Diffbot Privacy Statement for California Residents
Last Updated: April 10, 2023 - Effective: January 1, 2023
Information Diffbot Collects
In the last twelve (12) months, we may have collected the following categories of personal information:
- Identifiers, such as name, Internet Protocol address, email address, including business and/or other email addresses (including “freemails” such as Gmail, Yahoo, Hotmail, etc.), job title and department, phone numbers (general or direct business numbers, faxes, and/or mobile numbers), business-related postal address, and social networking URLs.
- Personal Information Categories Listed in the California Customer Records Statute, such as name, business address, telephone numbers (general or direct business numbers, faxes, and/or mobile numbers), education, employment, employment history, and credit or debit card number.
- Commercial Information, such as products or services purchased.
- Internet or Other Similar Network Activity, such as Internet Protocol address and information on a consumer’s interaction with a website, application, or advertisement.
- Geolocation Data, such as information about your physical location collected from geolocation features on your device, including your IP address.
- Professional or Employment-Related Information, such as email address, including business and/or other email addresses (including “freemails” such as Gmail, Yahoo, Hotmail, etc.), telephone numbers (general or direct business numbers, faxes, and/or mobile numbers), business-related physical address, current or past job history, and title.
- Inferences, which may be drawn from the information identified above to make predictions about your preferences and interests.
- Sensitive Information, such as your Diffbot Dashboard or Leadgraph web app account login and password (if you are a Diffbot or Leadgraph subscriber or trial user). Diffbot only uses sensitive information for the purposes specified in the CPRA and does not collect or process sensitive personal information for purposes of inferring characteristics about consumers.
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing prior notice.
Categories of Sources from which Personal Information is Collected
Diffbot collects personal information from the following categories of sources:
- Publicly available information
- Primary research
- Submissions from Diffbot’s subscribers or trial users
- Third-party data vendors of email and phone contact information
- Directly and indirectly from activity or submissions to the Leadgraph web application
- Directly and indirectly from our subscribers or their representatives
- Directly from vendors and other contractual counterparties
Purposes for Collection, Disclosure, Sharing, and Sale of Personal Information
Diffbot collects, discloses, shares, and sells personal information for the following business and commercial purposes:
- Provide, maintain, and improve the Site
- Verify, cleanse, update, and maintain Business Information and other information provided through the Site
- Provide and deliver the Services, process transactions, and send related information, including communications and invoices
- Send technical notices, updates, security alerts, and support and administrative messages
- Respond to comments, questions, and requests, and provide customer support
- Create Leadgraph or Diffbot Dashboard account(s) and identify users signing in to their account
- Communicate about products, services, offers, promotions, rewards, and events offered by Diffbot and others, and provide news and information
- Monitor and analyze trends, usage, and activities in connection with the Site
- Detect, investigate, and prevent fraud and other illegal activities
- Protect the rights and property of Diffbot, our subscribers, and others
- Personalize and improve the Site
- Consider persons for possible employment with Diffbot, and communicate about employment opportunities or submitted employment applications
- Create aggregated statistical data, inferred non-personal data, or anonymized or pseudonymized data (rendered non-personal and non-identifiable), which we or our business partners or customers may use to provide and improve our respective services
- Comply with our contractual and legal obligations, resolve disputes with users, and enforce our agreements Carry out any other purpose described at the time the information was collected or as otherwise set forth in the CPRA
- Diffbot may disclose personal information to the following third-party recipients for the business and commercial purposes identified above: Service providers
- Diffbot subscribers and trial users
- Diffbot partners
Sale, Sharing, and Disclosure of Personal Information
We sell personal information collected for our database of Search Subjects to our Subscribers. This database may contain information about business personas including name, employer, job title and department, email address, phone number, office address, social media or professional profile link, and work or educational history. This information is sold to Diffbot’s Subscribers for the purpose of business-to-business sales, marketing, and recruiting and is provided subject to license agreements that limit its use to those purposes.
In the preceding twelve (12) months, we have sold or shared the following categories of personal information to Diffbot subscribers, partners, or research affiliates:
- Personal information categories listed in the California Customer Records statute
- Professional or employment-related information
Diffbot may also disclose personal information to its service providers for business purposes necessary for providing functions related to our operation of our business and provision of our applications and services. In the preceding twelve (12) months, we have disclosed for a business purpose the following categories of personal information to our service providers:
- Personal information categories listed in the California Customer Records statute
- Professional or employment-related information
We do not sell or share the personal information of minors under 18 years of age.
A Consumer’s Right to Opt-Out of the Sale or Sharing of Personal Information A consumer has the right to opt-out of the sale or sharing of that consumer’s personal information by Diffbot. Consumers may opt-out of the sale of their information by submitting a request to remove the consumer’s profile or delete the consumer’s data. Contact us by sending an email to email@example.com. In order to submit a request, a consumer or an Authorized Agent will be required to demonstrate that such person has control of an email inbox associated with the profile in question. If such person cannot, then we may be contacted regarding other means of verifying such person’s identity or the authorization of a third party to exercise a consumer’s rights on that consumer’s behalf.
Diffbot may also share Subscriber information with third parties for marketing and advertising purposes. Individuals may opt-out of the sharing of their information by visiting their Diffbot Account.
A Consumer’s Other CPRA Rights and Choices
The CPRA provides consumers with specific rights regarding their personal information. This section describes a consumer’s CPRA rights and explains how to exercise those rights.
Access to Specific Information and Data Portability Rights A consumer has the right to request that we disclose certain information to that consumer about Diffbot’s collection and use of that consumer’s personal information over the past twelve (12) months. Once we receive and confirm a consumer’s verifiable consumer request, we will disclose:
- The categories of personal information we collected about that consumer.
- The categories of sources from which the personal information was collected.
- Our business or commercial purpose for collecting or selling that personal information.
- The categories of third parties with whom we share that personal information.
- The specific pieces of personal information we collected about that consumer (also called a data portability request).
Correction Request Rights A consumer has the right to request that we correct personal information that we maintain about the consumer if it is inaccurate, taking into account the nature of the personal information and the purposes for which it is processed. Once we receive and confirm a consumer’s verifiable consumer request, we will use commercially reasonable efforts to correct the inaccurate personal information. We may require documentation if necessary to confirm the accuracy of the requested correction. We may deny the request if:
- We determine, based on the totality of the circumstances, that the contested personal information is more likely than not accurate as maintained.
- We determine that the requested correction would be impossible or would involve disproportionate effort.
- The requested correction is in conflict with federal or state law.
- We denied the same request to correct within the past six months and the consumer has not provided additional documentation in support of the request.
- We have a good-faith, reasonable, and documented belief that the request to correct is fraudulent or abusive.
In any case, we will inform you of the action we take and, where the request has been denied, the reasons for the denial. Subject to the exceptions given below, a consumer whose request to correct has been denied may be able to exercise a right to delete the contested data.
Deletion Request Rights A consumer has the right to request that Diffbot delete any of his or her personal information that we have collected and retained, subject to certain exceptions. Once we receive and confirm a consumer’s verifiable consumer request, we will delete (and direct our service providers and/or customers to delete) that consumer’s personal information from our records, unless an exception applies.
We may deny a consumer’s deletion request if retaining the information is necessary for us or our service providers or customers to:
- Complete the transaction for which we collected the personal information, fulfill the terms of a product warranty or product recall conducted in accordance with federal law, provide a good or service that a consumer requested, take actions reasonably anticipated within the context of our ongoing business relationship with that consumer, or otherwise perform our contract with that consumer.
- Help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
- Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the ability to complete such research, if a consumer provided informed consent.
- Enable solely internal uses that are reasonably aligned with consumer expectations based on a consumer’s relationship with us and compatible with the context in which the consumer provided the information.
- Comply with a legal obligation.
Exercising Access, Correction, Data Portability, and Deletion Rights To exercise the access, correction, data portability, and deletion rights described above, please submit a verifiable consumer request to us by contacting us at firstname.lastname@example.org
Only a consumer, or a natural person or business entity that a consumer authorizes to act on a consumer’s behalf (an “Authorized Agent”), may make a verifiable consumer request related to a consumer’s personal information. A consumer may also make a verifiable consumer request on behalf of that consumer’s minor child.
A consumer or the consumer’s Authorized Agent may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:
- Provide sufficient information that allows Diffbot to reasonably verify a consumer is the person about whom we collected personal information.
- If an Authorized Agent is being used, provide sufficient proof that the consumer has provided the Authorized Agent with permission to submit the request on the consumer’s behalf, such as signed permission or a power of attorney executed pursuant to California Probate Code Sections 4121 to 4130..
- Describe a consumer’s request with sufficient detail that allows Diffbot to properly understand, evaluate, and respond to it.
We cannot respond to a consumer’s or an Authorized Agent’s request or provide a consumer or Authorized Agent with personal information if we cannot verify the consumer’s or Authorized Agent’s identity and/or authority to make the request and confirm the personal information relates to that consumer. Making a verifiable consumer request does not require a consumer to create an account with us. We will only use personal information provided to us in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
Response Timing and Format We endeavor to respond to a verifiable consumer request within 30 days of its receipt. If we require more time (up to 90 days), we will inform the consumer of the reason and extension period in writing. We will deliver our written response by mail or electronically. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will choose a format to provide a consumer’s personal information that is readily useable and should allow a consumer to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to a consumer’s verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell the consumer why we made that decision and provide the consumer with a cost estimate before completing that consumer’s request.
Non-Discrimination Consumers have the right to not receive discriminatory treatment by a business for exercising their rights under the CPRA. We will not discriminate against a consumer for exercising any CPRA rights.
Deidentified Data To the extent Diffbot may collect or process deidentified data, we will maintain and use the information in deidentified form and will not attempt to reidentify the information, except for the purpose of determining whether our deidentification processes satisfy applicable requirements.
Changes to Our Privacy Statement We reserve the right to amend this privacy statement at our discretion and at any time. When we make material changes to this privacy statement, we will provide notification by email or through a notice on our website homepage.
Consumer Rights Requests Metrics
During the previous calendar year, Diffbot received the following number of requests from residents of California:
Requests to know: RECEIVED = 0
Requests to delete: RECEIVED = 0
Requests to opt-out: RECEIVED = <500, COMPLIED WITH (in Whole or in Part) = all, DENIED = 0, AVG DAYS TO RESPOND = 3
Diffbot Technologies Corp Attn: Privacy Team 333 Ravenswood Ave Menlo Park, CA 94025 Email: email@example.com
This Privacy Statement was last updated on April 10, 2023.