Customers, applicants, and the state of California sent it
California gave your customers rights. Someone will eventually use them.
Notice at collection, the right to know and delete, opt-out of sale — CCPA/CPRA applies to far smaller businesses than most owners assume, and the paperwork is specific.
What this actually is
California's privacy law gives consumers enforceable rights over their data and requires businesses to post specific notices, honor requests on a 45-day clock, and put required terms in service-provider contracts.
What happens if you wing it
The exposure isn't abstract: a tenant applicant, a job applicant, or a customer sends a rights request, and the clock starts whether you're ready or not. Handling it improvisationally is how small businesses end up in demand letters.
How Vouchra answers it
From your own documents. With receipts.
Vouchra's control library includes a full California privacy overlay — notice at collection, request handling on the statutory clock, opt-out and Global Privacy Control, sensitive-data rules, service-provider contract terms.
The interview establishes what you actually collect and hold; the generated policies match reality, not a template.
When a privacy questionnaire or rights request arrives, the answers come from your own filed policies, cited.
Who usually receives this
Sound familiar?
Questions
Before you ask
We're a small business — does CCPA even apply to us?
The thresholds catch more businesses than expected, and even below them, your larger partners increasingly pass privacy obligations down by contract. The interview sorts out what actually applies to you before anything is written.
Next move
Bring this exact form to the walkthrough.
Thirty minutes, your real paperwork, and you leave knowing what your gaps are — whether or not you buy.
See your own paperwork answered.
Bring a real questionnaire — an insurer's renewal, a client's spreadsheet, the processor's SAQ — and watch it answered from real policies, with citations.