Privacy Policy
Effective as of September 8, 2026.
California Notice at Collection / State Privacy Rights Notice: See the State Privacy Rights Notice section below for important information about your rights under applicable state privacy laws.
Fiberside LLC ("Fiberside," "we," "us," or "our") provides compliance services relating to United States packaging and textile extended producer responsibility ("EPR") regulation. This Privacy Policy describes how Fiberside processes personal information that we collect through our digital properties that link to this Privacy Policy, including our website at fiberside.co, as well as our marketing activities and other activities described in this Privacy Policy (collectively, the "Service").
Personal information we collect
Information you provide to us. Personal information you may provide to us through the Service or otherwise includes:
- Contact data, such as your first and last name, work email address, work telephone number, and company name.
- Inquiry data, such as the category of assistance you request and the contents of any message you submit through the Service's contact form or send to us by email.
- Exposure Check data, consisting of your responses to the questions presented by the Service's EPR Exposure Check, including the types of products you sell, the states into which you sell, brand-ownership and importer status, ranges of global revenue and California sales, ranges of packaging weight, existing regulatory or producer-responsibility-organization registrations, and business-structure characteristics, together with the preliminary result generated from those responses.
- Communications data, based on our exchanges with you, including when you contact us through the Service or by email.
- Marketing data, such as your preferences for receiving our marketing communications and details about your engagement with them.
- Scheduling data. If you elect to book a call through the scheduling link presented with your Exposure Check result, your name, email address, and a summary of your result are transmitted to our scheduling provider to prefill the booking form.
We do not collect payment information through the Service, and the Service does not offer user accounts. Please do not submit confidential supplier, product, customer, or employee data through the Service; if documents are required, we will provide a separate intake method.
Third-party sources. We may combine personal information we receive from you with personal information we obtain from other sources, such as public sources (including government agencies and public records) and data providers licensed to furnish business contact information. Where we first contact you using information obtained from such sources, we will identify the source, and each such communication will include a functioning unsubscribe mechanism.
Automatic data collection. We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and your interaction over time with the Service, such as:
- Device data, such as your computer or mobile device's operating system, browser type, screen characteristics, IP address, language settings, and general location information (city, state, or geographic area).
- Online activity data, such as pages viewed, time spent on a page, the website you visited before browsing to the Service, navigation paths, and access times.
- Session interaction data, consisting of reconstructions of visitor interactions with pages of the Service (scrolling, pointer movement, clicks, and keystrokes within the page), collected by our session-analytics provider only as described under Tracking Technologies below.
- Campaign data, such as the campaign parameters (UTM tags) present in the link through which you arrived at the Service, which we associate with any Exposure Check submission you make.
Tracking technologies
Strictly necessary technologies. The Service uses technologies that are necessary for its operation, including technologies that record your consent choice and enable form submission. These cannot be disabled. Our hosting provider maintains standard server logs, which include IP addresses.
Analytics technologies (consent-based). Only where you provide consent through the banner presented on the Service, we use: (i) Google Analytics 4, which collects device data and online activity data to help us understand use of the Service; and (ii) Microsoft Clarity, which collects session interaction data, including session replays and heatmaps. Clarity masks form-field content by default. Neither service is loaded before consent is given, and you may withdraw consent at any time through the banner.
No advertising technologies. We do not use advertising cookies, do not build advertising audiences from Service activity, and do not deploy tracking technologies for targeted advertising.
Opt-out preference signals. We honor the Global Privacy Control ("GPC") signal as a valid opt-out preference signal as required by applicable law, and treat a GPC or legacy Do Not Track signal as declined consent for the technologies described above.
How we use your personal information
We may use your personal information for the following purposes or as otherwise described at the time of collection:
- Service delivery and operations, including to operate and secure the Service, to respond to your inquiries and requests, to generate and review your Exposure Check result, and to communicate with you about the Service. The Exposure Check result is an informational screen only; it is not a compliance determination, and every engagement is reviewed by a person.
- Direct marketing. Where you have completed the Exposure Check or otherwise requested our communications, we may send you alerts regarding newly announced state EPR deadlines and periodic communications regarding the regulations we track and our services. You may opt out as described in the Your Choices section below. We do not send marketing text messages.
- Service improvement and analytics, using the consent-based technologies described above.
- Relationship management, including maintaining records of inquiries, prospects, and clients in the customer-relationship-management systems we use to operate our business.
- Compliance and protection, including to comply with applicable laws, lawful requests, and legal process; to protect our, your, or others' rights, privacy, safety, or property (including by making and defending legal claims); to audit our internal processes; and to prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity.
- Aggregated, de-identified, or anonymized data. We may create aggregated, de-identified, or anonymized data from personal information, and use and share such data for our lawful business purposes. We will not attempt to re-identify such data, except to test whether our de-identification processes comply with applicable law.
We do not use your personal information to make automated decisions that produce legal or similarly significant effects concerning you.
Retention
We generally retain personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying legal, accounting, or reporting requirements, establishing or defending legal claims, and fraud prevention. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes of processing and whether those purposes can be achieved by other means, and applicable legal requirements. As applied to the Service:
- Contact-form and Exposure Check submissions are retained while we correspond with you and for no longer than three years after your last interaction with us, unless you become a client, in which case client records are retained in accordance with the applicable engagement agreement.
- Marketing-list email addresses are retained until you unsubscribe, and for no longer than three years after your last interaction with our communications.
- Google Analytics event data is retained for fourteen (14) months; Microsoft Clarity session recordings are retained by the provider for thirty (30) days and aggregated data for up to thirteen (13) months.
When a retention period ends, we delete, de-identify, or isolate the applicable information.
How we share your personal information
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, in each case within the meaning of applicable state privacy laws. We may share your personal information with the following parties:
- Service providers. Third parties that provide services on our behalf or help us operate the Service or our business, including website hosting and form processing (Netlify), business email (Google Workspace), consent-based analytics (Google Analytics; Microsoft Clarity), scheduling (Cal.com, where you elect to book), and customer-relationship-management and email-delivery tools.
- Professional advisors, such as lawyers, auditors, bankers, and insurers, in the course of the professional services they render to us.
- Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate to comply with applicable laws, lawful requests, and legal process, or for the compliance and protection purposes described above.
- Business transferees. We may disclose personal information in the context of actual or prospective business transactions (e.g., investments in or financing of Fiberside, or the sale, transfer, or merger of all or part of our business or assets), including to prospective counterparties and their advisers, and to an acquirer, successor, or assignee of Fiberside, in which case this Privacy Policy will continue to apply to the transferred information.
We do not disclose one client's information to another client, and Exposure Check responses are not published or used in examples.
Your choices
- Opt out of marketing communications. You may opt out of marketing-related emails by following the unsubscribe instructions in any such email or by contacting us at privacy@fiberside.co. You may continue to receive service-related and other non-marketing communications.
- Analytics consent. You may decline or withdraw consent for the analytics technologies described above at any time through the banner on the Service, or by broadcasting a GPC signal.
- Declining to provide information. We need certain personal information to provide certain aspects of the Service. If you do not provide required information, we may be unable to respond to your inquiry or provide the requested result.
Other sites and services
The Service contains links to websites and online services operated by third parties, including regulators, statutes, producer responsibility organizations, and our scheduling provider. These links are not an endorsement of, or representation that we are affiliated with, any third party. We do not control third-party services and are not responsible for their actions. We encourage you to read the privacy policies of the third-party services you use.
Security
We employ technical, organizational, and physical safeguards designed to protect the personal information we collect, consistent with the New York SHIELD Act's reasonable-safeguards standard, including access limitation and encryption in transit. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information. If a breach affects your personal information, we will notify you as required by applicable law.
International data transfer
We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.
Children
The Service is directed to businesses and is not intended for use by anyone under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected personal information from a child, please contact us and we will comply with applicable legal requirements to delete the information.
Changes to this Privacy Policy
We reserve the right to modify this Privacy Policy at any time. If we make material changes, we will notify you by updating the date of this Privacy Policy and posting it on the Service, and, for material changes, noting the change on this page for thirty (30) days. Modifications are effective upon posting. The current version is available at fiberside.co/privacy.
How to contact us
- Email: privacy@fiberside.co
- Mail: Fiberside LLC, 30 N Gould St # 63390, Sheridan, WY 82801
State Privacy Rights Notice
Except as otherwise provided, this section applies to residents of U.S. states to the extent such states have privacy laws applicable to us that grant their residents the rights described below (collectively, the "State Privacy Laws"). For purposes of this section, "Personal Information" and "Sensitive Personal Information" have the meanings given to those or similar terms under the State Privacy Laws. These rights are not absolute, not all rights are available in all states, and we may decline requests as permitted by law.
Your rights. Subject to the State Privacy Laws, you may request: (i) information about the categories of Personal Information we have collected, the categories of sources, the business or commercial purposes of collection, and the categories of third parties to which we disclose Personal Information; (ii) access to a copy of the Personal Information we have collected about you; (iii) correction of inaccurate Personal Information; (iv) deletion of Personal Information we have collected from you; (v) portability of the Personal Information you provided to us in a machine-readable format; and (vi) appeal of our denial of any request validly submitted. You are entitled to exercise these rights free from discrimination as prohibited by the State Privacy Laws.
Sales, sharing, targeted advertising, and profiling. We do not sell your Personal Information, we do not share your Personal Information for cross-context behavioral advertising, we do not process your Personal Information for targeted advertising, and we do not use your Personal Information to engage in profiling in furtherance of decisions that produce legal or similarly significant effects.
Sensitive Personal Information. We do not intentionally collect or process Sensitive Personal Information through the Service. Please do not submit Sensitive Personal Information in free-text fields.
Consumers under 16. We do not have actual knowledge that we collect, sell, or share the Personal Information of consumers under 16 years of age.
Opt-out preference signals. We honor GPC signals as valid opt-out preference signals as required by applicable law.
Exercising your rights. You may submit requests by email to privacy@fiberside.co. We may need to verify your identity to process your request — ordinarily by confirming your control of the email address associated with the information — and we reserve the right to confirm your residency. Under some State Privacy Laws, you may authorize an agent to make a request on your behalf; we may require evidence of the agent's authority, including a valid power of attorney or your written, signed permission, and may confirm the request with you directly. We will respond within the time required by applicable law. To appeal a denial, reply to our response and we will explain the outcome of your appeal.
Information practices. The following describes our practices currently and during the preceding 12 months:
| Personal Information we collect | CCPA statutory category | Purposes | Categories of third parties to whom we disclose for a business purpose | Categories of third parties to whom we "sell" or "share" |
|---|---|---|---|---|
| Contact data (name, work email, work phone, company) | Identifiers; professional information (Cal. Civ. Code §1798.140(v)(1)(A), (I)) | Service delivery; communications; relationship management; compliance and protection | Service providers | None |
| Inquiry data and communications data | Identifiers; commercial information ((v)(1)(A), (D)) | Service delivery; communications; compliance and protection | Service providers | None |
| Exposure Check data, including revenue and sales ranges | Commercial information; professional information ((v)(1)(D), (I)) | Service delivery; relationship management | Service providers | None |
| Device data, online activity data, session interaction data, campaign data | Identifiers; internet or other electronic network activity information ((v)(1)(A), (F)) | Service improvement and analytics (consent-based) | Service providers (analytics) | None |
| Exposure Check result (tier and program statuses) | Inferences ((v)(1)(K)) | Service delivery; relationship management | Service providers | None |
Retention. The criteria for determining retention periods are described in the Retention section above. De-identification. We do not attempt to re-identify de-identified information, except to test our de-identification processes as permitted by law.
California Shine the Light. Under California Civil Code §1798.83, California residents may request the identity of third parties to which we have disclosed certain personal information for those parties' own direct marketing purposes during the preceding calendar year. We make no such disclosures. Requests may be sent to privacy@fiberside.co with the subject line "Shine the Light Request."
Contact. If you have questions or concerns about our privacy practices, please contact us using the details in the How to Contact Us section above.