Privacy Policy

Effective as of September 9, 2026.

California Notice at Collection / State Privacy Rights Notice: See the State Privacy Rights Notice section below for important information about your rights under applicable state privacy laws.

Fiberside LLC ("Fiberside," "we," "us," or "our") provides compliance services relating to United States packaging and textile extended producer responsibility ("EPR") regulation. This Privacy Policy describes how Fiberside processes personal information that we collect through our digital properties that link to this Privacy Policy, including our website at fiberside.co, as well as our marketing activities and other activities described in this Privacy Policy (collectively, the "Service").

Personal information we collect

Information you provide to us. Personal information you may provide to us through the Service or otherwise includes:

• Contact data, such as your first and last name, work email address, work telephone number, and company name.
• Inquiry data, such as the category of assistance you request and the contents of any message you submit through the Service's contact form or send to us by email.
• Exposure Check data, consisting of your responses to the questions presented by the Service's EPR Exposure Check, including the types of products you sell, the states into which you sell, brand-ownership and importer status, ranges of global revenue and California sales, ranges of packaging weight, existing regulatory or producer-responsibility-organization registrations, and business-structure characteristics, together with the preliminary result generated from those responses.
• Communications data, based on our exchanges with you, including when you contact us through the Service or by email.
• Marketing data, such as your preferences for receiving our marketing communications and details about your engagement with them.
• Scheduling data. If you elect to book a call through the scheduling link presented with your Exposure Check result, your name, email address, and a summary of your result are transmitted to our scheduling provider to prefill the booking form.

We do not collect payment information through the Service, and the Service does not offer user accounts. Please do not submit confidential supplier, product, customer, or employee data through the Service; if documents are required, we will provide a separate intake method.

Third-party sources. We may combine personal information we receive from you with personal information we obtain from other sources, such as public sources (including government agencies and public records) and data providers licensed to furnish business contact information. Each marketing communication we send includes a functioning unsubscribe mechanism.

Automatic data collection. We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and your interaction over time with the Service, such as:

• Device data, such as your computer or mobile device's operating system, browser type, screen characteristics, IP address, language settings, and general location information (city, state, or geographic area).
• Online activity data, such as pages viewed, time spent on a page, the website you visited before browsing to the Service, navigation paths, and access times.
• Session interaction data, consisting of reconstructions of visitor interactions with pages of the Service (scrolling, pointer movement, clicks, and keystrokes within the page), collected by our session-analytics provider only as described under Tracking Technologies below.
• Campaign data, such as the campaign parameters (UTM tags) present in the link through which you arrived at the Service, which we associate with any Exposure Check submission you make.

Tracking technologies

Strictly necessary technologies. The Service uses technologies that are necessary for its operation, including technologies that record your consent choice and enable form submission. These cannot be disabled. Our hosting provider maintains standard server logs, which include IP addresses.

Analytics technologies. We use two analytics services: (i) Google Analytics 4, which collects device data and online activity data to help us understand how the Service is found and used; and (ii) Microsoft Clarity, which collects session interaction data, including session replays and heatmaps. Clarity masks form-field content by default. How these services load depends on where you are visiting from, as determined from your IP address at the time of your visit:

• Visitors in the United States. Both services load when you arrive. You may opt out at any time through the Do Not Sell or Share My Info link in the footer of the Service, which presents a notice where you can decline, or by broadcasting a GPC signal; after you opt out, neither service loads on your later visits.
• Visitors outside the United States. Neither service loads until you accept through the notice presented on the Service. Closing the notice without accepting is treated as declining.

Your choice is stored in your browser. You may change it at any time through the Do Not Sell or Share My Info link in the footer of the Service, by clearing this site's data in your browser, or by contacting us at privacy@fiberside.co. You may also opt out of Google Analytics in any browser by installing Google's opt-out browser add-on.

Advertising technologies. We use advertising pixels from LinkedIn (Insight Tag), Meta (Meta Pixel), Reddit (Reddit Pixel), and TikTok (TikTok Pixel). These technologies collect device data and online activity data, including the pages you view and the actions you take (such as completing the Exposure Check or submitting the contact form), and share it with the respective platform so that we can measure our advertising and show you Fiberside advertising on those platforms. Each platform may also use that data for its own purposes as described in its privacy policy. Where you submit the Exposure Check or the contact form, we also pass the email address you entered (and your name and phone number, where provided) to these platforms in hashed form so that they can match you to an account for advertising measurement and audiences. How they load depends on where you are visiting from: for visitors in the United States they load when you arrive, and you may opt out at any time by declining or closing the notice, through the Do Not Sell or Share My Info link in the footer of the Service (which re-presents the notice), or by broadcasting a GPC signal; for visitors outside the United States none of them loads until you accept, and you may withdraw acceptance the same ways.

Opt-out preference signals. We honor the Global Privacy Control ("GPC") signal as a valid opt-out preference signal as required by applicable law, and treat a GPC or legacy Do Not Track signal as an opt-out from, and as declined consent for, every analytics technology described above, wherever you are visiting from.

How we use your personal information

We may use your personal information for the following purposes or as otherwise described at the time of collection:

• Service delivery and operations, including to operate and secure the Service, to respond to your inquiries and requests, to generate and review your Exposure Check result, and to communicate with you about the Service. The Exposure Check result is an informational screen only; it is not a compliance determination, and every engagement is reviewed by a person.
• Direct marketing. Where you have completed the Exposure Check or otherwise requested our communications, we may send you alerts regarding newly announced state EPR deadlines and periodic communications regarding the regulations we track and our services. You may opt out as described in the Your Choices section below. We do not send marketing text messages.
• Service improvement and analytics, using the analytics technologies described above.
• Relationship management, including maintaining records of inquiries, prospects, and clients in the customer-relationship-management systems we use to operate our business.
• Compliance and protection, including to comply with applicable laws, lawful requests, and legal process; to protect our, your, or others' rights, privacy, safety, or property (including by making and defending legal claims); to audit our internal processes; and to prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity.
• Aggregated, de-identified, or anonymized data. We may create aggregated, de-identified, or anonymized data from personal information, and use and share such data for our lawful business purposes. We will not attempt to re-identify such data, except to test whether our de-identification processes comply with applicable law.

We do not use your personal information to make automated decisions that produce legal or similarly significant effects concerning you.

Retention

We generally retain personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying legal, accounting, or reporting requirements, establishing or defending legal claims, and fraud prevention. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes of processing and whether those purposes can be achieved by other means, and applicable legal requirements. As applied to the Service:

• Contact-form and Exposure Check submissions are retained while we correspond with you and for no longer than three years after your last interaction with us, unless you become a client, in which case client records are retained in accordance with the applicable engagement agreement.
• Marketing-list email addresses are retained until you unsubscribe, and for no longer than three years after your last interaction with our communications.
• Google Analytics event data is retained for fourteen (14) months; Microsoft Clarity session recordings are retained by the provider for thirty (30) days and aggregated data for up to thirteen (13) months.

When a retention period ends, we delete, de-identify, or isolate the applicable information.

How we share your personal information

We do not sell personal information for money. Unless you opt out (visitors in the United States) or until you accept (visitors outside the United States), we share device data and online activity data with advertising platforms for cross-context behavioral advertising within the meaning of applicable state privacy laws; you may opt out at any time through the Do Not Sell or Share My Info link in the footer of the Service or by broadcasting a GPC signal. We may share your personal information with the following parties:

• Service providers. Third parties that provide services on our behalf or help us operate the Service or our business, including website hosting and form processing (Netlify), business email (Google Workspace), analytics (Google Analytics; Microsoft Clarity), scheduling (Cal.com, where you elect to book), and customer-relationship-management and email-delivery tools.
• Advertising platforms. Unless you have opted out (United States) or until you accept (elsewhere): LinkedIn, Meta, Reddit, and TikTok, which receive device data and online activity data through their pixels as described under Tracking Technologies.
• Professional advisors, such as lawyers, auditors, bankers, and insurers, in the course of the professional services they render to us.
• Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate to comply with applicable laws, lawful requests, and legal process, or for the compliance and protection purposes described above.
• Business transferees. We may disclose personal information in the context of actual or prospective business transactions (e.g., investments in or financing of Fiberside, or the sale, transfer, or merger of all or part of our business or assets), including to prospective counterparties and their advisers, and to an acquirer, successor, or assignee of Fiberside, in which case this Privacy Policy will continue to apply to the transferred information.

We do not disclose one client's information to another client, and Exposure Check responses are not published or used in examples.

Your choices

• Opt out of marketing communications. You may opt out of marketing-related emails by following the unsubscribe instructions in any such email or by contacting us at privacy@fiberside.co. You may continue to receive service-related and other non-marketing communications.
• Analytics. Visitors in the United States may opt out of Google Analytics and Microsoft Clarity at any time, and visitors outside the United States may decline or withdraw consent for them, as described under Tracking Technologies above. Any visitor may opt out of every analytics technology by broadcasting a GPC signal, or opt out of Google Analytics alone by installing Google's opt-out browser add-on.
• Advertising / Do Not Sell or Share. You may opt out of, or withdraw acceptance of, the advertising technologies at any time through the Do Not Sell or Share My Info link in the footer of the Service, or by broadcasting a GPC signal. You may also limit advertising on each platform through its own settings.
• Declining to provide information. We need certain personal information to provide certain aspects of the Service. If you do not provide required information, we may be unable to respond to your inquiry or provide the requested result.

Other sites and services

The Service contains links to websites and online services operated by third parties, including regulators, statutes, producer responsibility organizations, and our scheduling provider. These links are not an endorsement of, or representation that we are affiliated with, any third party. We do not control third-party services and are not responsible for their actions. We encourage you to read the privacy policies of the third-party services you use.

Security

We employ technical, organizational, and physical safeguards designed to protect the personal information we collect, consistent with the New York SHIELD Act's reasonable-safeguards standard, including access limitation and encryption in transit. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information. If a breach affects your personal information, we will notify you as required by applicable law.

International data transfer

We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country. If you visit the Service from outside the United States, no analytics technology is loaded unless you accept it, as described under Tracking Technologies above.

Children

The Service is directed to businesses and is not intended for use by anyone under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected personal information from a child, please contact us and we will comply with applicable legal requirements to delete the information.

Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes, we will notify you by updating the date of this Privacy Policy and posting it on the Service, and, for material changes, noting the change on this page for thirty (30) days. Modifications are effective upon posting. The current version is available at fiberside.co/privacy.

How to contact us

• Email: privacy@fiberside.co
• Mail: Fiberside LLC, 30 N Gould St # 63390, Sheridan, WY 82801

State Privacy Rights Notice

Except as otherwise provided, this section applies to residents of U.S. states to the extent such states have privacy laws applicable to us that grant their residents the rights described below (collectively, the "State Privacy Laws"). For purposes of this section, "Personal Information" and "Sensitive Personal Information" have the meanings given to those or similar terms under the State Privacy Laws. These rights are not absolute, not all rights are available in all states, and we may decline requests as permitted by law.

Your rights. Subject to the State Privacy Laws, you may request: (i) information about the categories of Personal Information we have collected, the categories of sources, the business or commercial purposes of collection, and the categories of third parties to which we disclose Personal Information; (ii) access to a copy of the Personal Information we have collected about you; (iii) correction of inaccurate Personal Information; (iv) deletion of Personal Information we have collected from you; (v) portability of the Personal Information you provided to us in a machine-readable format; and (vi) appeal of our denial of any request validly submitted. You are entitled to exercise these rights free from discrimination as prohibited by the State Privacy Laws.

Sales, sharing, targeted advertising, and profiling. We do not sell your Personal Information for money. Unless you opt out, we share device data and online activity data with advertising platforms for cross-context behavioral advertising and targeted advertising; you may opt out at any time through the Do Not Sell or Share My Info link in the footer of the Service or by broadcasting a GPC signal. We do not use your Personal Information to engage in profiling in furtherance of decisions that produce legal or similarly significant effects.

Sensitive Personal Information. We do not intentionally collect or process Sensitive Personal Information through the Service. Please do not submit Sensitive Personal Information in free-text fields.

Consumers under 16. We do not have actual knowledge that we collect, sell, or share the Personal Information of consumers under 16 years of age.

Opt-out preference signals. We honor GPC signals as valid opt-out preference signals as required by applicable law.

Exercising your rights. You may submit requests by email to privacy@fiberside.co. We may need to verify your identity to process your request — ordinarily by confirming your control of the email address associated with the information — and we reserve the right to confirm your residency. Under some State Privacy Laws, you may authorize an agent to make a request on your behalf; we may require evidence of the agent's authority, including a valid power of attorney or your written, signed permission, and may confirm the request with you directly. We will respond within the time required by applicable law. To appeal a denial, reply to our response and we will explain the outcome of your appeal.

Information practices. The following describes our practices currently and during the preceding 12 months:

Retention. The criteria for determining retention periods are described in the Retention section above. De-identification. We do not attempt to re-identify de-identified information, except to test our de-identification processes as permitted by law.

California Shine the Light. Under California Civil Code §1798.83, California residents may request the identity of third parties to which we have disclosed certain personal information for those parties' own direct marketing purposes during the preceding calendar year. We make no such disclosures. Requests may be sent to privacy@fiberside.co with the subject line "Shine the Light Request."

Contact. If you have questions or concerns about our privacy practices, please contact us using the details in the How to Contact Us section above.

← BACK TO FIBERSIDE