Privacy Notice

Lee Bliss, trading as EquiList.app ("EquiList", "we", "us"), operates an equine transport and marketplace platform serving the United States. This Privacy Notice explains the categories of personal information we collect, how we use it, and your rights under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), and the federal Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506.

1. Categories of personal information we collect (CCPA §1798.140)

• Identifiers: name, email address, account password hash, IP address, profile picture (if Google sign-in is used).
• Commercial information: bid amounts, escrow payments processed through Stripe, subscription tier, ad-quota usage, transport history.
• Internet activity: browser type, device identifier, pages viewed, anonymized analytics (where Google Analytics 4 is enabled, IP truncated per anonymize_ip=true).
• Geolocation data: precise GPS coordinates of carriers while they are "On-Call" (transporter-side only, opt-in).
• Professional / employment information: for carriers — business legal name, USDOT number, MC docket number, state CDL endorsements, vehicle insurance certificate, USDA APHIS license where applicable.
• Inferences: reliability rating derived from completed-job ratings.
• Sensitive personal information (CPRA): we do not intentionally collect Social Security numbers, government IDs (beyond DOT / MC numbers), biometric data, precise health data, or race/ethnicity. Vehicle insurance certificates may incidentally contain a driver's license number — we redact this in our document vault.

2. Purposes of collection (CCPA §1798.100(a)(1))

• Matching shippers with verified carriers within distance-based search radii.
• Dispatching emergency SOS requests and notifying destination equine hospitals.
• Verifying carrier credentials via OCR (federal USDOT registration, MC docket, COI insurance).
• Processing escrow payments and subscriptions via Stripe Connect.
• Operating the marketplace and routing buyer/seller messages.
• Sending transactional emails via Resend.
• Fraud prevention and rule enforcement.

3. Sources of personal information

• Directly from you (account creation, listing posting, document upload).
• Automatically from your device (cookies, server logs).
• From third parties: Google (if you choose Google sign-in), Stripe (payment confirmation), publicly searchable USDOT/FMCSA registers.

4. Sharing & "selling" disclosures

EquiList does not sell or "share" personal information as those terms are defined in CCPA §1798.140(t) and §1798.140(ah) (including cross-context behavioral advertising). We disclose personal information only to:

• The carrier you matched with — name, contact phone, pickup/drop-off ZIP codes, horse details.
• The destination equine hospital on an SOS — horse name, breed, medical history snapshot, live driver position.
• Stripe, Inc. (payments) — a federal money services business and California-licensed money transmitter.
• Resend, Inc. (transactional email).
• Google LLC — Gemini Vision OCR processing of carrier documents you upload (one-shot, no model training).
• Federal, state, or local authorities when legally compelled (subpoena, court order).

5. Retention

• Active account data — kept until account deletion.
• Completed-job records — 7 years (IRS Publication 583 retention guidance).
• SOS records — 7 years for safety auditing.
• Marketplace listings — 12 months after removal.
• Server logs — 90 days rolling.

6. Your CCPA / CPRA rights (California residents)

If you are a California resident you have the right to:

• Right to know what categories of personal information we have collected about you in the prior 12 months (§1798.110).
• Right to delete personal information we have collected (§1798.105), subject to statutory exceptions.
• Right to correct inaccurate personal information (§1798.106).
• Right to opt-out of "sale" / "sharing" (§1798.120) — although we do not sell or share.
• Right to limit use of sensitive personal information (§1798.121).
• Right to non-discrimination for exercising any CCPA right (§1798.125).

To exercise these rights, email support@equilist.app from the email on your account, or write to the postal address in §10 below. We will verify your identity and respond within 45 days (extendable once by 45 days per §1798.130(a)(2)).

If you are dissatisfied with our response you may file a complaint with the California Attorney General's Office at oag.ca.gov/privacy/ccpa or, for the California Privacy Protection Agency, at cppa.ca.gov.

7. Rights for residents of other US states

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have substantively similar rights of access, correction (where applicable), deletion, portability, and opt-out of targeted advertising. We do not engage in targeted advertising or profiling that produces legal or similarly significant effects. Submit requests to the same email address; we respond within 45 days.

8. Children (COPPA, 15 U.S.C. § 6502)

EquiList is not directed to children under 13 and we do not knowingly collect personal information from children under 13. If you believe we have collected such information, email support@equilist.app and we will delete it.

9. Cookies & tracking

We use essential session cookies to keep you signed in. Where Google Analytics 4 is enabled the analytics cookies fire only after you accept the cookie banner. You may set the Global Privacy Control (GPC) signal in your browser; we honor GPC as an opt-out request per CCPA Regulation 7025 even though we do not sell or share personal information.

10. Contact

Data controller: Lee Bliss T/A EquiList.app · United Kingdom. For US privacy inquiries: support@equilist.app.