Last Updated: April 17, 2026
This page supplements our
Privacy Policy for residents of U.S. states with comprehensive privacy statutes. California residents should also consult our
California Privacy Notice.
1. Common Rights
Regardless of the state statute, residents generally have the following rights with respect to personal information we process as a controller:
- Right to access / confirm processing and receive a copy of personal information;
- Right to correct inaccurate personal information;
- Right to delete personal information;
- Right to portability;
- Right to opt out of targeted advertising, “sale” (where applicable), and certain profiling with legal or similarly significant effects;
- Where applicable, the right to appeal a denied request.
2. Global Privacy Control (GPC)
We honor the Global Privacy Control signal as a valid opt-out of targeted advertising and “sale” or “sharing” for all state residents whose law recognizes this mechanism. Learn more at
globalprivacycontrol.org.
3. State-Specific Coverage Summary
The following states have comprehensive privacy statutes that apply to our Processing of their residents' data. Where the statute imposes additional or different requirements, we will honor those requirements for that resident.
| State | Statute | Appeal Right | GPC / Opt-Out Signal |
|---|
| Virginia | Virginia Consumer Data Protection Act (VCDPA) | Yes | Honored |
| Colorado | Colorado Privacy Act (CPA) | Yes | Honored (opt-out preference signal) |
| Connecticut | Connecticut Data Privacy Act (CTDPA) | Yes | Honored |
| Utah | Utah Consumer Privacy Act (UCPA) | No appeal right; rights include access, deletion, portability, opt-out of sale/targeted advertising | Not required; honored as courtesy |
| Texas | Texas Data Privacy and Security Act (TDPSA) | Yes | Honored |
| Oregon | Oregon Consumer Privacy Act (OCPA) | Yes | Honored |
| Montana | Montana Consumer Data Privacy Act (MCDPA) | Yes | Honored |
| Delaware | Delaware Personal Data Privacy Act (DPDPA) | Yes | Honored |
| Iowa | Iowa Consumer Data Protection Act (ICDPA) | No appeal right | Not required |
| Nebraska | Nebraska Data Privacy Act | Yes | Honored |
| New Hampshire | New Hampshire Data Privacy Act | Yes | Honored |
| New Jersey | New Jersey Data Protection Act | Yes | Honored |
| Tennessee | Tennessee Information Protection Act | Yes | Honored |
| Indiana | Indiana Consumer Data Protection Act | Yes | Honored |
| Maryland | Maryland Online Data Privacy Act | Yes | Honored |
| Minnesota | Minnesota Consumer Data Privacy Act | Yes | Honored |
| Rhode Island | Rhode Island Data Transparency and Privacy Protection Act | Yes | Honored |
4. How to Exercise Rights
Submit a request through the self-service portal at
/privacy/request, by email at
privacy@packageretriever.com, or by postal mail at the address listed in our Privacy Policy. We respond within the period required by your state's statute (generally forty-five (45) days, with a possible single extension). Appeal decisions are issued within sixty (60) days where the statute provides an appeal right.
5. Nevada
Nevada residents may submit a verified request to opt out of the “sale” of covered information as defined in Chapter 603A of the Nevada Revised Statutes by emailing
privacy@packageretriever.com. We do not currently sell covered information to third parties to license or sell the information to other persons within the meaning of NRS 603A.
6. Health and Financial Data Laws
We do not knowingly process consumer health data subject to Washington's My Health My Data Act (or comparable Nevada statute). We also do not process data subject to HIPAA or to the Gramm-Leach-Bliley Act as a covered entity. Where our Services incidentally capture data that would be regulated under these laws (for example, a prescription contained in a shipment manifest provided by a Merchant), we process that data as a processor on the Merchant's instructions and in accordance with the DPA.
7. Children
Where applicable state law requires parental opt-in for processing of children's personal information, we do not knowingly engage in such processing. See Section 19 of the Privacy Policy.