Privacy Policy

Version 2026-10-28
Effective: October 28, 2026

1. Who We Are

ExplainmyERMI is a service of Mycolytica LLC, a Texas limited liability company doing business as ExplainmyERMI and headquartered in Williamson County, Texas (the "Company," "ExplainmyERMI," "we," "us," "our"). For purposes of applicable data privacy laws, the Company is the controller of the personal data described in this Policy. We can be reached at:

General: hello@explainmyermi.com
Privacy / data requests: privacy@explainmyermi.com
Legal / records requests: legal@mycolytica.com

This Privacy Policy describes the personal information we collect, how we use and share it, and the choices you have. It applies to the website at explainmyermi.com and to any service, report, or product we provide through it (collectively, the "Service").

This Policy is a notice of our practices. It is referred to in, but is not part of, our Terms of Service. Capitalized terms used here have the meanings given in the Terms.

2. Information We Collect

We collect only what we need to deliver the Service, support customers, comply with legal obligations, and defend against claims.

2.1 Information you provide

When you place an order:

Email address. Required so we can deliver your Report PDF and order confirmation.
Lab values you transcribe from your existing ERMI laboratory report. The 36 mold-species concentrations or "ND" entries.
Your name (optional). If you give it, we use it to address your Report and our emails.
Sample details. A label you choose for each sample, the sample date, how much of the building the sample covers, which rooms were sampled, and where the sample came from: a U.S. ZIP code (used for climate context) or, for a sample outside the United States, the town you enter and its approximate map coordinates.
Building details you choose to give. For example: year built, building type, foundation and crawlspace, heating, cooling, and ventilation, dehumidifier use, approximate size, number of floors and of occupants, HVAC age, basement finish, ductwork location, indoor humidity readings, past water events such as leaks or flooding, and tiled wet areas. These shape the building-related sections of your Report.
Acceptance evidence. A timestamped record that you checked the box agreeing to the Terms and Disclaimer at checkout, including the version identifier and content hash of the documents you accepted, the page URL where you accepted, your IP address, and your user-agent string. This record is part of our legal defense file.
Lab report PDF (optional upload). If you choose to use the optional "upload your lab PDF" feature on the order form, the PDF file itself is uploaded to our servers so our parser can read the species values, sample date, and ZIP code and pre-fill them for you to review. Lab reports usually show other details too, such as the address where the sample was taken; our parser may read that address as well, and it is kept with the upload's record and deleted with the file (Section 5). You see a brief notice and check an acknowledgment box before the upload begins. When you upload, we record the time, your IP address and browser user-agent, and which version of the upload notice you acknowledged. If you have already entered your email or name in the form, those may be associated with the upload so we can match it to your order. Uploaded PDFs are retained according to the schedule in Section 5, and you may request earlier deletion at any time (see Section 6).

Your sample label is printed on your Report and kept in our seven-year order archive, which cannot be edited or deleted (Section 5), so anything you put in it, such as an address, stays there for that period.

2.1A Other information you give us

Professional and creator applications. If you apply through our free-report program for professionals and creators, we collect your name, email, role, organization, a description of who you work with or reach, and what you would run a report on.
Feedback. If you fill out our feedback form, we collect your answers, any comments you write, and your email address if you choose to give it.
Messages to us. If you email us, we receive your email address, the message, and anything you attach.
Outreach contacts. We keep a list of people we may contact about the Service, such as customers, program applicants, and professionals who have told us they want to hear from us. For each, we keep contact details, how they reached us, notes about our correspondence, whether they have joined our mailing list or unsubscribed, and a tracking code used in the links we email them (Section 2.3).

2.2 Information from your payment processor

Stripe processes payments for us. Stripe collects payment-card data directly. We do not receive or store your card number.

Stripe's payment page asks for the name on your card and your billing address. When you pay, Stripe sends us payment confirmation data: the transaction ID, the last four digits of the card, the name on the card, your billing address (street, city, state, ZIP code, and country), the amount paid, any sales tax charged, and whether the payment succeeded. We use this data to reconcile your order and to calculate, collect, and report sales tax. Orders with a Texas billing address are charged Texas sales tax.

2.3 Information collected automatically

When you visit the Site:

Server logs. IP address, request paths, response codes, timestamps, browser user-agent, and referring URL. Used for operational monitoring, security, and abuse prevention. Kept by our hosting provider for a short rolling period (currently between 7 and 30 days, depending on our plan), then deleted.
Cookies and local storage. We use a minimal set of first-party storage mechanisms to run the Service. Your in-progress order and wizard answers are saved in your browser's local storage so that reloading the page does not lose your work, and small interface preferences (such as your preferred PDF zoom level) are stored the same way. We do not use third-party advertising cookies, cross-context behavioral advertising, or any third-party analytics or marketing service.
First-party analytics. We operate our own privacy-preserving analytics to understand how visitors find and move through the Site: for example, which pages are viewed and how far visitors get in the checkout flow. This uses a randomly generated identifier stored in your browser's local storage; the identifier does not itself contain your name, email, or other personal information. For each event we record the page path (with any query string removed), the referring site's hostname (not the full URL), a coarse traffic-source category (direct, search, social, or referral), and checkout-flow milestones. If you reach the Site through a marketing link we have tagged, we also record the campaign tags carried in that link (the standard utm_source, utm_medium, utm_campaign, utm_content, and utm_term values, or a short ref code) so we can tell which of our own links or posts brought you here; we capture only those known tags, never the rest of the web address. If we email you directly (for example, after you request a free report), the links in that email may include a code unique to you, so that if you click through we can recognize that you came back and connect that visit to your contact record with us. This applies only to people we email; anonymous visitors are not identified this way. We may also give a customer a personal link to share with others; if someone visits or places an order through that link, we count it toward the customer who shared it (the person who clicks the shared link is not identified to us by it). We do not store your IP address, device, or location with these events. For a browsing session that results in an order, we may associate that session's activity with the resulting order so we can measure how customers complete a purchase. This data is first-party only: we do not use it for advertising or profiling, and we do not share it with third parties or advertising networks.
Bot protection at checkout. When you place an order, the checkout page runs Cloudflare Turnstile, a security check that helps us block automated abuse. Turnstile sends Cloudflare technical information about your connection and browser (your IP address, browser user-agent, and a connection fingerprint) so Cloudflare can tell a person from an automated script. It is not used to identify you, build a profile, or show you ads. We receive only a pass or fail result. Cloudflare handles this information under its Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/), and you may send requests about it to us.

2.4 What we do not collect

The Service is intended for adults 18 and over and is not directed to children. We do not knowingly collect personal information from children under 13.
We do not track your device's location. Our order form does not ask for your street address. Your billing address reaches us from Stripe when you pay (Section 2.2). An address can also reach us if it appears on a lab report you upload (Section 2.1) or if you type one into a sample label (Section 2.1).
We do not collect biometric information, and we do not ask for health information about you or anyone else. Do not include health details, or any other sensitive personal information you would not want stored as part of your order record, in a sample label or other free-text field.
We do not collect "sensitive personal data," "sensitive personal information," or "sensitive data" as those terms are defined under applicable state privacy laws (including, without limitation, biometric data, genetic data, precise geolocation data, racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sexuality, citizenship or immigration status, and personal data of children under thirteen). ZIP code is not "precise geolocation data" under any applicable state privacy law, which generally defines that term to require resolution within approximately 1,750 feet. We do not collect location data from your device; an address on a lab report or in a sample label identifies the building that was sampled, not where you are. Your billing address is an address you type in, not location data from your device.

3. How We Use Your Information

We use the information described above to:

Generate and re-generate your customized PDF Report.
Send you transactional emails (order confirmation, Report delivery, refund correspondence, security or service notices).
Provide customer support related to your order.
Maintain a legal record of your acceptance of the Terms and Disclaimer.
Maintain order, payment, and submission records as required by these Terms, applicable law, and our retention policy (Section 5).
Calculate, collect, and report sales tax, and keep the tax records the law requires.
Detect, prevent, and respond to fraud, abuse, security incidents, and unlawful or harmful activity.
Comply with legal obligations, respond to legal process, and assert or defend legal claims.
Generate aggregate, de-identified statistics that cannot reasonably be linked back to you (for product improvement and internal research).
Send promotional email about the Service, including offers and coupon codes, to customers and to people who have asked to hear from us, unless they have unsubscribed.
Run our free-report program for professionals and creators, and follow up on feedback you send us.
Measure which of our emails, links, and referral codes bring visitors and orders (Section 2.3).

We do not sell or rent personal information. We do not share personal information with third parties for those parties' direct-marketing purposes.

We share personal information only with the following categories of recipients, only as needed for the purposes described above:

Recipient	What they do for us
Payment processor (Stripe, Inc.)	Runs the checkout payment page, processes your card payment, and calculates sales tax from your billing address.
Hosting provider	Runs the Site, the report-generation service, and our database, including its backups.
Cloud storage provider	Stores your order archive (locked for seven years; see Section 5), your Report PDFs, and any lab PDFs you upload (deleted about 90 days after upload; see Section 5).
Email delivery service	Sends our email (order and Report emails, and promotional email to people who have not unsubscribed) and tells us when a message bounces or is reported as spam.
Email hosting provider	Hosts our email accounts, so it receives and stores the messages you send us and our replies.
Bot-protection service	Runs the bot check on the checkout page (see Section 2.3).

Our hosting, cloud storage, email delivery, and email hosting providers process personal information on our behalf under contracts that limit their use of it to providing their services to us. Our payment processor and bot-protection service also use some of the information they receive for their own security and fraud-prevention purposes, as their own privacy policies describe (for Stripe, see https://stripe.com/privacy). To build the climate section of your Report, our servers also look up historical weather for your sample's area from a public weather service; only a place name or approximate map coordinates are sent, never your name, email, or IP address.

We may also disclose personal information:

In response to a subpoena, court order, or other valid legal process, or where we have a good-faith belief that disclosure is required by law or necessary to protect our rights, your safety, or the safety of others.
To a tax authority when the law requires it, for example during a sales tax audit.
In connection with a corporate transaction (merger, acquisition, financing, sale of assets, reorganization, bankruptcy), in which case continuity of this Policy will be a condition of the transaction.

5. Data Retention

We retain different categories of data for different periods:

Order submissions and acceptance records: seven (7) years from the date you submit an order, whether or not payment is completed. When you click to place an order, we write a copy of what you submitted and of your acceptance of the Terms and Disclaimer to a locked archive before you are sent to the payment page. This window covers the longest plausible Texas statute-of-limitations exposure (including discovery-rule extensions) for breach-of-contract, fraud, DTPA, and product-related claims, and aligns with the California UCL's four-year window plus a discovery buffer. Records include your email, Submission Data, the generated Report PDF (if any), the versions of the Terms and Disclaimer you accepted, and the acceptance details in Section 2.1.
Payment records (the payment confirmation data Stripe sends us, including the name on your card and your billing address; Section 2.2): seven (7) years from your order. Texas law requires us to keep sales tax records for at least four years.
Uploaded lab report PDFs: up to ninety (90) days from upload, then automatically deleted, except (i) where you ask us to delete the file sooner (see Section 6), or (ii) where applicable law, regulation, subpoena, court order, or other valid legal process requires us to preserve the file longer (in which case the legal-hold provisions of this Section apply). After the file is deleted, we keep the values our parser read from it (the laboratory name, sample date, ZIP code, and species values) for parser improvement and research, without your name, email, IP address, browser information, file name, or the file itself. We maintain this data in de-identified form, we will not attempt to re-identify it, and we require anyone we share it with to do the same.
Server logs: kept by our hosting provider for a short rolling period (currently between 7 and 30 days, depending on our plan), then deleted.
First-party analytics events: the pageview and checkout-flow events described in Section 2.3 are retained on an ongoing basis as site- and conversion-trend data. They carry no IP address, user-agent, or precise location, and the random browser identifier attached to them does not itself identify you. Events that arrive through a link we emailed to you, or through a customer's personal referral link, carry that link's code and can be connected to the customer or contact the code belongs to.
Email correspondence (messages you send us, and our copies of emails we send you): for the same seven-year window if it relates to an order; otherwise up to three (3) years.
Outreach contacts and mailing-list records: for as long as we keep in touch with you. If you unsubscribe, we keep your email address and the date you unsubscribed so that we do not email you again.
Feedback and program applications: up to three (3) years after you submit them, unless they become part of an order record.
Aggregate, de-identified statistics: indefinite, because they are not personal information.

Records under legal hold (e.g., upon notice of an actual or threatened claim, subpoena, or regulatory inquiry) are retained beyond the standard window until the matter resolves and the hold is released. When a record is subject to a legal hold from a third party (e.g., subpoena, court order, or regulatory inquiry), we will notify you unless prohibited from doing so by the order itself or by applicable law, and will retain the record until the hold is released.

The submission archive is stored in cloud storage under a compliance-mode retention lock for the retention period. This is an immutability mechanism: once written, an archived submission cannot be modified or deleted, by us or by anyone else, until the lock expires. This protects the integrity of the legal-defense record.

6. Your Choices and Rights

Regardless of where you live, you may:

Access your data. Email privacy@explainmyermi.com from the address used to place your order. We will provide a copy of the personal information we hold about you in a portable format.
Correct your data. Email us with the correction. We will update operational records. Note that the immutable archive (Section 5) cannot be altered; we will append a correction record alongside the original.
Delete your data. Email us. We will delete personal information from operational records to the extent we can do so consistent with our legal obligations, but we may continue to retain records that are subject to the seven-year retention window or to a legal hold. We will let you know what we cannot delete and why.
Delete an uploaded lab report PDF before the 90-day window expires. Reply to your order-confirmation email or contact privacy@explainmyermi.com. We will delete the uploaded file from our storage, except any file that is at that moment subject to a legal hold. Note that the values the parser extracted from it (the species numbers, sample date, ZIP code, lab name) become part of your order record (Section 5, seven-year retention); that retention obligation is separate from the uploaded file itself.
Unsubscribe from promotional email. Every promotional email we send includes an unsubscribe link, and we honor unsubscribes promptly. Unsubscribing does not stop transactional email about an order you placed (order confirmation, Report delivery, and security or service notices), which we need to send to provide the Service.

Do Not Track. Some browsers send a "Do Not Track" signal. We do not track visitors across other websites or let third parties do so on our Site, so there is nothing for the signal to turn off; the Site works the same whether or not your browser sends it.

7. California Residents

ExplainmyERMI complies with the California Online Privacy Protection Act ("CalOPPA"), which applies to any commercial website that collects personal information from California residents regardless of business size or revenue.

What we collect, use, and share is described in Sections 2, 3, and 4 above.
How you review and change your information is described in Section 6.
Notice of changes: we will post a new effective date at the top of this Policy when we update it, and we will note material changes in the changelog at Section 14.
Do Not Track: see Section 6 above.

The California Consumer Privacy Act / California Privacy Rights Act ("CCPA / CPRA") imposes additional obligations on businesses that meet certain revenue or volume thresholds. ExplainmyERMI does not currently meet any of those thresholds. If we begin to, we will update this Policy and provide CCPA-mandated notices, including:

A right-to-know request channel.
A right-to-delete request channel.
A right-to-correct request channel.
A right-to-opt-out-of-sale or sharing channel (although we do not sell or share personal information for cross-context behavioral advertising).
A right against discrimination for exercising any of these rights.

In the meantime, if you are a California resident and you would like to exercise any of these rights informally, email privacy@explainmyermi.com and we will treat your request as if CCPA applied.

Shine the Light (Cal. Civ. Code § 1798.83). California residents may request information about whether we share personal information with third parties for those parties' direct-marketing purposes. We do not. To inquire, email privacy@explainmyermi.com.

8. State-Specific Consumer Privacy Rights

Many U.S. states have enacted comprehensive consumer-privacy statutes. Based on our size and practices, we believe none of them currently applies to ExplainmyERMI, and where a statute has a small-business exemption, we qualify for it. We nonetheless extend the rights described in this Section to residents of every U.S. state as a matter of policy and good faith.

You may exercise these rights by emailing privacy@explainmyermi.com from the address associated with your order. We will respond within forty-five (45) days, with one (1) additional forty-five (45)-day extension if reasonably necessary, in which case we will notify you of the extension.

In this Section, "personal information" (also referred to as "personal data" under certain state privacy laws) has the meaning given in Section 2 of this Policy.

Texas Residents (TDPSA, Tex. Bus. & Com. Code Ch. 541)

ExplainmyERMI is a small business as defined by the United States Small Business Administration and is therefore exempt from the substantive obligations of the Texas Data Privacy and Security Act under Tex. Bus. & Com. Code § 541.002. We do not sell personal information of any kind, including sensitive personal data; consequently, the only obligation the small-business exemption preserves (i.e., not to sell sensitive personal data without consent) is satisfied by the simple fact that we do not sell data.

As a matter of policy, we extend Texas residents the rights TDPSA confers on consumers of in-scope controllers: the right to access, correct, delete, and obtain a portable copy of personal information; the right to opt out of the sale of personal information; the right to opt out of processing for targeted advertising; and the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal information and do not engage in targeted advertising or profiling.

Residents of Other States

Wherever you live in the United States, you may ask us to confirm whether we hold personal information about you, to give you a copy of it in a portable format, to correct it, and to delete it (subject to Section 5), and you may opt out of any sale of personal information, targeted advertising, or profiling that produces legal or similarly significant effects (we do none of these). These requests follow the timeline described above, and you may appeal any denial under Section 9. If a state's law gives you additional rights that apply to us, we will honor them. This Section is in addition to the rights described in Section 6 (Your Choices and Rights), which apply to all users regardless of residence.

Universal Opt-Out Mechanism (Global Privacy Control)

We do not sell personal information or use it for targeted advertising. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of any sale or targeted advertising, and we also turn off our own site analytics for your browser: no analytics identifier is created and no page views are recorded.

9. Appeals

If we deny a request you make under Section 8 (or under Section 6, in the case of requests that overlap), you may appeal that decision by replying to our denial email within sixty (60) days. We will respond to your appeal in writing within sixty (60) days of receipt, explaining the basis for our decision.

If we deny your appeal, you may submit a complaint to the attorney general of your state. Texas residents may file a complaint with the Texas Attorney General's Consumer Protection Division at texasattorneygeneral.gov/consumer-protection/file-consumer-complaint. Residents of other states may contact their state attorney general's office through that office's published consumer-complaint channel.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child has provided us personal information, email privacy@explainmyermi.com.

11. International Users and Cross-Border Transfers

ExplainmyERMI is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. Data-protection laws in the United States may not be equivalent to those in your country of residence.

The Service is offered to people who live in the United States. You may order a Report for a sample taken from a property anywhere, but if you live outside the United States, please do not use the Service.

12. Security

We use commercially reasonable technical and organizational safeguards, including:

TLS encryption for data in transit between your browser, our servers, and our service providers.
Encryption at rest for our database and for the files we store.
Access to personal information limited to the Company, with each part of the Service given only the access it needs.
A locked archive of order and acceptance records that cannot be altered or deleted during its retention period (Section 5).
Automated database backups maintained by our hosting provider.
Bot protection and rate limits on the order form and other public forms.

These safeguards are intended to provide reasonable administrative, technical, and physical protection appropriate to our size, the nature and scope of our activities, and the sensitivity of the personal information we hold, consistent with applicable data-security laws.

No system is perfectly secure. If you become aware of a security issue affecting the Service, email security@explainmyermi.com.

Breach notification. If we determine that an unauthorized party has accessed or acquired (or we reasonably believe has accessed or acquired) personal information we hold about you in a manner that compromises its security, confidentiality, or integrity, we will notify you, and any attorneys general, regulators, or other parties to whom notice is required, in accordance with applicable data-breach-notification laws. We will provide notice without unreasonable delay and within the time limits set by applicable law (for example, 30 days under California law and 60 days under Texas law), subject only to delays that law enforcement requests or that applicable law permits while we determine the scope of the incident and secure our systems.

13. Third-Party Links

The Site and the Report may contain links to third-party websites (peer-reviewed papers, EPA pages, manufacturer documentation, etc.). We do not control those sites and are not responsible for their privacy practices. Review the privacy policy of any third-party site before providing it personal information.

14. Changes to This Policy

We may update this Policy from time to time. The current effective date is at the top of this document. Material changes will be reflected in a brief changelog (date, summary). Changes to this Policy apply only to information we collect after the change takes effect. We will not apply a material change to information we already hold without your consent where the law requires it.

Effective	Change
2026-10-27	Initial version.
2026-10-28	Stripe's payment page now asks for your billing address, and Stripe sends it to us, so we can charge Texas sales tax. We also receive the name on your card. Sections 2.2, 2.4, 3, 4, and 5 updated.

15. Contact

For questions, requests, or complaints about this Policy or our data practices:

privacy@explainmyermi.com

Mycolytica LLC d/b/a ExplainmyERMI
5900 Balcones Drive STE 100, Austin, TX 78731
Principal place of business: Williamson County, Texas

Show the exact stored text (version 2026-10-28)

# Privacy Policy

**Version 2026-10-28**
**Effective: October 28, 2026**

## 1. Who We Are

ExplainmyERMI is a service of **Mycolytica LLC**, a Texas limited liability company doing business as ExplainmyERMI and headquartered in Williamson County, Texas (the "**Company**," "**ExplainmyERMI**," "**we**," "**us**," "**our**"). For purposes of applicable data privacy laws, the Company is the controller of the personal data described in this Policy. We can be reached at:

- General: hello@explainmyermi.com
- Privacy / data requests: privacy@explainmyermi.com
- Legal / records requests: legal@mycolytica.com

This Policy is a notice of our practices. It is referred to in, but is not part of, our **Terms of Service**. Capitalized terms used here have the meanings given in the Terms.

## 2. Information We Collect

We collect only what we need to deliver the Service, support customers, comply with legal obligations, and defend against claims.

### 2.1 Information you provide

When you place an order:

- **Email address.** Required so we can deliver your Report PDF and order confirmation.
- **Lab values you transcribe from your existing ERMI laboratory report.** The 36 mold-species concentrations or "ND" entries.
- **Your name (optional).** If you give it, we use it to address your Report and our emails.
- **Sample details.** A label you choose for each sample, the sample date, how much of the building the sample covers, which rooms were sampled, and where the sample came from: a U.S. ZIP code (used for climate context) or, for a sample outside the United States, the town you enter and its approximate map coordinates.
- **Building details you choose to give.** For example: year built, building type, foundation and crawlspace, heating, cooling, and ventilation, dehumidifier use, approximate size, number of floors and of occupants, HVAC age, basement finish, ductwork location, indoor humidity readings, past water events such as leaks or flooding, and tiled wet areas. These shape the building-related sections of your Report.
- **Acceptance evidence.** A timestamped record that you checked the box agreeing to the Terms and Disclaimer at checkout, including the version identifier and content hash of the documents you accepted, the page URL where you accepted, your IP address, and your user-agent string. This record is part of our legal defense file.
- **Lab report PDF (optional upload).** If you choose to use the optional "upload your lab PDF" feature on the order form, the PDF file itself is uploaded to our servers so our parser can read the species values, sample date, and ZIP code and pre-fill them for you to review. Lab reports usually show other details too, such as the address where the sample was taken; our parser may read that address as well, and it is kept with the upload's record and deleted with the file (Section 5). You see a brief notice and check an acknowledgment box before the upload begins. When you upload, we record the time, your IP address and browser user-agent, and which version of the upload notice you acknowledged. If you have already entered your email or name in the form, those may be associated with the upload so we can match it to your order. Uploaded PDFs are retained according to the schedule in Section 5, and you may request earlier deletion at any time (see Section 6).

### 2.1A Other information you give us

- **Professional and creator applications.** If you apply through our free-report program for professionals and creators, we collect your name, email, role, organization, a description of who you work with or reach, and what you would run a report on.
- **Feedback.** If you fill out our feedback form, we collect your answers, any comments you write, and your email address if you choose to give it.
- **Messages to us.** If you email us, we receive your email address, the message, and anything you attach.
- **Outreach contacts.** We keep a list of people we may contact about the Service, such as customers, program applicants, and professionals who have told us they want to hear from us. For each, we keep contact details, how they reached us, notes about our correspondence, whether they have joined our mailing list or unsubscribed, and a tracking code used in the links we email them (Section 2.3).

### 2.2 Information from your payment processor

Stripe processes payments for us. Stripe collects payment-card data directly. We do not receive or store your card number.

### 2.3 Information collected automatically

When you visit the Site:

- **Server logs.** IP address, request paths, response codes, timestamps, browser user-agent, and referring URL. Used for operational monitoring, security, and abuse prevention. Kept by our hosting provider for a short rolling period (currently between 7 and 30 days, depending on our plan), then deleted.
- **Cookies and local storage.** We use a minimal set of first-party storage mechanisms to run the Service. Your in-progress order and wizard answers are saved in your browser's local storage so that reloading the page does not lose your work, and small interface preferences (such as your preferred PDF zoom level) are stored the same way. We do not use third-party advertising cookies, cross-context behavioral advertising, or any third-party analytics or marketing service.
- **First-party analytics.** We operate our own privacy-preserving analytics to understand how visitors find and move through the Site: for example, which pages are viewed and how far visitors get in the checkout flow. This uses a randomly generated identifier stored in your browser's local storage; the identifier does not itself contain your name, email, or other personal information. For each event we record the page path (with any query string removed), the referring site's hostname (not the full URL), a coarse traffic-source category (direct, search, social, or referral), and checkout-flow milestones. If you reach the Site through a marketing link we have tagged, we also record the campaign tags carried in that link (the standard `utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, and `utm_term` values, or a short `ref` code) so we can tell which of our own links or posts brought you here; we capture only those known tags, never the rest of the web address. If we email you directly (for example, after you request a free report), the links in that email may include a code unique to you, so that if you click through we can recognize that you came back and connect that visit to your contact record with us. This applies only to people we email; anonymous visitors are not identified this way. We may also give a customer a personal link to share with others; if someone visits or places an order through that link, we count it toward the customer who shared it (the person who clicks the shared link is not identified to us by it). We do **not** store your IP address, device, or location with these events. For a browsing session that results in an order, we may associate that session's activity with the resulting order so we can measure how customers complete a purchase. This data is first-party only: we do not use it for advertising or profiling, and we do not share it with third parties or advertising networks.
- **Bot protection at checkout.** When you place an order, the checkout page runs Cloudflare Turnstile, a security check that helps us block automated abuse. Turnstile sends Cloudflare technical information about your connection and browser (your IP address, browser user-agent, and a connection fingerprint) so Cloudflare can tell a person from an automated script. It is not used to identify you, build a profile, or show you ads. We receive only a pass or fail result. Cloudflare handles this information under its Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/), and you may send requests about it to us.

### 2.4 What we do not collect

- The Service is intended for adults 18 and over and is not directed to children. We do not knowingly collect personal information from children under 13.
- We do not track your device's location. Our order form does not ask for your street address. Your billing address reaches us from Stripe when you pay (Section 2.2). An address can also reach us if it appears on a lab report you upload (Section 2.1) or if you type one into a sample label (Section 2.1).
- We do not collect biometric information, and we do not ask for health information about you or anyone else. **Do not include health details, or any other sensitive personal information you would not want stored as part of your order record, in a sample label or other free-text field.**
- We do not collect "sensitive personal data," "sensitive personal information," or "sensitive data" as those terms are defined under applicable state privacy laws (including, without limitation, biometric data, genetic data, precise geolocation data, racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sexuality, citizenship or immigration status, and personal data of children under thirteen). ZIP code is **not** "precise geolocation data" under any applicable state privacy law, which generally defines that term to require resolution within approximately 1,750 feet. We do not collect location data from your device; an address on a lab report or in a sample label identifies the building that was sampled, not where you are. Your billing address is an address you type in, not location data from your device.

## 3. How We Use Your Information

We use the information described above to:

- Generate and re-generate your customized PDF Report.
- Send you transactional emails (order confirmation, Report delivery, refund correspondence, security or service notices).
- Provide customer support related to your order.
- Maintain a legal record of your acceptance of the Terms and Disclaimer.
- Maintain order, payment, and submission records as required by these Terms, applicable law, and our retention policy (Section 5).
- Calculate, collect, and report sales tax, and keep the tax records the law requires.
- Detect, prevent, and respond to fraud, abuse, security incidents, and unlawful or harmful activity.
- Comply with legal obligations, respond to legal process, and assert or defend legal claims.
- Generate aggregate, de-identified statistics that cannot reasonably be linked back to you (for product improvement and internal research).
- Send promotional email about the Service, including offers and coupon codes, to customers and to people who have asked to hear from us, unless they have unsubscribed.
- Run our free-report program for professionals and creators, and follow up on feedback you send us.
- Measure which of our emails, links, and referral codes bring visitors and orders (Section 2.3).

We do not sell or rent personal information. We do not share personal information with third parties for those parties' direct-marketing purposes.

## 4. How We Share Your Information

We share personal information only with the following categories of recipients, only as needed for the purposes described above:

| Recipient | What they do for us |
|---|---|
| **Payment processor** (Stripe, Inc.) | Runs the checkout payment page, processes your card payment, and calculates sales tax from your billing address. |
| **Hosting provider** | Runs the Site, the report-generation service, and our database, including its backups. |
| **Cloud storage provider** | Stores your order archive (locked for seven years; see Section 5), your Report PDFs, and any lab PDFs you upload (deleted about 90 days after upload; see Section 5). |
| **Email delivery service** | Sends our email (order and Report emails, and promotional email to people who have not unsubscribed) and tells us when a message bounces or is reported as spam. |
| **Email hosting provider** | Hosts our email accounts, so it receives and stores the messages you send us and our replies. |
| **Bot-protection service** | Runs the bot check on the checkout page (see Section 2.3). |

We may also disclose personal information:

- In response to a subpoena, court order, or other valid legal process, or where we have a good-faith belief that disclosure is required by law or necessary to protect our rights, your safety, or the safety of others.
- To a tax authority when the law requires it, for example during a sales tax audit.
- In connection with a corporate transaction (merger, acquisition, financing, sale of assets, reorganization, bankruptcy), in which case continuity of this Policy will be a condition of the transaction.

## 5. Data Retention

We retain different categories of data for different periods:

- **Order submissions and acceptance records**: **seven (7) years** from the date you submit an order, **whether or not payment is completed**. When you click to place an order, we write a copy of what you submitted and of your acceptance of the Terms and Disclaimer to a locked archive before you are sent to the payment page. This window covers the longest plausible Texas statute-of-limitations exposure (including discovery-rule extensions) for breach-of-contract, fraud, DTPA, and product-related claims, and aligns with the California UCL's four-year window plus a discovery buffer. Records include your email, Submission Data, the generated Report PDF (if any), the versions of the Terms and Disclaimer you accepted, and the acceptance details in Section 2.1.
- **Payment records** (the payment confirmation data Stripe sends us, including the name on your card and your billing address; Section 2.2): **seven (7) years** from your order. Texas law requires us to keep sales tax records for at least four years.
- **Uploaded lab report PDFs**: **up to ninety (90) days** from upload, then automatically deleted, except (i) where you ask us to delete the file sooner (see Section 6), or (ii) where applicable law, regulation, subpoena, court order, or other valid legal process requires us to preserve the file longer (in which case the legal-hold provisions of this Section apply). After the file is deleted, we keep the values our parser read from it (the laboratory name, sample date, ZIP code, and species values) for parser improvement and research, without your name, email, IP address, browser information, file name, or the file itself. We maintain this data in de-identified form, we will not attempt to re-identify it, and we require anyone we share it with to do the same.
- **Server logs**: kept by our hosting provider for a short rolling period (currently between 7 and 30 days, depending on our plan), then deleted.
- **First-party analytics events**: the pageview and checkout-flow events described in Section 2.3 are retained on an ongoing basis as site- and conversion-trend data. They carry no IP address, user-agent, or precise location, and the random browser identifier attached to them does not itself identify you. Events that arrive through a link we emailed to you, or through a customer's personal referral link, carry that link's code and can be connected to the customer or contact the code belongs to.
- **Email correspondence** (messages you send us, and our copies of emails we send you): for the same seven-year window if it relates to an order; otherwise up to three (3) years.
- **Outreach contacts and mailing-list records**: for as long as we keep in touch with you. If you unsubscribe, we keep your email address and the date you unsubscribed so that we do not email you again.
- **Feedback and program applications**: up to three (3) years after you submit them, unless they become part of an order record.
- **Aggregate, de-identified statistics**: indefinite, because they are not personal information.

The submission archive is stored in cloud storage under a **compliance-mode retention lock** for the retention period. This is an immutability mechanism: once written, an archived submission cannot be modified or deleted, by us or by anyone else, until the lock expires. This protects the integrity of the legal-defense record.

## 6. Your Choices and Rights

Regardless of where you live, you may:

- **Access your data.** Email privacy@explainmyermi.com from the address used to place your order. We will provide a copy of the personal information we hold about you in a portable format.
- **Correct your data.** Email us with the correction. We will update operational records. Note that the immutable archive (Section 5) cannot be altered; we will append a correction record alongside the original.
- **Delete your data.** Email us. We will delete personal information from operational records to the extent we can do so consistent with our legal obligations, but we may continue to retain records that are subject to the seven-year retention window or to a legal hold. We will let you know what we cannot delete and why.
- **Delete an uploaded lab report PDF before the 90-day window expires.** Reply to your order-confirmation email or contact **privacy@explainmyermi.com**. We will delete the uploaded file from our storage, except any file that is at that moment subject to a legal hold. Note that the values the parser extracted from it (the species numbers, sample date, ZIP code, lab name) become part of your order record (Section 5, seven-year retention); that retention obligation is separate from the uploaded file itself.
- **Unsubscribe from promotional email.** Every promotional email we send includes an unsubscribe link, and we honor unsubscribes promptly. Unsubscribing does not stop transactional email about an order you placed (order confirmation, Report delivery, and security or service notices), which we need to send to provide the Service.

**Do Not Track.** Some browsers send a "Do Not Track" signal. We do not track visitors across other websites or let third parties do so on our Site, so there is nothing for the signal to turn off; the Site works the same whether or not your browser sends it.

## 7. California Residents

ExplainmyERMI complies with the California Online Privacy Protection Act ("**CalOPPA**"), which applies to any commercial website that collects personal information from California residents regardless of business size or revenue.

- **What we collect, use, and share** is described in Sections 2, 3, and 4 above.
- **How you review and change your information** is described in Section 6.
- **Notice of changes**: we will post a new effective date at the top of this Policy when we update it, and we will note material changes in the changelog at Section 14.
- **Do Not Track**: see Section 6 above.

The California Consumer Privacy Act / California Privacy Rights Act ("**CCPA / CPRA**") imposes additional obligations on businesses that meet certain revenue or volume thresholds. ExplainmyERMI does not currently meet any of those thresholds. If we begin to, we will update this Policy and provide CCPA-mandated notices, including:

- A right-to-know request channel.
- A right-to-delete request channel.
- A right-to-correct request channel.
- A right-to-opt-out-of-sale or sharing channel (although we do not sell or share personal information for cross-context behavioral advertising).
- A right against discrimination for exercising any of these rights.

In the meantime, if you are a California resident and you would like to exercise any of these rights informally, email privacy@explainmyermi.com and we will treat your request as if CCPA applied.

**Shine the Light (Cal. Civ. Code § 1798.83).** California residents may request information about whether we share personal information with third parties for those parties' direct-marketing purposes. We do not. To inquire, email privacy@explainmyermi.com.

## 8. State-Specific Consumer Privacy Rights

You may exercise these rights by emailing **privacy@explainmyermi.com** from the address associated with your order. We will respond within forty-five (45) days, with one (1) additional forty-five (45)-day extension if reasonably necessary, in which case we will notify you of the extension.

In this Section, "**personal information**" (also referred to as "personal data" under certain state privacy laws) has the meaning given in Section 2 of this Policy.

### Texas Residents (TDPSA, Tex. Bus. & Com. Code Ch. 541)

### Residents of Other States

### Universal Opt-Out Mechanism (Global Privacy Control)

## 9. Appeals

If we deny your appeal, you may submit a complaint to the attorney general of your state. Texas residents may file a complaint with the Texas Attorney General's Consumer Protection Division at **texasattorneygeneral.gov/consumer-protection/file-consumer-complaint**. Residents of other states may contact their state attorney general's office through that office's published consumer-complaint channel.

## 10. Children's Privacy

## 11. International Users and Cross-Border Transfers

The Service is offered to people who live in the United States. You may order a Report for a sample taken from a property anywhere, but if you live outside the United States, **please do not use the Service**.

## 12. Security

We use commercially reasonable technical and organizational safeguards, including:

- TLS encryption for data in transit between your browser, our servers, and our service providers.
- Encryption at rest for our database and for the files we store.
- Access to personal information limited to the Company, with each part of the Service given only the access it needs.
- A locked archive of order and acceptance records that cannot be altered or deleted during its retention period (Section 5).
- Automated database backups maintained by our hosting provider.
- Bot protection and rate limits on the order form and other public forms.

No system is perfectly secure. If you become aware of a security issue affecting the Service, email security@explainmyermi.com.

**Breach notification.** If we determine that an unauthorized party has accessed or acquired (or we reasonably believe has accessed or acquired) personal information we hold about you in a manner that compromises its security, confidentiality, or integrity, we will notify you, and any attorneys general, regulators, or other parties to whom notice is required, in accordance with applicable data-breach-notification laws. We will provide notice without unreasonable delay and within the time limits set by applicable law (for example, 30 days under California law and 60 days under Texas law), subject only to delays that law enforcement requests or that applicable law permits while we determine the scope of the incident and secure our systems.

## 13. Third-Party Links

## 14. Changes to This Policy

| Effective | Change |
|---|---|
| 2026-10-27 | Initial version. |
| 2026-10-28 | Stripe's payment page now asks for your billing address, and Stripe sends it to us, so we can charge Texas sales tax. We also receive the name on your card. Sections 2.2, 2.4, 3, 4, and 5 updated. |

## 15. Contact

For questions, requests, or complaints about this Policy or our data practices:

**privacy@explainmyermi.com**

Mycolytica LLC d/b/a ExplainmyERMI
5900 Balcones Drive STE 100, Austin, TX 78731
Principal place of business: Williamson County, Texas