Homeowners.
• Federal sector laws (HIPAA, GLBA, COPPA, FCRA); see regulated-data.md.
• Breach notification and the security programme; see the companion document.
• Any state's law on the Contractor's calls, texts or emails to Homeowners.