State and Provincial Privacy Rights Notice

Last updated: June 15, 2026 · Version 1.0

1. Purpose and How This Document Relates to the Privacy Policy

This Notice supplements our Privacy Policy by enumerating, in detail, the privacy rights that apply to you under the law of your state of residence (United States) or province of residence (Canada). The Privacy Policy describes our overall data-handling practices. This Notice sets out the state and provincial rights and the process for exercising them.

If there is any apparent inconsistency between the Privacy Policy and this Notice, the more user-protective interpretation governs.

2. How to Exercise Your Rights, Common Process

Regardless of where you live, the process for invoking any right described in this Notice is the same:

• Self-serve where possible. Many rights, access (data export), correction, deletion, and consent withdrawal, can be exercised directly from your privacy settings in the Service. The data-export action produces a structured archive that also satisfies the portability right.
• Email for everything else. For rights not self-serve (e.g., authorized-agent submissions, profiling opt-outs, sensitive-PI restrictions, de-indexing requests), email privacy@thepersonalityproject.com.
• Postal alternative. You may write to Scrawlr, 1820-999 W Hastings St, Vancouver, BC, Canada V6C2W2
• Verification. We will verify your identity before honoring a request affecting your personal information. Verification is typically through a confirmation link sent to the email on file, or, for authorized agents, through documentation of the agent’s authority.
• Response timelines. We respond within the timeframes required by your jurisdiction. As a default: 45 days for US state requests (with one 45-day extension where the request is complex); 30 days for PIPEDA and Quebec Law 25; one month for GDPR (with two-month extension).
• No retaliation. We will not discriminate against you or restrict your access to the Service in any way because you exercised one of these rights.

3. United States, State-Specific Rights

3.1 California (CCPA / CPRA / AADC)

Applies to: California residents.

Categories of personal information collected in the past 12 months

Swipe sideways to see every column

Sources

Directly from you (when you create an account, take an assessment, write a journal entry, post to community); automatically (telemetry as you use the Service); from your devices (browser type, OS).

Purposes for collection

See Privacy Policy, Section 2.

Categories of third parties

Service providers and legal and government authorities (see Privacy Policy, Section 6); affiliate networks for referral attribution (see our Affiliate Disclosure).

“Sale” and “Share” disclosure

Scrawlr has not sold or shared the personal information of any California resident in the past 12 months, within the meaning of the CPRA’s “sale” and “share” definitions. We do not engage in cross-context behavioral advertising. The “Do Not Sell or Share My Personal Information” link in our website footer surfaces a confirmation page documenting this position.

“Limit the Use of My Sensitive Personal Information”

Sensitive personal information as defined under CPRA §1798.140(ae), which includes the psychometric and clinical-scale data we collect, is used by Scrawlr only for the purposes described in the Privacy Policy. We do not use it for any purpose triggering the §1798.121 opt-out, because we limit the use to the permitted purposes by default. A “Limit the Use of My Sensitive Personal Information” link is provided in our website footer for California residents who wish to confirm or further restrict.

Specific California rights

• Right to know what personal information we have collected, used, disclosed, and (if applicable) sold or shared
• Right to delete personal information we have collected
• Right to correct inaccurate personal information
• Right to limit the use of sensitive personal information
• Right to opt out of sale and share (not applicable, we do neither)
• Right not to be discriminated against for exercising any of these rights
• Right to designate an authorized agent to exercise rights on your behalf (we will verify the agent’s authority and your identity)

“Shine the Light” (California Civil Code §1798.83)

We do not disclose personal information to third parties for their direct-marketing purposes.

California Age-Appropriate Design Code Act (AADC), minors 13 to 17

Users aged 13 to 17 in California receive heightened protections:

• Highest-privacy default settings on the account (profile private; direct messages restricted; mentorship pairing opt-in only)
• No dark patterns in our consent flows
• Data minimization specific to minors’ processing
• Completion of a Data Protection Impact Assessment (DPIA) for processing that affects minors
• No marketing-email opt-in offered until age of majority in California
• All advertising remains non-personalized and contextual only

3.2 Colorado (CPA)

Applies to: Colorado residents.

Rights

• Access: the right to confirm whether we process your personal data and to obtain a portable copy
• Correction: the right to correct inaccurate personal data
• Deletion: the right to delete personal data we maintain about you
• Portability: the right to receive your data in a structured, commonly used, machine-readable format
• Opt-out of:
• Targeted advertising, not applicable, we do not engage in targeted advertising
• Sale of personal data, not applicable, we do not sell
• Profiling in furtherance of decisions that produce legal or similarly significant effects, not applicable, we do not engage in such profiling

Universal opt-out mechanism

We honor universal opt-out mechanisms, including Global Privacy Control (GPC), for the categories of processing within their scope (sale, share, targeted advertising).

Sensitive data

Colorado’s CPA treats data revealing mental or physical health condition or diagnosis as sensitive. The psychometric and clinical-scale data we collect is processed only with your opt-in consent under our consent flow at signup and at the time you take a sensitive assessment.

Data Protection Assessment

We have conducted a Data Protection Assessment for the processing of sensitive data and the surfacing of crisis resources, as required by the CPA.

Appeals

If we deny your request, you may appeal by replying to our response with “Appeal” in the subject line, or by sending a fresh request to privacy@thepersonalityproject.com referencing the original denial. If the appeal is denied, you may contact the Colorado Attorney General at https://coag.gov/.

3.3 Virginia (VCDPA)

Applies to: Virginia residents.

Rights substantially similar to Colorado (§3.2): access, correction, deletion, portability, and opt-out of targeted advertising / sale / consequential profiling. Consent for processing of sensitive data is obtained at the point we begin processing it. Appeals process per §3.2. Escalation: Virginia Attorney General at https://www.oag.state.va.us/.

3.4 Connecticut (CTDPA)

Applies to: Connecticut residents.

Substantially the same as Virginia (§3.3). We honor Global Privacy Control where applicable to categories of processing within its scope. Escalation: Connecticut Attorney General at https://portal.ct.gov/ag.

3.5 Utah (UCPA)

Applies to: Utah residents.

Rights include access, deletion, portability, and opt-out of targeted advertising (not applicable, we do none) and sale (not applicable, we do none). No express opt-in for sensitive data at the level of CO/VA/CT, but Scrawlr applies the higher standard uniformly. Escalation: Utah Attorney General at https://attorneygeneral.utah.gov/.

3.6 Texas (DPSA)

Applies to: Texas residents.

The Texas Data Privacy and Security Act, effective July 1, 2024, provides rights to access, correction, deletion, portability, and opt-out of targeted advertising / sale / consequential profiling, substantially similar to Virginia (§3.3). Sensitive data (including mental-health status) requires consent. Escalation: Texas Attorney General at https://www.texasattorneygeneral.gov/.

3.7 Oregon (CPA)

Applies to: Oregon residents.

The Oregon Consumer Privacy Act, effective July 1, 2024, provides:

• Rights of access, correction, deletion, portability, opt-out of targeted advertising / sale / profiling, substantially similar to Virginia (§3.3)
• Sensitive-data sale prohibition: sale of sensitive data (which includes mental-health condition or diagnosis data, biometric data, and information about a known child) is prohibited without affirmative consent. Scrawlr does not sell any personal data, so this is satisfied by default.
• Specific list of third parties: on request, you have the right to receive a list of the specific third parties to whom we disclosed your personal data in the preceding 12 months. We maintain this list and will provide it on request.
• Universal opt-out mechanism honored.

Escalation: Oregon Attorney General at https://www.doj.state.or.us/.

3.8 Washington, My Health My Data Act (MHMDA)

Applies to: Washington residents, and the data this Act covers may go beyond Washington residents under certain interpretations.

Washington’s My Health My Data Act, effective March 31, 2024, applies to “consumer health data,” which is broadly defined to include data that identifies a consumer’s past, present, or future physical or mental health status, including:

• Mental-health conditions, diagnoses, symptoms, or treatments
• Data that could reasonably indicate or be used to infer the above

The psychometric and clinical-scale data we collect through The Personality Project (specifically PHQ-9, GAD-7, PHQ-15, PSS-4, DASS-21, PSWQ-16, SPIN-17, OCI-R, PDSS-SR, and AUDIT-10 responses, plus mood-logs and journal-entry crisis-content detection signals) may fall within MHMDA’s scope under a broad regulator interpretation.

Rights of Washington consumers under MHMDA

• Right to confirm whether we collect, share, or sell your consumer health data
• Right to access your consumer health data, including a list of all third parties with whom we shared it
• Right to withdraw consent
• Right to delete your consumer health data

Scrawlr’s MHMDA-related practices

• Authorization for collection. Where MHMDA requires “authorization” (a higher standard than consent for certain processing), we obtain it before processing consumer health data.
• No sale. We do not sell consumer health data and do not engage in any “sale” within the meaning of MHMDA §19.373.005(28).
• Geofencing prohibition. MHMDA prohibits geofencing within 2,000 feet of any in-person healthcare facility for purposes of collecting consumer health data, identifying consumers seeking healthcare, or sending notifications to consumers regarding their consumer health data. We do not engage in any geofencing activity.
• Private right of action. MHMDA violations may be enforced through the Washington Consumer Protection Act, which provides for a private right of action.

To exercise MHMDA rights, contact privacy@thepersonalityproject.com.

3.9 Other states with privacy laws in force

The following states have comprehensive privacy laws in force as of the effective date of this Notice. Rights are substantially similar to Virginia / Colorado (§§3.2 to 3.3): access, correction, deletion, portability, opt-out of targeted advertising / sale / consequential profiling, and consent for sensitive data.

Swipe sideways to see every column

Residents of these states should refer to the rights enumerated under Colorado (§3.2) and exercise them via the process at §2. The respective state attorney general handles escalation.

3.10 Other states coming into force after this Notice’s effective date

Additional state privacy laws are scheduled to come into force after the effective date of this Notice. We will update this Notice as those laws come into effect. If you reside in a state with a comprehensive privacy law that came into force after the effective date of this Notice, the rights granted by that law apply to you and we will respond to requests under it.

4. Canada, Provincial Rights

4.1 Federal baseline (PIPEDA)

PIPEDA applies to our collection, use, and disclosure of personal information of users in Canada in the course of commercial activities. Under PIPEDA, you have the right to:

• Know what personal information we hold about you and how we use it
• Access your personal information and request correction of inaccuracies
• Withdraw consent for processing (subject to legal or contractual restrictions and reasonable notice)
• Challenge our compliance with PIPEDA, in writing, by contacting us (see §6)

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/.

We adhere to the 10 Fair Information Principles in PIPEDA Schedule 1.

4.2 Quebec (Law 25)

Applies to: Quebec residents.

Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25 (formerly Bill 64) and fully in force as of September 2023, supplements PIPEDA with more specific obligations.

Rights of Quebec residents

• Access and correction. As under PIPEDA.
• Express consent for sensitive personal information. For psychometric assessment data, clinical-scale responses, external reference scores, and user-generated content disclosing health or mental-health information, we obtain express, separate consent at the point of collection.
• Automated decision-making transparency. The Service uses automated processing to compute your psychometric scores, match exercises and resources to your profile, and detect crisis-content keywords. None of these are decisions that produce legal or similarly significant effects on you. For more information about how any of these automated processes work, contact privacy@thepersonalityproject.com.
• Data portability. You have the right to receive your personal information in a structured, commonly used technological format and to require us to communicate it to any person or entity you designate. Use the self-serve export in your privacy settings or contact us.
• De-indexing / right to be forgotten. You have the right to require us to cease disseminating your personal information, or to de-index, anonymize, or delete the information, where the dissemination causes you serious injury to your reputation or privacy that outweighs the public interest or the right of others to information.
• Right to know about cross-border transfers. Before transferring your personal information outside Quebec, we assess whether the destination provides adequate protection.
• Right to receive a French response. You may exercise any of these rights in French; we will respond in French.

Privacy Impact Assessment

We conduct Privacy Impact Assessments for new projects or technologies involving the collection, use, or transfer of personal information of Quebec residents, including any project involving an automated decision-making system.

Breach notification

In the event of a confidentiality incident presenting a risk of serious injury, we will notify the Commission d’accès à l’information (CAI) and the affected persons with reasonable diligence, and we maintain a register of confidentiality incidents.

Escalation

If you are not satisfied with our response, you may contact the Commission d’accès à l’information du Québec at https://www.cai.gouv.qc.ca/.

4.3 British Columbia (BC PIPA)

Applies to: BC residents.

The BC Personal Information Protection Act provides rights substantially similar to PIPEDA, with specific provincial consent rules. Notable elements:

• Express, implied, or deemed consent under the BC PIPA framework; we rely on express consent for sensitive data
• Right of access and correction
• Right to withdraw consent at any time
• Right to be informed of the purposes for which personal information is being collected
• Specific BC PIPA breach-notification requirements

Escalation: Office of the Information and Privacy Commissioner for British Columbia at https://www.oipc.bc.ca/.

4.4 Alberta (Alberta PIPA)

Applies to: Alberta residents.

The Alberta Personal Information Protection Act provides rights substantially similar to PIPEDA, with specific Alberta breach-notification provisions. Notable elements:

• Mandatory notification of the Information and Privacy Commissioner of Alberta in cases of incidents involving a real risk of significant harm
• Notification of affected individuals where required by the Commissioner
• Rights of access, correction, and withdrawal of consent

Escalation: Office of the Information and Privacy Commissioner of Alberta at https://www.oipc.ab.ca/.

4.5 Other provinces and territories

In provinces and territories without “substantially similar” private-sector privacy legislation (i.e., everywhere other than Quebec, BC, and Alberta), PIPEDA applies federally. The rights and contact mechanisms described in §4.1 apply.

5. Summary Comparison Table

The following table summarizes the rights available in each US state and Canadian province as of the effective date of this Notice. Where a right is “N/A” (not applicable), it is because Scrawlr does not engage in the practice the right would address.

Swipe sideways to see every column

6. Contact and Authorized Agents

• Email: privacy@thepersonalityproject.com
• Postal: Scrawlr, 1820-999 W Hastings St, Vancouver, BC, Canada, V6C 2W2

Authorized agents

You may designate an authorized agent to exercise rights described in this Notice on your behalf. We require:

• Written documentation of the agent’s authority to act for you (e.g., a power of attorney, a signed authorization, or other proof acceptable in your jurisdiction)
• Verification of your identity through your authenticated account session or account identifier

Agent authorization is jurisdiction-specific (California CCPA, Colorado CPA, and others have specific rules). We comply with the strictest applicable rule. Submit agent documentation to privacy@thepersonalityproject.com with the subject line “Authorized Agent Request” and we will respond with next steps.