U.S. State Privacy Notice

Last Updated: 11/6/26

This U.S. State Privacy Notice (this “Notice”) supplements the information and disclosures contained in our Privacy Policy. It applies to the residents of the following U.S. states: California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Tennessee, Texas, Utah, and Virginia (the “Covered States”). This Notice explains how we collect and process Personal Information as a “business” or “controller” and how you can exercise your rights under these states’ comprehensive privacy laws (the “U.S. State Privacy Laws”).

Personal Information means information that the U.S. State Privacy Laws define as “Personal Information” or “Personal Data.” Generally speaking, this means any information that is linked or reasonably linkable to an identified or identifiable natural person. Personal Information does not include information that is deidentified or aggregated, or otherwise excluded from the scope of the U.S. State Privacy Laws, such as publicly available information.

1. Sources of Personal Information We Collect

We collect Personal Information from you when you provide it to us or automatically through our services. We may also obtain information about you from other sources, such as your Discord username, display name, profile picture, and your activity in the Tolan Discord server if you choose to join our Discord server.

2. Categories of Personal Information We Collect, Process, and Disclose

The information we collect, use, and disclose about you will vary depending on how you interact with our Services. Over the past 12 months, we may have collected, used, and disclosed each of the categories of Personal Information about you, as described below.

  • Identifiers, including name, online identifiers, internet protocol address, driver’s license number or other government-issued ID number, or other similar identifiers
  • Categories of information listed in the California Customer Records statute (Cal. Civ. Code Section 1798.80(e)), including name, telephone number, payment information, education, employment, and employment history
  • Commercial Information, including records of Portola’s services purchased, obtained, or considered
  • Internet or Other Electronic Network Activity Information, including browsing history and information regarding a consumer’s interaction with an internet website, application or advertisement
  • Financial Information, including payment card information
  • Audio and Visual Information
  • General (Non-Precise) Geolocation Data
  • Professional or Employment-Related Information, including job application or resume information, past and current job history, and job performance information
  • Inferences Drawn from Personal Information, including consumer profiles reflecting a consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes
  • Sensitive Personal Information. If you choose to share any sensitive personal information in conversations with your Tolan (such as your racial or ethnic origin, religious or philosophical beliefs, union membership, health information or information about your sex life or sexual orientation), we will receive that information. If you choose to connect your Tolan account to your Gmail account, we will receive the contents of your email. Where we have actual knowledge that a user is under 18, we obtain a parent or guardian’s consent to collect their personal information. To learn how we collect and use personal information from children under 13, see our Children’s Privacy Notice.
  • Characteristics of Protected Classifications under California or Federal Law. Similarly, if you choose to share information about your protected classifications in conversations with your Tolan, such as your race or color, religion or creed, age (over 40), mental or physical disability, sex (including pregnancy, childbirth, breastfeeding or related medical conditions), sexual orientation, gender, gender identity or expression, marital status, we’ll receive that information.

3. Our Purposes for Processing Personal Information

We use the information we collect for the purposes listed below. For each purpose, we list the categories of Personal Information used for that purpose.

  • To provide, maintain, improve, and enhance our Services, including to improve, train, and develop the artificial intelligence, machine learning, and models that we use to support our Services: Identifiers, Categories of information listed in the California Customer Records statute, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Information, Professional or Employment-Related Information, Audio and Visual Information, Financial Information, Characteristics of Protected Classifications under California or Federal Law, Sensitive Personal Information
  • To personalize your experience on our Services, such as by providing tailored content and recommendations: Identifiers, Categories of information listed in the California Customer Records statute, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Information, Audio Information, Characteristics of Protected Classifications under California or Federal Law, Sensitive Personal Information
  • To understand and analyze how you use our Services and develop new products, services, features, and functionality: Identifiers, Categories of information listed in the California Customer Records statute, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Information, Audio Information, Financial Information, Characteristics of Protected Classifications under California or Federal Law, Sensitive Personal Information
  • To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, and otherwise provide customer support: Identifiers, Categories of information listed in the California Customer Records statute, Commercial Information, Internet or Other Electronic Network Activity Information, Financial Information, Audio and Visual Information, Inferences Drawn from Personal Information, Sensitive Personal Information
  • For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you: Identifiers, Categories of information listed in the California Customer Records statute, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Information, Inferences Drawn from Personal Information
  • To partner with you to promote our Services: Identifiers, Categories of information listed in the California Customer Records statute, Internet or Other Electronic Network Activity Information, Audio and Visual Information, Geolocation Information
  • To facilitate transactions and payments: Identifiers, Categories of information listed in the California Customer Records statute, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Information, Financial Information
  • To find and prevent fraud and abuse, and respond to trust and safety issues that may arise: Identifiers, Categories of information listed in the California Customer Records statute, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Information, Audio and Visual Information, Financial Information, Characteristics of Protected Classifications under California or Federal Law, Sensitive Personal Information
  • For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency: Identifiers, Categories of information listed in the California Customer Records statute, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Information, Professional or Employment-Related Information, Audio and Visual Information, Financial Information, Characteristics of Protected Classifications under California or Federal Law, Sensitive Personal Information

4. Categories of Third Parties to Which We Disclose Your Information

We may disclose your information to third parties, including the following categories of third parties:

  • Service providers and vendors
  • Analytics partners
  • AI service providers
  • Advertising partners
  • Other users you interact with
  • Law enforcement or other third parties in connection with legal requests, to comply with applicable law or to prevent harm
  • Third parties in mergers and other corporate transactions
  • Corporate affiliates

We disclose Identifiers, Categories of information listed in the California Customer Records statute (Cal. Civ. Code Section 1798.80(e)), Commercial Information, and Internet or Other Electronic Network Activity Information to Advertising Partners. Under the U.S. State Privacy Laws, some of these data disclosures may broadly be considered processing of Personal Information for targeted advertising and “sharing” of Personal Information for cross-context behavioral advertising.

We do not use or disclose Sensitive Personal Information as defined in the CCPA for purposes other than those set forth in that law.

We do not “sell” Personal Information about consumers, including consumers under the age of 16, and we do not knowingly “share” the Personal Information of consumers under the age of 16 for cross-context behavioral advertising. If we process deidentified data provided to us by third parties, we will not attempt to reidentify it if we are prohibited by applicable law from doing so.

5. Retention

We will retain Personal Information for a time period required or allowed by applicable regulations or laws and as needed to fulfill the business purposes outlined in Section 3, including providing you products and services, complying with our legal obligations, resolving disputes, and enforcing our agreements, or for other purposes described in this Notice. Our retention of information is based on many factors such as your relationship with Portola, the nature of the information, compliance with our legal obligations, and defending or resolving actual or anticipated legal claims.

6. Your U.S. State Privacy Rights

Some states provide consumers certain rights regarding their Personal Information. Depending on where you live and subject to certain exceptions, you may exercise the following rights:

  • The right to confirm whether we process your Personal Information and to know the categories of Personal Information we have collected or disclosed about you, as well as the sources of such Personal Information, the purposes, or categories of third parties to whom such Personal Information is disclosed.
  • The right to request that we disclose to you the categories of Personal Information we have collected or disclosed about you, as well as the sources of such Personal Information, the purposes, and categories of third parties to whom such Personal Information is disclosed.
  • The right to access, correct, or delete the specific pieces of Personal Information we have collected about you.
  • The right to opt out of the “sale” of your Personal Information, the “sharing” of your Personal Information for cross-context behavioral advertising, and the processing of your Personal Information for targeted advertising. We do not sell Personal Information.
  • The right to limit our collection, use or disclosure of your sensitive Personal Information, where permitted by law.
  • The right to be free from discriminatory treatment for the exercise of your privacy rights.
  • The right to appeal any decision with regard to your privacy request.
  • The right to opt out of profiling in furtherance of producing legal or similarly significant decisions concerning a consumer. We do not engage in such profiling.

If your Personal Information is profiled in furtherance of decisions that produce legal or similarly significant effects concerning you, you have the right to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of the actions you might have taken to secure a different decision and the actions that you might take to secure a different decision in the future. You also have the right to review your Personal Information used in the profiling, and if applicable, have the data corrected and the profiling decision reevaluated based upon the corrected data. We do not engage in such profiling.

7. Exercising Your U.S. State Privacy Rights

Submitting Requests. You can submit access, correction, deletion, and appeal requests by sending an email to privacy@portola.ai using the email address associated with your account. You can exercise your right to opt out of the processing of your Personal Information for targeted advertising or the “sharing” of your Personal Information for cross-context behavioral advertising by submitting our Do Not Share My Personal Information for Targeted Advertising form, or by emailing privacy@portola.ai with the subject line “Do Not Share My Personal Information” and the email address, phone number, and mobile advertising identifier associated with your Tolan account.

Verification. Requests for access to, deletion, or correction of Personal Information are subject to our ability to verify your identity. To verify your identity, we may ask you to provide additional personal information that you have previously provided to us.

Authorizing an Agent. If you are acting as an authorized agent to make a request to know, delete, or correct on behalf of a California resident, please send an email to privacy@portola.ai and attach a written authorization signed by the resident. We may still require the California resident to directly verify their identity and confirm that they have provided you permission to submit the request.

Global Privacy Controls. Please note that if you have implemented a web browser-based opt-out preference signal, such as the Global Privacy Control, we are unable to tie that web browser-based request to your account because users do not access their Tolan accounts through our website. Further, we do not use or share information collected via our website for targeted advertising or cross-context behavioral advertising.

8. Contact Information

If you have any questions, comments, or concerns about this Notice, please email us at privacy@portola.ai.

Last Reviewed and Updated: November 6, 2026