US State Privacy Notice
Last updated 25 July 2026
This notice supplements our global privacy policy and applies to residents of US states with comprehensive privacy laws — California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana. Where a term is defined in those laws, we use it as defined. Everything in the global policy still applies; this page adds the disclosures those state laws require.
Who this applies to
You, if you are a resident of one of the states above and you visit this website, submit an enquiry, or receive business correspondence from us. It covers personal information about you as a business contact — US state privacy laws no longer exempt business-to-business contact data.
Personal information we collect
In the last twelve months we have collected the following categories. The category names are the statutory ones, so they read more broadly than what we actually hold — the examples are the specific fields.
| Category | What this means for us | Source | Purpose |
|---|---|---|---|
| Identifiers | Name, work email address, employer, and first-party cookie identifiers we set (a visitor ID, a session ID, a campaign-attribution value, and an opaque token when you arrive from a link in one of our emails). | You, and automatically from your device | Responding to enquiries; measuring site use; attribution |
| Customer records | Name and employer, where you provide them in an enquiry. | You | Responding to enquiries |
| Commercial information | The services you enquire about and what you tell us you want reviewed. | You | Responding to enquiries |
| Internet or network activity | Pages viewed on this site, page titles, the referring URL, your language, and the campaign parameters a link carried. | Automatically from your device | Measuring site use; attribution |
| Geolocation data | A coarse region only. We read the country your network connection appears to originate from, classify it into one of three buckets (EU/EEA/UK, United States, or other) to decide which consent model applies, and store only that bucket — never the country itself, and never a precise location. | Automatically, via our hosting provider | Applying the correct privacy treatment |
| Professional or employment information | Your employer and work email address. | You | Responding to enquiries; relevance of business correspondence |
| Inferences | Where we can identify you, conclusions we draw from the above about which of our services may be relevant to your organisation. | Derived from the categories above | Relevance of business correspondence |
We do not collect: protected classification characteristics, biometric information, sensory data (audio, visual, thermal or similar), education information, or precise geolocation.
Sensitive personal information
We do not collect sensitive personal information, as those laws define it, and we therefore do not use or disclose it for any purpose that would trigger a right to limit its use. Because we do not collect it, there is nothing for you to limit.
Where it comes from
- Directly from you, when you submit an enquiry or correspond with us.
- Automatically from your device, through first-party cookies and ordinary web-server logs when you use this site.
- From our own email correspondence, when you follow a link we sent you.
- From our hosting provider, in the form of the coarse region described above.
Why we use it
- To respond to an enquiry and to provide the services you ask about.
- To understand how this website is used, so we can improve it.
- To attribute a visit to the campaign or message that led to it.
- To judge whether our business correspondence is relevant to you.
- To keep records we are required to keep, and to establish or defend legal claims.
- To secure the site and prevent abuse.
We do not sell or share your personal information
We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the last twelve months — and we do not do so now. We run no third-party advertising technology and no third-party analytics on this site. Every identifier described above is a first-party cookie we set ourselves, sent only to systems we build and operate. We also do not knowingly collect or sell the personal information of anyone under 16.
Who else processes it
We disclose personal information for business purposes to service providers who process it only on our instructions and are contractually barred from using it for their own purposes. They are not third parties in the sense those laws use, and these disclosures are not sales or sharing. Our service providers fall into these categories:
- Cloud hosting and content delivery for this website.
- Managed database hosting for the systems that store enquiries.
- Business email and productivity, used to correspond with you.
Our customer relationship system is not on this list because we built it and run it ourselves — your information is not handed to a third-party CRM vendor.
How long we keep it
We keep each category only as long as it is needed for the purpose it was collected for, then delete or anonymise it. Cookie lifetimes are listed in full in our cookie policy. Where a longer period is required to meet a legal, accounting or record-keeping obligation, or to establish or defend a legal claim, we keep it for that period and no longer.
| Site analytics events | 24 months from collection |
| Enquiry and lead records | 36 months from your last contact with us |
| Business contact records | 24 months from your last engagement with our correspondence |
| Cookies | 365 days, 180 days, 30 days or the session — see the cookie policy |
Your rights
Depending on your state, you have some or all of the following rights. We honour all of them for residents of every state listed above, rather than varying them state by state:
- To know what personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to.
- To access a copy of it, in a portable form where technically feasible.
- To correct inaccurate personal information.
- To delete personal information we hold about you.
- To opt out of any sale or sharing of personal information. We do not sell or share, so there is nothing to opt out of — but the control is provided anyway.
- To opt out of profiling that produces legal or similarly significant effects. We do not carry out profiling of that kind.
- Not to be discriminated against for exercising any of these rights.
- To appeal a decision, if we decline your request.
How to exercise them
Email us and tell us what you would like us to do. There is no form to complete and no account to create. Requests are free. You can reach us at privacy@alekstra.ai.
You can also write to us, for the attention of Privacy, at One Liberty Plaza, 165 Broadway, 23rd Floor, New York, NY 10006. Post reaches us more slowly than email, so use email if you have the choice.
How we verify you
We ask for enough information to match your request to the records we hold — usually the email address you contacted us from or that we hold for you. We will not ask for identity documents. If we cannot match you to a record with reasonable confidence, we will tell you why rather than guess, because acting on an unverified request would itself be a disclosure to the wrong person.
Authorised agents
You may use an authorised agent to make a request. We will ask for written proof that you authorised them, and we may still contact you directly to confirm.
How long we take
We confirm receipt within 10 business days and respond substantively within 45 days. If we need longer we will tell you within that window, with the reason, and take no more than a further 45 days.
If we say no
If we decline your request, we will tell you why and how to appeal. Reply to our decision and a different person reviews it; we respond to the appeal within 45 days. If we deny the appeal, you may complain to your state Attorney General.
Opt-out preference signals
We honour the Global Privacy Control (GPC). If your browser or extension sends the signal, we treat it as a valid request to opt out: no analytics or attribution cookies are set on that device, anything already set is deleted, and nothing is sent to us. This happens on arrival, without you having to click anything, and it takes precedence over any earlier choice you made in our cookie banner. Because the signal is read live rather than recorded, it applies for as long as your browser sends it.
No discrimination
We will not deny you goods or services, charge you a different price, or provide a different level or quality of service because you exercised any of these rights. We operate no financial incentive programme tied to personal information.
Contact us
For any request or question about this notice, email privacy@alekstra.ai. Alekstra Inc, One Liberty Plaza, 165 Broadway, 23rd Floor, New York, NY 10006, is the business responsible for the personal information described in this notice. Our affiliate Alekstra Oy (Business ID 1885374-9, Kumitehtaankatu 5, 04260 Kerava, Finland) is responsible for our European business and is the data controller under European law. A request sent to the address above reaches both — you do not need to work out which entity holds your information.