US Privacy Policy & Multi-State Data Protection Notice (CCPA/CPRA, VCDPA, TDPSA)

1. Scope & Controlling Entity This United States Privacy Policy ("Policy") describes how **CompositeMatrix Technologies Inc.**, a Delaware C-Corporation operating **compositematrix.com** ("CompositeMatrix," "we," "us," or "our"), collects, processes, retains, and safeguards personal and business-to-business ("B2B") contact data across the United States.

This Policy is drafted in accordance with: - **California Consumer Privacy Act of 2018**, as amended by the **California Privacy Rights Act of 2020 (CCPA/CPRA)** (Cal. Civ. Code § 1798.100 et seq.), including full coverage for **B2B employee, engineer, buyer, and contractor personal information**; - **Virginia Consumer Data Protection Act (VCDPA)**, **Colorado Privacy Act (CPA)**, **Connecticut Data Privacy Act (CTDPA)**, **Texas Data Privacy and Security Act (TDPSA)**, **Florida Digital Bill of Rights (FDBR)**, and **Delaware Personal Data Privacy Act (DPDPA)**; - **Section 5 of the Federal Trade Commission (FTC) Act** (15 U.S.C. § 45).

2. Categories of Information We Collect 1. **B2B Professional & Account Identifiers**: Full name, corporate email address, job title (e.g., Naval Architect, Composite Process Engineer, Procurement Buyer), company name, US state, and ship-to ZIP code. 2. **Authentication & SSO Credentials**: When you sign in via **Google Workspace OAuth 2.0** or corporate magic link, we receive your verified email, display name, profile avatar URL, and cryptographic Google subject identifier (`sub`). We never store plaintext passwords. 3. **B2B Procurement, BOM & RFQ Transaction Records**: Material SKUs, laminate bills of materials (BOMs), drum/roll quantities, destination ZIP codes (used to calculate US DOT 49 CFR Hazmat freight routing), and RFQ dispatch logs. 4. **AI Copilot & API Telemetry**: Technical queries submitted to **CompositeGPT™**, OpenAI Custom GPT Actions (`/api/v1/materials`), or the Anthropic Model Context Protocol endpoint (`/api/mcp`), along with your workspace API key (`mcpApiKey`).

3. How We Use & Share Information (No Sale of Personal Data) - **Autonomous B2B RFQ Routing**: When you submit an RFQ on CompositeMatrix, we transmit your corporate contact details, requested ASTM material specifications, and destination ZIP code strictly to the verified US regional distributor(s) you selected (such as **Composites One**, **FGCI**, **Revchem Composites**, or **Express Composites**) to generate a formal commercial quote and Hazmat freight estimate. - **No Sale of Personal Information**: CompositeMatrix **does not sell** personal information as defined under the CCPA/CPRA and does not share personal information for cross-context behavioral advertising. - **AI Training Governance**: Your proprietary vessel designs, private BOM calculations, and corporate RFQ pricing are **never** used to train public foundation models.

4. Your Statutory US Privacy Rights (California, Virginia, Colorado, Texas, Delaware) Depending on your US state of residence, you have the statutory right to: 1. **Right to Know & Access**: Request disclosure of the specific pieces and categories of personal information we have collected about you in the preceding 12 months. 2. **Right to Deletion**: Request deletion of your personal information, subject to statutory exceptions for completed B2B commercial transactions, tax records, and US DOT Hazmat shipping logs. 3. **Right to Correction**: Request correction of inaccurate professional or corporate profile data. 4. **Right to Opt-Out of Sale/Sharing & Limit Sensitive Data**: Submit a formal request via our [Do Not Sell or Share My Personal Information](/legal/ccpa-opt-out) portal and honor **Global Privacy Control (GPC)** browser signals automatically. 5. **Non-Discrimination**: We will never discriminate against any engineer, buyer, or distributor for exercising statutory privacy rights.

5. Data Security, Retention & Contact Information All data is stored in encrypted PostgreSQL 16 + `pgvector` clusters located in the United States (New Jersey / US-East) protected by TLS 1.3 in transit, `httpOnly` HMAC-SHA256 session tokens, and strict role-based access control.

To exercise your rights, use our online form at [/legal/ccpa-opt-out](/legal/ccpa-opt-out) or contact our US Privacy Officer at **privacy@compositematrix.com**.