US State Privacy Addendum

Effective Date: 10 February 2026 Last Updated: 10 February 2026

This US State Privacy Addendum supplements our Privacy Policy and CCPA/CPRA Privacy Notice with additional disclosures required by state privacy laws beyond California.

1. Applicability

This addendum applies to residents of US states with comprehensive consumer privacy laws. If you are a resident of one of the states listed below, you have specific rights regarding your personal data.

2. Virginia — Consumer Data Protection Act (CDPA)

Effective: January 1, 2023

2.1. Your Rights

• Right to access your personal data
• Right to correct inaccuracies
• Right to delete personal data you have provided
• Right to data portability in a readily usable format
• Right to opt out of targeted advertising, sale of personal data, and profiling that produces legal or similarly significant effects

2.2. Our Practices

• We do not sell personal data as defined by the CDPA
• We do not engage in targeted advertising using third-party data
• We do not profile consumers in a way that produces legal or similarly significant effects
• AI content generation is an automated process that creates content at your direction—it does not profile you

2.3. Data Protection Assessment

We have conducted data protection assessments for processing activities that present a heightened risk of harm, including AI-powered content generation using customer personal data.

2.4. Exercising Rights

Submit requests to support@discoverworthy.com. We will respond within 45 days (extendable by 45 days with notice).

2.5. Right to Appeal

If we deny your request, you may appeal within 60 days. We will respond to your appeal within 60 days. If the appeal is denied, you may file a complaint with the Virginia Attorney General.

3. Colorado — Colorado Privacy Act (CPA)

Effective: July 1, 2023

3.1. Your Rights

• Right to access, correct, delete, and port your personal data
• Right to opt out of targeted advertising, sale, and profiling
• Universal opt-out mechanism: We recognize and honor Global Privacy Control (GPC) signals

3.2. Our Practices

• We do not sell personal data or use it for targeted advertising
• We honor GPC signals sent by your browser as a valid opt-out request
• We have conducted data protection assessments as required

3.3. Exercising Rights

Submit requests to support@discoverworthy.com. Response within 45 days (extendable by 45 days).

3.4. Right to Appeal

If denied, you may appeal. If the appeal is denied, you may contact the Colorado Attorney General.

4. Connecticut — Connecticut Data Privacy Act (CTDPA)

Effective: July 1, 2023

4.1. Your Rights

• Right to access, correct, delete, and port your personal data
• Right to opt out of targeted advertising, sale, and profiling with legal/significant effects
• Universal opt-out mechanism: We recognize GPC signals

4.2. Sensitive Data

Under the CTDPA, sensitive data includes precise geolocation, racial/ethnic origin, religious beliefs, health data, sexual orientation, citizenship status, and genetic/biometric data. We do not collect sensitive data as defined by the CTDPA (our analytics use country-level geolocation only, not precise GPS coordinates).

4.3. Exercising Rights

Submit requests to support@discoverworthy.com. Response within 45 days (extendable by 45 days).

4.4. Right to Appeal

If denied, you may appeal within 60 days. We will respond within 60 days. You may also file a complaint with the Connecticut Attorney General.

5. Utah — Utah Consumer Privacy Act (UCPA)

Effective: December 31, 2023

5.1. Your Rights

• Right to access and delete your personal data
• Right to data portability
• Right to opt out of sale and targeted advertising

Note: Utah does not require data protection assessments or recognition of universal opt-out signals.

5.2. Exercising Rights

Submit requests to support@discoverworthy.com. Response within 45 days (extendable by 45 days).

6. Texas — Texas Data Privacy and Security Act (TDPSA)

Effective: July 1, 2024

6.1. Your Rights

• Right to access, correct, delete, and port your personal data
• Right to opt out of targeted advertising, sale, and profiling
• Universal opt-out mechanism: We recognize GPC signals

6.2. Data Protection Assessments

We have conducted assessments for processing activities that present a heightened risk as required by the TDPSA.

6.3. Exercising Rights

Submit requests to support@discoverworthy.com. Response within 45 days (extendable by 45 days).

6.4. Right to Appeal

If denied, you may appeal. We respond within 60 days. You may contact the Texas Attorney General if dissatisfied.

7. Additional States

The following states have enacted or are implementing comprehensive privacy laws. As these laws take effect, this addendum will be updated:

8. Universal Opt-Out Mechanism

We recognize and honor the Global Privacy Control (GPC) signal as a valid opt-out request for the sale of personal data and targeted advertising, as required by applicable state laws (Colorado, Connecticut, Texas, and others).

To enable GPC:

• Use a browser that supports GPC (e.g., Firefox, Brave)
• Install a GPC-supporting browser extension
• Visit globalprivacycontrol.org for more information

Note: Since we do not sell personal data or engage in targeted advertising, honoring GPC confirms our existing practices rather than changing our behavior.

9. Children's Privacy

We do not knowingly collect personal data from children under 13 (COPPA threshold) or under 16 where required by state law. If you believe we have collected data from a child, contact us immediately at support@discoverworthy.com.

10. Contact Us

For privacy requests or questions:

• Email: support@discoverworthy.com
• Address: 140 Keller Road, ESSENDON NORTH, VIC 3041