California Privacy Notice
This notice is for California residents and describes your rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), effective January 1, 2023.
Table of Contents
- CCPA vs CPRA — What Changed
- Does This Apply to OpenMat?
- Personal Information We Collect
- Sensitive Personal Information
- Sources of Personal Information
- Business Purposes for Collection
- Disclosure of Personal Information
- Sale & Sharing — We Don't
- Your California Privacy Rights
- Sensitive PI Limitation Right
- How to Submit a Request
- Authorized Agents
- Verification Process
- Response Timeframes
- Non-Discrimination
- Financial Incentives
- Shine the Light (Cal. Civ. Code §1798.83)
- Do Not Track
- Minors — Under 16
- Changes to This Notice
- Contact Us
1 CCPA vs CPRA — What Changed
The California Consumer Privacy Act (CCPA) came into force on January 1, 2020. It was significantly amended by the California Privacy Rights Act (CPRA), which took effect on January 1, 2023. OpenMat complies with the CPRA-amended version of the law, which is the current applicable standard.
CCPA
- Right to know what PI is collected
- Right to delete PI
- Right to opt out of sale of PI
- Right to non-discrimination
- Covered businesses: $25M revenue, 50K+ consumers, or 50%+ revenue from sale of PI
CPRA
- All CCPA rights plus:
- Right to correct inaccurate PI
- Right to limit use of sensitive PI
- Right to opt out of "sharing" (behavioral advertising)
- New category: Sensitive Personal Information
- Created dedicated enforcement agency: CPPA
- Stricter data minimisation obligations
2 Does This Apply to OpenMat?
The CCPA/CPRA applies to for-profit businesses that meet one or more of the following thresholds and do business in California:
- Annual gross revenue exceeding $25 million.
- Annually buy, sell, or share for commercial purposes the personal information of 100,000 or more consumers or households.
- Derive 50% or more of annual revenue from selling consumers' personal information.
As of the date of this notice, OpenMat operated by Proscris LLC may not meet the technical CCPA threshold for mandatory compliance. However, we voluntarily comply with the CCPA/CPRA for all California residents as a matter of principle and best practice. We believe every California user deserves the full protection of the law regardless of whether we are technically required to provide it.
3 Personal Information We Collect
In the preceding 12 months, we have collected the following categories of personal information from California consumers. "Personal information" under CCPA means information that identifies, relates to, or could reasonably be linked to you or your household.
| CCPA Category | Examples Collected | Collected? | Disclosed to Third Parties? | Sold? |
|---|---|---|---|---|
| A — Identifiers | Name, email address, @handle, IP address (approximate), device ID, session ID | ✓ Yes | Limited — service providers only | ✗ Never |
| B — Personal information (Cal. Civ. Code §1798.80) | Name, email address | ✓ Yes | Limited — service providers only | ✗ Never |
| C — Protected classification characteristics | Age or age range (if provided via Google OAuth, optional); gender (if provided via Google, optional) | Optional only | Not disclosed | ✗ Never |
| D — Commercial information | Subscription plan (Free/Coach/Academy), Mat Points balance, rewards redeemed, purchase history | ✓ Yes | Stripe only (payment processing) | ✗ Never |
| E — Biometric information | None | ✗ Not collected | N/A | ✗ Never |
| F — Internet / network activity | Pages visited, features used, session duration, clicks, scroll depth, feature engagement | ✓ Yes | n8n (our own analytics only) | ✗ Never |
| G — Geolocation data | City and country approximated from IP address. No precise GPS location unless explicitly granted. | Approximate only | ipapi.co (geolocation API) | ✗ Never |
| H — Sensory data | Profile photos uploaded by users | User-uploaded only | Not disclosed | ✗ Never |
| I — Professional / employment information | Martial arts rank, belt, academy affiliations, coaching role (user-provided) | ✓ Yes | Not disclosed | ✗ Never |
| J — Non-public education information | None | ✗ Not collected | N/A | ✗ Never |
| K — Inferences drawn from above | Training preferences, discipline focus, engagement level, estimated training frequency | ✓ Yes | Not disclosed | ✗ Never |
| L — Sensitive personal information | Health/fitness data (weight logs, training intensity, injury notes — optional); precise geolocation (Beacon, opt-in only) | Optional / Consent only | Not disclosed | ✗ Never |
4 Sensitive Personal Information
The CPRA created a new sub-category of personal information called Sensitive Personal Information (SPI) that receives heightened protection. California consumers have the right to limit the use and disclosure of their SPI to what is necessary to provide the requested service.
Here is every CPRA Sensitive PI category and our status for each:
Health / Fitness Data
Weight logs, training intensity, injury notes entered voluntarily. Used only to display your own data back to you. Never used for advertising or shared.
Precise Geolocation
City/country approximation from IP for analytics. Precise GPS only if you explicitly grant it for Beacon. Never used beyond the requested feature.
Social Security Number
Not collected. We have no reason to collect government identification numbers.
Financial Account Numbers
Not collected by us. Payment card details are handled exclusively by Stripe and never transmitted to OpenMat servers.
Racial / Ethnic Origin
Not collected. We do not ask for or infer racial or ethnic origin.
Religious / Philosophical Beliefs
Not collected. We do not ask about religion or beliefs.
Union Membership
Not collected.
Genetic Data
Not collected.
Biometric Data
Not collected. No fingerprints, face recognition, or biometric identifiers of any kind.
Sexual Orientation / Sex Life
Not collected. We do not ask about or infer sexual orientation.
Contents of Communications
Direct messages between users are end-to-end encrypted and not read by OpenMat except where required for safety investigations.
Immigration Status
Not collected.
5 Sources of Personal Information
We collect California consumers' personal information from the following sources:
- Directly from you: Account registration, profile setup, training session logs, community posts, messages, gear entries, weight entries, and support communications.
- Automatically from your device: Device type and operating system, browser type and version, IP address (approximate), pages visited, features used, session data, and error logs — collected when you use the OpenMat app or website.
- From Google (with your consent): If you use Google Sign-In, we receive your name, email address, profile picture, and locale from Google. With your additional optional consent, we may also receive your approximate age range, general location, and birthday from your Google account.
- From Stripe (payment processor): Confirmation of subscription status, last 4 digits of payment card, billing country, and payment success/failure — received when you subscribe to a paid plan.
- From ipapi.co (geolocation service): City and country approximation based on your IP address, used for analytics and Beacon distance features.
6 Business Purposes for Collection
We collect personal information for the following business and commercial purposes, as defined under the CCPA/CPRA:
| Business Purpose | PI Categories Used | Required for Service? |
|---|---|---|
| Providing and operating the OpenMat platform and its features | A, B, D, F, I, K | Yes |
| Processing subscriptions and transactions | A, B, D | Yes (if paid) |
| Personalizing training recommendations and Sensei AI coaching | I, K, F | Service feature |
| Enabling the Beacon partner-finding feature | G (approximate) | Optional feature |
| Sending transactional emails (receipts, password resets) | A, B | Yes |
| Sending marketing/training reminder emails | A, B | With consent — optional |
| Analytics and platform improvement | F, G (anonymised) | Legitimate business interest |
| Security, fraud detection, and abuse prevention | A, F, G | Yes |
| Responding to support and legal requests | A, B, and as required | Yes |
| Legal, regulatory, and tax compliance | A, B, D | Legal obligation |
| Auditing interactions for regulatory compliance | F (aggregated) | Legal obligation |
We do not use personal information for any purpose not disclosed in this notice or our Privacy Policy without giving you advance notice and, where required, obtaining your consent.
7 Disclosure of Personal Information
In the preceding 12 months, we have disclosed the following categories of personal information to the following categories of third parties for the stated business purposes. All disclosures are governed by written data processing agreements that prohibit recipients from using the data for any purpose other than providing services to us.
| PI Category | Recipient Category | Purpose |
|---|---|---|
| Identifiers (A) Name, email, handle |
Payment processor (Stripe); Email delivery provider; n8n (our analytics) | Payment processing; Transactional emails; Internal analytics |
| Commercial information (D) Subscription plan, purchase history |
Payment processor (Stripe) | Subscription management and billing |
| Internet activity (F) Usage patterns (anonymised) |
n8n (our own automation) | Internal analytics — we own this data, n8n processes on our behalf |
| Geolocation (G) City/country approximation |
ipapi.co | IP geolocation API — request only, not stored by ipapi.co |
| All categories | Law enforcement / courts | Only when legally required by valid court order or subpoena |
We do not disclose personal information to data brokers, advertising networks, marketing companies, or any third party for their own commercial purposes.
8 Sale & Sharing — We Don't
Under the CCPA/CPRA, "selling" personal information means disclosing it to a third party for monetary or other valuable consideration. "Sharing" means making it available to a third party for cross-context behavioral advertising.
OpenMat does neither. Specifically:
- We do not sell your personal information to data brokers.
- We do not sell your personal information to marketers or advertisers.
- We do not share your personal information for cross-context behavioral advertising.
- We do not allow third-party advertisers to collect personal information through our platform.
- We do not use your personal information to build advertising profiles for use by third parties.
- Our service providers receive personal information only to provide contracted services — this does not constitute a "sale" or "share" under CCPA/CPRA.
Because we do not sell or share personal information, you technically do not need to exercise the "opt out of sale or sharing" right with us. However, we honor it anyway — see the Opt-Out section below.
Opt Out of Sale or Sharing
Even though we do not sell or share your personal information, California law requires us to provide this mechanism. Submit your request below and we will confirm our no-sale status in writing.
Do Not Sell or Share My Personal Information9 Your California Privacy Rights
California residents have the following rights under the CCPA/CPRA. These rights are in addition to any rights you have under our general Privacy Policy.
Right to Know
Request disclosure of the specific pieces and categories of personal information we have collected about you, the sources, the purposes, and the third parties with whom we share it. Covers the prior 12 months. We may provide up to 2 years of history.
Right to Delete
Request deletion of personal information we have collected from you, subject to certain exceptions (legal obligations, fraud detection, completing transactions you requested, internal research, etc.).
Right to Correct
Request correction of inaccurate personal information we maintain about you, taking into account the nature of the information and the purposes for which it is processed.
Right to Opt Out of Sale / Sharing
Direct us not to sell or share your personal information. We do not sell or share — but we provide this mechanism as required by law. See Section 8 above.
Right to Limit Sensitive PI Use
Direct us to limit our use and disclosure of your sensitive personal information to only what is necessary to provide the service. See Section 10 for details.
Right to Non-Discrimination
Not receive discriminatory treatment for exercising any CCPA/CPRA rights. We will not deny service, charge different prices, provide different quality, or suggest you will receive different treatment for exercising your rights.
10 Right to Limit Sensitive PI Use (CPRA)
Under the CPRA, California residents have the right to direct a business to limit its use and disclosure of sensitive personal information to only what is necessary to provide the goods or services you reasonably expect.
As stated in Section 4, OpenMat collects limited sensitive personal information — health/fitness data (optional) and approximate geolocation (for Beacon). We already limit our use of this data to the minimum necessary to provide the feature you requested. However, you can exercise this right at any time:
- Health / fitness data: Delete your weight logs and health notes at any time from Settings → Data → Delete Health Data. You can also simply stop entering this data — it is entirely optional.
- Precise geolocation (Beacon): Turn off your Beacon from the app header or Beacon panel at any time. Your location data stops being processed immediately.
- Formal limitation request: Email privacy@openmat.ai with subject "CCPA Limit Sensitive PI" and specify which sensitive data category you wish to limit. We will confirm within 15 business days.
11 How to Submit a Request
You may submit any California privacy rights request through the following channels:
| Channel | How to Use | Best For |
|---|---|---|
| In-App | Settings → Account Settings → Privacy Requests | Access, deletion, correction, data export |
| privacy@openmat.ai | All request types; required for opt-out, SPI limitation | |
| Subject Line Format | "CCPA [Right Type] Request — @yourhandle" | Ensures fastest routing to our privacy team |
What to include in your request:
- Your full name as registered on OpenMat (or your @handle).
- The email address associated with your OpenMat account.
- The specific right you wish to exercise (Know, Delete, Correct, Opt-Out, Limit SPI).
- Any additional context that will help us locate your records.
12 Authorized Agents
California residents may designate an authorized agent to submit CCPA/CPRA requests on their behalf under Cal. Civ. Code §1798.135.
Requirements for authorized agent requests:
-
Written authorization from the consumer
The agent must provide a written and signed authorization from the California resident granting them permission to act on the consumer's behalf. This can be a signed letter, a power of attorney, or a legal guardianship document.
-
Agent identity verification
The agent must verify their own identity. We may ask for a government-issued ID or other documentation to confirm the agent is who they claim to be.
-
Consumer identity verification
Except where the agent has power of attorney, we will also contact the consumer directly to verify they authorize the agent. This protects consumers against unauthorized access to their data.
-
Submit to privacy@openmat.ai
Email all documentation to privacy@openmat.ai with subject "CCPA Authorized Agent Request." We will review and respond within 15 business days.
Exception — Power of Attorney: If an agent has a valid, notarized power of attorney under California Probate Code §4000–4665, we will process the request without requiring separate consumer verification, provided the POA document is current and applies to privacy-related decisions.
13 Verification Process
We are required to verify your identity before processing most CCPA/CPRA requests to prevent unauthorized access to, modification, or deletion of your personal information. The verification process is proportionate to the sensitivity and nature of the request.
| Request Type | Verification Method | Verification Level |
|---|---|---|
| Right to Know (Categories) | Email verification link sent to registered address | Standard — email confirmation |
| Right to Know (Specific Pieces) | Email verification + one additional identifier (e.g., @handle) | Elevated — two factors |
| Right to Delete | Email verification + @handle confirmation (in-app) or two identifiers (email) | Elevated — two factors |
| Right to Correct | Email verification link | Standard — email confirmation |
| Opt-Out of Sale/Sharing | Email acknowledgment only — no verification required | Minimal — no personal data at risk |
| Limit Sensitive PI | Email verification link | Standard — email confirmation |
We will never ask you to provide your password, full payment card number, Social Security number, or government-issued ID as part of standard verification. If you receive a communication asking for these details claiming to be from OpenMat, contact us immediately at security@openmat.ai.
14 Response Timeframes
Under Cal. Civ. Code §1798.130(a)(2), we must respond to CCPA/CPRA consumer requests within specific timeframes:
| Action | Required Timeframe | Our Target |
|---|---|---|
| Acknowledge receipt of request | 10 business days (Cal. Civ. Code §1798.130(a)(1)) | Within 2 business days |
| Substantive response to request | 45 calendar days from receipt | Within 30 calendar days |
| Extension (if needed) | Up to additional 45 days (90 days total) with notice | We will notify you before Day 45 if needed |
| Opt-out of sale/sharing confirmation | 15 business days | Within 5 business days |
| Limit sensitive PI confirmation | 15 business days | Within 5 business days |
Responses are provided free of charge for up to 2 requests in any 12-month period. We will notify you and explain our reasoning before charging any fee for excessive requests.
We provide responses in a portable, readily usable format that allows you to easily transmit the information to another entity — specifically, JSON format for data exports.
15 Non-Discrimination
OpenMat will not discriminate against you for exercising any of your California privacy rights under the CCPA/CPRA. This means we will not:
- Deny you goods or services.
- Charge you a different price or rate for goods or services, including through discounts, penalties, or different quality of service.
- Provide you a different level or quality of goods or services.
- Suggest that you may receive a different price, rate, level, or quality of goods or services.
- Retaliate against you for exercising your rights.
- Penalize employees, contractors, or job applicants for exercising their CCPA rights.
Exception — Financial Incentives: We may offer different prices, rates, or quality of services if the difference is reasonably related to the value provided by the consumer's data. Any such financial incentive program will be disclosed separately and you may opt out at any time. See Section 16.
16 Financial Incentives
OpenMat currently offers the following program that could be considered a financial incentive under Cal. Civ. Code §1798.125(b):
| Program | Benefit | PI Involved | How to Opt In/Out |
|---|---|---|---|
| Founding Member Program | Locked-in discounted pricing and exclusive benefits for early adopters | Email address, subscription data | Opt-in at signup. Opt-out by cancelling Founding Member status (pricing reverts to standard). |
| Mat Points (Loyalty) | Points earned for training activity, redeemable for rewards | Training activity data, session logs | Automatically enrolled for all users. Opt-out by stopping point redemption; points simply go unused. No data collected beyond what's needed for the app itself. |
The material terms of these programs are disclosed at the time of enrollment. We calculate the value of consumer data used in these programs as described in our full financial incentive disclosures available on request at privacy@openmat.ai.
These programs are not contingent on you waiving your CCPA rights. You may exercise any privacy right and remain enrolled, or unenroll at any time without penalty.
17 Shine the Light (Cal. Civ. Code §1798.83)
California Civil Code Section 1798.83, known as the "Shine the Light" law, permits California residents to request certain information about our disclosure of personal information to third parties for their direct marketing purposes.
OpenMat does not disclose personal information to third parties for direct marketing purposes. We do not sell, rent, trade, or transfer your personal information to any third party for them to market their products or services directly to you.
Because we make no such disclosures, there is no information to provide in response to a Shine the Light request. However, if you wish to confirm this in writing, email privacy@openmat.ai with subject "Shine the Light Request" and we will confirm our practices in writing within 30 days.
18 Do Not Track
California Online Privacy Protection Act (CalOPPA) requires us to disclose how we respond to "Do Not Track" (DNT) signals from browsers.
OpenMat does not currently alter its data collection or processing practices in response to DNT browser signals, because there is no universally accepted standard for what constitutes a DNT signal or how businesses should respond to it.
However, our practices are privacy-respecting by default regardless of DNT status:
- We do not sell personal information — DNT or not.
- We do not use cross-site tracking — DNT or not.
- We do not place third-party advertising cookies — DNT or not.
- Analytics are anonymous session-level metrics that we own — not shared with advertising networks — DNT or not.
We will update this section if a workable DNT standard is adopted by the relevant authorities.
19 Minors — Under 16
The CCPA/CPRA contains specific provisions regarding minors' personal information:
Under 13 (COPPA): We do not knowingly collect personal information from children under 13 without verifiable parental consent. If you believe a child under 13 has created an account, contact privacy@openmat.ai immediately — we will delete the account within 5 business days.
Ages 13–15 (CCPA Opt-In Requirement): Under Cal. Civ. Code §1798.120(c), we must obtain affirmative authorization before selling or sharing the personal information of consumers aged 13–15. Since we do not sell or share any personal information (see Section 8), this requirement does not apply — but we honor it regardless by never selling or sharing data for any user in this age group.
Ages 16–17: Standard CCPA rights apply. Minors 16 and older may exercise all CCPA rights directly. Parents or guardians of 16–17 year olds may submit requests as authorized agents following the process in Section 12.
Deletion of Minor Data: Parents or legal guardians may request deletion of a minor's personal information at any time, regardless of the minor's age, by emailing privacy@openmat.ai with subject "Minor Deletion Request — [State]."
20 Changes to This Notice
We update this California Privacy Notice at least once per calendar year and whenever our data practices materially change. The "Last Updated" date at the top indicates when the most recent changes were made.
When we make material changes that affect California residents' rights or our data practices, we will:
- Post the updated notice with a new "Last Updated" date at openmat.ai/ccpa.
- Display an in-app notification describing the key changes to California users.
- For significant changes, send an email to registered California users at least 30 days before changes take effect.
Your continued use of OpenMat after the effective date of any updated notice constitutes your acknowledgment of the changes. Where changes require fresh consent under applicable law, we will seek it before the new processing begins.
We maintain archived versions of previous California Privacy Notices. To request a prior version, email privacy@openmat.ai with subject "CCPA Notice Archive Request."
21 Contact Us
For all California privacy rights requests, questions, or concerns:
| Privacy Team | privacy@openmat.ai |
| CCPA Request Subject Line | "CCPA [Right Type] Request — @yourhandle" |
| Do Not Sell / Share | "CCPA Opt-Out Request — Do Not Sell or Share" |
| Limit Sensitive PI | "CCPA Limit Sensitive PI Request" |
| Shine the Light | "Shine the Light Request" |
| Minors / COPPA | "Minor Data Request" or "COPPA Deletion Request" |
| Acknowledgment Time | Within 10 business days (required) — we target 2 business days |
| Response Time | Within 45 calendar days — we target 30 calendar days |
| Company | Proscris LLC, State of Florida, USA |
| Enforcement Agency | California Privacy Protection Agency (CPPA) — cppa.ca.gov |
This California Privacy Notice was prepared and last updated on April 1, 2026. It is reviewed at least annually. For the most current version, visit openmat.ai/ccpa. This notice is provided pursuant to Cal. Civ. Code §1798.100 et seq. (CCPA) as amended by Proposition 24 (CPRA). All section references are to the California Civil Code as amended.
California privacy rights?
Submit any CCPA or CPRA request to our privacy team. We acknowledge within 10 business days and respond within 45 calendar days — no charge for standard requests.