US State Privacy Laws

Lynx (“we,” “our,” or “us”) is committed to protecting the privacy of all users of the Lynx platform, a startup networking service for the Vanderbilt University community. This US State Privacy Laws page (“State Privacy Notice”) supplements our main Privacy Policy and addresses the specific rights and disclosures required by US state consumer privacy laws.

Depending on the state in which you reside, you may have additional rights regarding the personal information we collect, use, and disclose about you. This notice covers residents of California (under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, collectively “CCPA/CPRA”), Virginia (under the Virginia Consumer Data Protection Act, “VCDPA”), Colorado (under the Colorado Privacy Act, “CPA”), and Connecticut (under the Connecticut Data Privacy Act, “CTDPA”).

If you reside in a state not listed above, you may still have privacy rights under applicable law or under our general Privacy Policy. We will honor valid privacy requests from all users to the extent practicable, regardless of state of residence. To submit a request or ask a question, please contact us at privacy@lynx.community.

This section applies to residents of California and is provided pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §§ 1798.100–1798.199.100) (collectively, the “CCPA”). Capitalized terms not defined herein have the meanings ascribed to them under the CCPA.

Categories of Personal Information Collected

In the twelve (12) months preceding the effective date of this notice, we have collected the following categories of personal information from or about California consumers:

We do not collect Social Security numbers, financial account numbers, health or medical data, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic or biometric data, or contents of non-Lynx communications. Accordingly, we do not collect sensitive personal information as defined by the CPRA beyond what is listed above.

Business and Commercial Purposes for Collection

We collect the categories of personal information described above for the following business or commercial purposes:

• Providing, maintaining, and improving the Lynx platform, including facilitating connections between students, alumni, and venture capitalists around startup ideas and projects.
• Creating and managing user accounts and authenticating users via Clerk.
• Enabling users to post startup ideas, form project teams, and recruit co-founders with relevant skills and experience.
• Facilitating direct messaging and communications between platform users.
• Personalizing the platform experience, including surfacing relevant startup ideas, projects, and potential collaborators based on user profile data and engagement signals.
• Detecting, preventing, and investigating fraud, abuse, security incidents, and violations of our User Agreement and Professional Community Policy.
• Complying with legal obligations and responding to lawful requests from government authorities.
• Sending transactional and service-related communications, such as account verification emails and platform notifications.

We do not use personal information collected for purposes materially different from those listed above without providing additional notice or obtaining consent as required by law.

Right to Know

You have the right to request that we disclose to you (up to twice per 12-month period, free of charge):

• The categories of personal information we have collected about you in the preceding 12 months.
• The categories of sources from which we collected your personal information.
• The business or commercial purpose for collecting your personal information.
• The categories of third parties to whom we have disclosed your personal information.
• The specific pieces of personal information we have collected about you (“data portability”).

To submit a Right to Know request, please follow the instructions in the How to Submit a Privacy Request section below.

Right to Delete

You have the right to request that we delete the personal information we have collected from you, subject to certain exceptions. We may deny a deletion request, in whole or in part, if retaining the information is necessary for us or our service providers to:

• Complete a transaction, provide goods or services you requested, or take actions reasonably anticipated within the context of our ongoing relationship with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible.
• Debug to identify and repair errors in our platform functionality.
• Exercise free speech or ensure another consumer’s right to exercise their free speech, or exercise another right provided by law.
• Comply with a legal obligation under California or federal law.
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.

If we delete your account and personal information, we will also direct any service providers and contractors that received your personal information to delete it, unless this proves impossible or involves disproportionate effort.

Right to Correct Inaccurate Information

You have the right to request that we correct inaccurate personal information we maintain about you, taking into account the nature of the personal information and the purposes of the processing. We may deny a correction request if we determine, considering all relevant circumstances, that the personal information is more likely than not accurate. Upon receiving a valid correction request, we will use commercially reasonable efforts to correct the inaccurate information.

For most profile information, you can correct inaccuracies directly by editing your profile within the Lynx platform without submitting a formal request.

Right to Opt-Out of Sale or Sharing

Lynx does not sell your personal information for monetary or other valuable consideration within the meaning of the CCPA. Lynx does not share your personal information for cross-context behavioral advertising. Because we do not engage in these activities, there is no sale or sharing to opt out of. However, if our practices change in the future, we will update this notice and provide you with an opportunity to opt out before any such sale or sharing begins.

Right of Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. We will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you with a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services, or a different level or quality of goods or services.

Sensitive Personal Information

Under the CPRA, “sensitive personal information” is a defined subset of personal information requiring additional protections. The CPRA defines sensitive personal information to include Social Security numbers, financial account numbers, precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of personal communications, genetic and biometric data, and health information.

Lynx does not collect most categories of sensitive personal information as defined by the CPRA. The only potentially sensitive category we may collect is the contents of private messages between users, which we collect solely to facilitate user-to-user communication on the platform and for security purposes. We do not use or disclose the contents of user messages for any purpose beyond operating the messaging feature, enforcing our community policies, and complying with legal obligations. We do not use sensitive personal information to infer characteristics about you as prohibited by the CPRA.

You have the right to limit our use of sensitive personal information to those uses which are necessary to perform the services you request. Given our limited use of sensitive personal information, we believe our current practices already comply with this standard. If you have questions or concerns, please contact us at privacy@lynx.community.

How to Submit a California Privacy Request

California residents may submit requests to exercise their rights under the CCPA by emailing privacy@lynx.community with the subject line “California Privacy Request.” Please identify the specific right(s) you wish to exercise (Right to Know, Right to Delete, Right to Correct, or Right to Limit Use of Sensitive Personal Information) and provide sufficient information to allow us to verify your identity as described in Section 6. You may also use an authorized agent as described in Section 7.

This section applies to residents of Virginia and is provided pursuant to the Virginia Consumer Data Protection Act (Va. Code Ann. §§ 59.1-571 through 59.1-585) (“VCDPA”), which took effect January 1, 2023.

Under the VCDPA, Virginia residents who are “consumers” (natural persons who are Virginia residents acting in an individual or household context, and not in a commercial or employment context) have the following rights with respect to their personal data:

Right to Access

You have the right to confirm whether we are processing your personal data and to access such personal data. We will provide a copy of your personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance.

Right to Correct

You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing. We will use commercially reasonable efforts to correct confirmed inaccuracies within the applicable response period. For most profile fields, you may correct your data directly within the Lynx platform settings without submitting a formal request.

Right to Delete

You have the right to delete personal data you have provided to us or that we have obtained about you. We will delete your personal data upon a verified request unless an exception applies, such as where retention is necessary to complete a transaction, detect fraud or security incidents, comply with a legal obligation, or engage in public interest research.

Right to Data Portability

You have the right to obtain a copy of your personal data in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means. You may exercise this right twice per 12-month period free of charge.

Right to Opt-Out of Sale, Targeted Advertising, and Profiling

You have the right to opt out of (i) the sale of personal data, (ii) processing of personal data for purposes of targeted advertising, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Lynx does not sell personal data, process personal data for targeted advertising, or engage in profiling that produces legal or similarly significant effects. Accordingly, there is currently no opt-out mechanism needed. If our practices change, we will provide a clear opt-out mechanism before engaging in any such processing.

Non-Discrimination and Appeals

We will not discriminate against you for exercising your VCDPA rights. If we decline to take action in response to your request, we will inform you within 45 days with reasons for the denial. You have the right to appeal our decision by contacting us at privacy@lynx.community with the subject line “VCDPA Appeal.” We will respond to your appeal within 60 days. If your appeal is denied, you may contact the Virginia Attorney General at oag.state.va.us.

This section applies to residents of Colorado and is provided pursuant to the Colorado Privacy Act (Colo. Rev. Stat. §§ 6-1-1301 through 6-1-1313) (“CPA”), which took effect July 1, 2023. Colorado consumers have the following rights with respect to their personal data:

Right to Access and Data Portability

You have the right to confirm whether we are processing your personal data and to access such data. You also have the right to obtain your personal data in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without impediment, where the processing is carried out by automated means. You may exercise this right once per 12-month period free of charge.

Right to Correct

You have the right to correct inaccuracies in your personal data, taking into account the nature of the data and the purposes for which we process it. We encourage you to use in-platform profile editing tools for most corrections. For data not editable within the platform, submit a request to privacy@lynx.community.

Right to Delete

You have the right to delete personal data concerning you that you have provided to us or that we have otherwise obtained about you. Exceptions apply where retention is necessary to complete a transaction you requested, for security purposes, to comply with legal obligations, or for other legitimate purposes set out in the CPA.

Right to Opt-Out of Sale, Targeted Advertising, and Profiling

Under the CPA, you have the right to opt out of (i) the sale of personal data, (ii) the processing of personal data for purposes of targeted advertising, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.

Lynx does not sell personal data, process personal data for targeted advertising, or engage in automated profiling that produces legal or similarly significant effects. If our practices change, we will update this notice and provide the required opt-out mechanisms, including honoring opt-out preference signals such as the Global Privacy Control (“GPC”) to the extent required by law.

Sensitive Data

The CPA provides additional protections for “sensitive data,” which includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health conditions, genetic or biometric data, personal data of a known child, precise geolocation, or data concerning a natural person’s sex life or sexual orientation. Lynx does not knowingly collect any of these categories of sensitive data.

Appeals

If we decline to take action on your request, we will inform you within 45 days with reasons for the decision. You may appeal by emailing privacy@lynx.community with the subject line “CPA Appeal.” We will respond within 45 days of receipt. If your appeal is denied, you may submit a complaint to the Colorado Attorney General at coag.gov.

This section applies to residents of Connecticut and is provided pursuant to the Connecticut Data Privacy Act (Conn. Gen. Stat. §§ 42-515 through 42-525) (“CTDPA”), which took effect July 1, 2023.

Connecticut consumers have rights that are substantially similar to those described for Virginia and Colorado residents above, including:

• Right to Access: Confirm whether we process your personal data and obtain a copy of such data.
• Right to Correct: Correct inaccuracies in your personal data.
• Right to Delete: Delete personal data provided by or obtained about you, subject to applicable exceptions.
• Right to Data Portability: Obtain your personal data in a portable, readily usable format, to the extent technically feasible.
• Right to Opt-Out: Opt out of the sale of personal data, processing for targeted advertising, and profiling that produces legal or similarly significant effects. As noted above, Lynx does not engage in any of these activities.

If we decline to take action on your request, you may appeal by emailing privacy@lynx.community with the subject line “CTDPA Appeal.” We will respond within 60 days. If your appeal is denied, you may submit a complaint to the Connecticut Attorney General at portal.ct.gov/ag.

The CTDPA also requires that we honor opt-out preference signals such as the Global Privacy Control (GPC) to the extent required by applicable law. Because Lynx does not engage in targeted advertising or sale of personal data, no action is required when we receive a GPC signal at this time. We will honor GPC signals and provide opt-out mechanisms if our practices change.

To exercise any of the privacy rights described in this notice, please submit your request to us using the contact information below. We strive to make the request process straightforward and accessible.

Identity Verification

To protect your personal information and prevent fraudulent requests, we are required to verify your identity before fulfilling certain requests. We will not fulfill a request to disclose specific pieces of personal information or to delete personal information without first verifying that the requestor is the consumer about whom we have collected information.

We verify identity by matching information you provide in your request against information we already have on file for you. The level of verification required depends on the sensitivity of the request:

• Right to Know (categories only): We will ask you to confirm two or more data points (e.g., name and email address).
• Right to Know (specific pieces) and Right to Delete: We will ask you to confirm three or more data points and may request a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.
• Right to Correct: We will ask you to confirm at least two data points.

We will use only the personal information you provide in your verification request for the purpose of verifying your identity and will delete any personal information collected solely for verification within a reasonable time after responding to your request.

If we cannot verify your identity to a sufficient level of certainty, we will notify you and explain why we cannot fulfill your request. We may not be able to associate the information we have on file with you if you have previously provided incomplete information or used a different email address.

California consumers may designate an authorized agent to submit privacy requests on their behalf. An authorized agent is a natural person or a business entity registered with the California Secretary of State that a consumer has authorized to act on their behalf.

If you wish to use an authorized agent to submit a request, the authorized agent must provide us with one of the following:

• A written permission signed by you authorizing the agent to submit the request on your behalf; or
• A valid power of attorney executed by you pursuant to California Probate Code sections 4000 to 4465.

In addition to providing proof of authorization, we will also require you to verify your own identity directly with us and confirm that you provided the authorized agent with permission to submit the request, unless the agent has provided a valid power of attorney. We may deny a request from an authorized agent who does not submit proof of authorization.

To submit a request through an authorized agent, please have the agent contact us at privacy@lynx.community with the subject line “Authorized Agent Request — California” and include the documentation described above.

Residents of Virginia, Colorado, and Connecticut may also designate an authorized representative to submit privacy requests on their behalf. We will apply similar verification procedures to confirm the agent’s authority and the requestor’s identity.

If you have any questions, concerns, or requests regarding this State Privacy Notice or our privacy practices generally, please contact us:

We take privacy inquiries seriously and will respond promptly. If you are not satisfied with our response to your request or complaint, you may contact the applicable state regulatory authority as listed in the relevant state section above.

This State Privacy Notice may be updated from time to time to reflect changes in applicable law or our privacy practices. We will post the updated notice at lynx.community/legal/us-privacy with a new effective date. We encourage you to review this notice periodically.