Notice at Collection & Do Not Sell or Share

1. About This Notice

Grace Unworthy Ministries, LLC ("we," "our," or "us") provides this Notice at Collection to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA/CPRA"). This document applies to the properties listed in our Covered Properties notice, which is incorporated by reference.

This notice summarizes the categories of personal information we collect, the purposes for which we use each category, how long we keep it, whether we sell or share it, and how you can opt out. It supplements — and is consistent with — our Privacy Policy, which contains the full description of our data practices and your rights.

2. Categories of Personal Information We Collect

In the preceding twelve months, we have collected the following statutory categories of personal information. Not every category applies to every person — what we hold depends on which services you use.

• Identifiers. Name, display name, email address, postal address, phone number, account ID, IP address, device identifiers including a generated device ID and push notification tokens, a device fingerprint hash, and social sign-in identifiers from Google, Facebook, LinkedIn, Twitter/X, or Apple.
• Customer records information (Cal. Civ. Code § 1798.80). Name, contact details, billing and shipping addresses, and payment identifiers held with our processor. We do not receive or store full payment card numbers or CVV codes.
• Protected classification characteristics, where you provide them. Optional profile fields such as birthday or age, and religious or church affiliation. These are always voluntary — see Section 5.
• Commercial information. Products, courses, and subscriptions purchased or considered; order and invoice history; refunds, credits, points, and coupons; subscription status and dunning history; and shipment records.
• Internet or other electronic network activity. Pages and screens viewed, referring URLs, navigation paths, search queries, session duration and timing, feature usage, email opens and clicks with the associated IP address and user agent, error and crash diagnostics, and session replay of interactions on our web pages.
• Geolocation data. Approximate location derived from IP address, and location you enter yourself in a profile or shipping address. We do not collect precise GPS location for advertising.
• Audio, electronic, and visual information. Profile and cover photos, images and files you upload, voice notes and audio recordings, and automated transcripts of that audio — including voice notes sent in direct messages.
• Professional or employment information. Occupation or ministry role, where you choose to enter it in your profile.
• Education information. Course enrollments, progress, quiz and assessment responses and scores, certificates, achievements, and notes or reflections you submit.
• Inferences. Internal affinity and relevance scores derived from your activity, used to order feeds and suggest people, groups, and content; interest and engagement segments used for messaging and advertising measurement; and automated safety and trauma-sensitivity scores generated for content moderation.
• Sensitive personal information. Account log-in credentials, religious or philosophical beliefs where you provide them, and the contents of direct messages where we are not the intended recipient. See Section 5.

We collect this information directly from you, automatically as you use our services, and from service providers such as our payment processor, email and SMS providers, analytics and advertising platforms, and social sign-in providers. Full detail is in Section 2 of our Privacy Policy.

3. Purposes for Collection and Use

We use the categories above for the following business and commercial purposes:

• Creating, authenticating, and securing accounts, and preventing fraud and abuse
• Delivering the services you request — courses, community features, journaling, downloads, and purchases
• Processing payments, subscriptions, renewals, refunds, shipping, and related financial recordkeeping
• Tracking learning progress and issuing certificates and achievements
• Personalizing feeds, recommendations, and content ordering using activity history and affinity scores
• Operating safety and moderation systems, including automated content review, and enforcing our policies
• Providing customer support and responding to your inquiries and rights requests
• Sending transactional messages such as receipts, security alerts, and policy updates
• Sending marketing email and text messages where you have opted in, and measuring their performance
• Measuring advertising performance, attributing conversions, building audiences, and limiting repeat ad exposure on the same device
• Debugging, maintaining, and improving our sites, apps, and infrastructure
• Complying with legal obligations and responding to lawful requests

We do not use or disclose personal information for purposes materially different from, or incompatible with, those disclosed here without providing you notice.

4. Sale and Sharing for Cross-Context Behavioral Advertising

The technologies involved include the Meta Pixel and the Meta Conversions API, Google Analytics 4 and the GA4 Measurement Protocol, the TikTok Pixel and TikTok events, Meta App Events in our mobile app, and device fingerprinting used for advertising frequency capping. Several of these operate server-side, meaning events are sent from our systems rather than your browser, so browser cookie blocking alone does not stop them.

Categories sold or shared in the preceding twelve months: identifiers, internet or other electronic network activity information, commercial information, and inferences. The categories of third parties receiving them are advertising and analytics platforms.

We do not knowingly sell or share the personal information of consumers under 16 years of age. Our services are not directed to children under 13, as described in our Privacy Policy.

We also disclose personal information to service providers and contractors for business purposes — including hosting, payment processing, email and SMS delivery, transcription, error monitoring, and customer support. Those disclosures are made under contracts that restrict use of the information to performing services for us, and they are not sales or sharing.

5. Sensitive Personal Information

Some of what we collect is sensitive personal information under the CPRA — most notably religious or philosophical beliefs, including church or denominational affiliation and faith-journey details, along with account log-in credentials and the contents of direct messages.

6. Your Right to Opt Out — How to Do It Today

You have the right to opt out of the sale or sharing of your personal information. The following methods are available right now:

6.1 Reject on the cookie banner

On web properties where we display a cookie banner, selecting Reject opts you out of banner-controlled analytics and marketing technologies in that browser. Your choice is stored in your browser's local storage, so it applies only to that browser on that device — clearing site data, using private browsing, switching browsers, or using another device will require you to choose again. Our banner offers a single Accept-or-Reject choice rather than per-category toggles, and it is not displayed on every property. See our Cookie Policy for which measurement runs outside the banner.

6.2 Email us — the most complete method

6.3 Global Privacy Control

6.4 Additional controls

• Block third-party cookies or enable tracking prevention in your browser, and use content blockers
• On iOS, decline App Tracking Transparency and review Settings > Privacy & Security > Tracking; on Android, reset or delete your advertising ID and opt out of ads personalization
• Use industry opt-out tools at optout.aboutads.info and optout.networkadvertising.org

An opt-out does not stop transactional messages, does not delete information we already hold, and does not stop non-advertising analytics we use to operate our services. To request deletion, see our Data Deletion & Retention Policy.

7. Retention

We keep each category of personal information for as long as necessary to fulfill the purposes described in Section 3, and then delete or de-identify it, unless a longer period is required for legal, accounting, audit, dispute-resolution, or safety purposes. At a high level:

• Account and profile data: retained while your account is active, plus a short wind-down period after deletion
• Community content and messages: retained while your account is active; removed or disassociated on deletion, though copies delivered to other members may persist in their accounts
• Learning records: retained while your account is active; enrollment records tied to a purchase follow the financial rule below
• Purchase, payment, and subscription records: retained indefinitely for tax, accounting, audit, chargeback, and dispute-defense purposes, and not deleted in response to a deletion request
• Marketing and suppression records: opt-out and unsubscribe records retained indefinitely so that we can keep honoring your opt-out
• Moderation and safety records: retained after account deletion to enforce our policies and prevent evasion
• Logs and diagnostics: retained for a limited operational window, then deleted or aggregated
• Aggregated and de-identified analytics: may be retained indefinitely

The full retention schedule is in Section 8 of our Privacy Policy, and the deletion process — including what we cannot delete — is described in our Data Deletion & Retention Policy.

8. Your Other California Rights

• Right to know. Request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we disclosed it.
• Right to delete. Request deletion of personal information we collected from you, subject to the statutory exceptions — including the financial recordkeeping described in Section 7.
• Right to correct. Request correction of inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing. Described in Section 6.
• Right to limit sensitive personal information. Described in Section 5 — our uses do not trigger this right, and we will tell you if that changes.
• Right to non-discrimination. Described in Section 10.

Submit requests to [email protected], telling us which right you are exercising and the email address associated with your account. We verify identity before acting, generally by confirming the request from the account email or by asking you to confirm details we already hold. We confirm receipt within ten (10) business days and respond substantively within forty-five (45) days, with one additional 45-day extension where reasonably necessary and with notice to you. If we deny a request, you may appeal by replying to our decision.

9. Authorized Agents

You may designate an authorized agent to submit a request on your behalf. The agent should email [email protected] and state clearly that they are acting as an authorized agent, identify the consumer, and describe the request.

• We require written permission signed by the consumer, or proof of a valid power of attorney under California Probate Code
• We may contact the consumer directly to confirm that they authorized the request
• We may require the consumer to verify their own identity with us
• We may deny a request from an agent who does not submit proof of authorization

10. Non-Discrimination

We will not discriminate against you for exercising any of your California privacy rights. Exercising a right will not cause us to deny you goods or services, charge you a different price or rate, impose penalties, provide a different level or quality of service, or suggest that you will receive any of those.

We do not offer financial incentives or price differences in exchange for the retention or sale of personal information. If we ever introduce a loyalty or incentive program that involves personal information, we will provide the required notice of financial incentive and obtain your opt-in consent first.

11. Changes to This Notice

We may update this notice as our practices, technologies, or legal obligations change. Material changes are reflected in the Last Updated date shown at the top of this page. If we begin honoring Global Privacy Control signals automatically, change what we sell or share, or change how the cookie banner works across our properties, we will revise this notice to describe the change accurately.

12. Contact

Submit opt-out and privacy rights requests to our privacy team. For the full description of our data practices, see our Privacy Policy; for tracking technologies specifically, see our Cookie Policy; and for deletion, see our Data Deletion & Retention Policy.