Services Privacy Policy

At Nachal Inc. d/b/a Liminal ("we," "our," "us"), we are committed to protecting your privacy. This Privacy Policy explains how we collect, share, use, and safeguard your personal information while delivering services to our clients or when you interact with our website, products, and services. By using our services, you agree to the practices described in this policy.

  1. Information We Collect

    We collect the following categories of Personal Information:

    Category of Personal Information Description & Examples Source Categories
    Identifiers Hashed emails, Mobile Ad IDs (MAIDs), IP addresses, Cookies, and system-generated unique identifiers (for linking individuals across devices). Directly from Consumers (via Pixels); From Clients/Partners; From Third-Party Data Providers.
    Sensitive Personal Information (SPI) Precise Geolocation Data (via polygons/wickets and resting place identification). Third-Party Data Providers, From Clients (for CDP enhancement).
    Commercial Information Records of products purchased/serviced; financing status, vehicle ownership records (Client-provided for CDP). Directly from Consumers; From Clients/Partners.
    Internet/Network Activity Browsing history, interaction with digital advertisements, and pages viewed on websites where our tracking pixels are placed. Directly from Consumers (via Pixels); From Clients/Partners.
    Inferences Profiles reflecting consumer preferences, characteristics, and audience segment membership (e.g., "in-market for a new car"). Internally Generated; From Third-Party Data Providers.
  2. Our Data Collection Practices

    A. Tracking and Profiling
    We collect data from mobile ad IDs and use tracking methods like "polygons" or "wickets" (virtual fences) to monitor physical and digital locations. We also use a "resting place" identification process to infer a device's probable home address from its movement history.

    B. Data Sourcing (Third-Party Partners)
    We collect information directly from you, from our Clients/Partners, and from Third-Party Data Providers.

    • Location Data Source (Precise Geolocation): We receive bulk daily movement data (Mobile Ad IDs and location coordinates) from our third-party, from users that have accepted the terms and conditions that allow their location data to be sold.
    • Consumer Data Source (PII and Profile Data): We receive opted in co-registration and consumer database records from third party providers. This data is the main source of truth for our PII and includes name, address, email, IP address, and opt-in timestamp, sourced from online surveys, warranty companies, and other third parties.
  3. How We Use and Share Your Information (Sale/Sharing)

    A. Data Broker and AdTech Services
    We operate as a Data Broker by creating, selling, or sharing proprietary audience segments and enriched records with our Clients for Targeted Advertising and analytics purposes.

    B. CDP Client Services (Processor Role)
    For data processed through our Customer Data Platform (CDP, e.g., Liminal CDP), we act solely as a Service Provider/Processor. This client-provided data (e.g., service records) is segregated and used only on the client's documented instructions and is not sold or shared for our own independent commercial purposes.

    C. Categories of Third-Party Partners We Share/Sell Data To
    We may Sell or Share PI with the following categories of Third-Party Partners:

    • Advertising Platforms and Exchanges: (e.g., DSPs, SSPs, Google, Facebook/Meta) for ad delivery, optimization, and measurement.
    • Data Aggregators and Data Enhancers: For verifying, enriching, and updating consumer profiles.
    • Client Businesses and Their Affiliates: (e.g., automotive dealerships) for their internal marketing, fraud prevention, and lead generation purposes.
    • Service Providers: (e.g., Cloud hosting, email service providers) who perform services on our behalf under contract.
  4. Data Security and Protection

    We take the security of your personal information seriously and implement appropriate technical and organizational measures to protect it from unauthorized access, alteration, disclosure, or destruction.

    • Encryption in Transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS protocols.
    • Encryption at Rest: Personal information stored on our servers is protected using industry-standard encryption methods.
    • Access Controls: Access to personal data is restricted to authorized personnel only, based on the principle of least privilege. Employees and contractors are granted access solely as needed to perform their job functions.
    • Infrastructure Security: Our services are hosted on secure cloud infrastructure with built-in protections including firewalls, intrusion detection, and automated threat monitoring.
    • Data Segregation: Client data processed through our CDP is logically segregated to prevent unauthorized cross-client access.
    • Incident Response: We maintain an incident response plan to promptly address any potential data breaches. In the event of a breach involving your personal information, we will notify affected individuals and relevant authorities as required by applicable law.

    While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to continuously improving our security practices.

  5. Your Rights and Choices (US State Privacy Laws)

    A. Right to Opt-Out of Sale or Sharing (Targeted Advertising)
    You have the right to direct us not to Sell or Share your Personal Information for cross-context behavioral advertising (Targeted Advertising) purposes. To exercise this right, please click the link on our website footer: DO NOT SELL OR SHARE MY PERSONAL INFORMATION.

    B. Right to Limit SPI Use
    You have the right to direct us to limit the use of your Sensitive Personal Information (SPI), including Precise Geolocation Data, to purposes necessary for our services or as otherwise permitted by law.

    C. Right to Appeal
    If we deny your request to exercise a privacy right (e.g., deletion or access), you have the right to appeal our decision. Please submit your appeal by contacting us as set out at "Contact Us" below. We will respond to your appeal within the timeframes set by Applicable Privacy Laws.

    D. State Data Broker Notices and Automated Decision-Making

    Data Broker Registration
    Nachal Inc. d/b/a Liminal is a registered Data Broker in the following states:

    • California: Registered with the California Privacy Protection Agency (CPPA) in accordance with the Delete Act (SB 362). We are fully integrated with the Delete Request and Opt-out Platform (DROP) and will process automated deletion requests via the state's centralized platform beginning August 1, 2026.
    • Texas: Registered with the Texas Secretary of State. We do not knowingly collect or process personal data from children under the age of 13. We utilize a purchaser credentialing process to ensure that data is used only for legitimate and legal purposes.
    • Vermont: Registered with the Vermont Secretary of State under 9 V.S.A. § 2446.
    • Oregon: Registered with the Oregon Department of Consumer and Business Services.

    Automated Decision-Making and Profiling
    We use automated decision-making technology (ADMT) and profiling to analyze consumer behaviors and generate our Audience Intelligence segments.

    • No Significant Decisions: Our use of ADMT is limited to audience segmentation and targeted advertising. We do not use ADMT to make "significant decisions" that result in the provision or denial of financial or lending services, housing, insurance, education, employment, or healthcare.
    • Your Rights: While our automated processing is excluded from the "significant decisions" regulatory burden, you maintain the right to opt-out of the profiling used for targeted advertising.

    How to Exercise Your Rights
    To exercise your rights to opt-out, know, or delete your information across these jurisdictions, please use the following methods:

    • Online Portal: Visit our centralized request portal at https://optoutcollectionservice.com/.
    • Interactive Web Links: Use the DO NOT SELL OR SHARE MY PERSONAL INFORMATION or LIMIT THE USE OF MY SENSITIVE PERSONAL INFORMATION links located in our website footer.
    • California DROP: Beginning August 1, 2026, California residents may also submit deletion requests through the state's DROP platform, via the link located in our website footer.

    E. Notice to Residents of Other US States (excluding California)
    This section applies to residents of US states with comprehensive privacy laws currently in effect as of January 1, 2026, including but not limited to Indiana, Kentucky, Rhode Island, Virginia, Connecticut, Colorado, Utah, Oregon, and Texas ("Other US States") and supplements the practices described in this Privacy Policy. It describes how we collect, use, and share Personal Information of such residents, and their rights with respect to that Personal Information. For purposes of this section, "Personal Information" means "personal data" as such term is defined under applicable privacy laws of such states but does not include information exempted from the scope of such laws.

    Under applicable privacy laws of such states, you may request the rights listed below.

    • Access. You can request that we confirm whether we process your Personal Information and to access that Personal Information.
    • Correct. You can ask us to correct inaccurate Personal Information that we maintain about you.
    • Delete. You can ask us to delete Personal Information provided by or obtained about you.
    • Port. You can request to obtain a copy of Personal Information that you have previously provided to us in a portable and, to the extent technically feasible, readily usable format.
    • Opt-out of sales, targeted advertising or profiling. You can opt out of the processing of your personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

    To exercise any of the above rights, you or your authorized agent may contact us using the following information and submit the required verifying information, as further described below:

    Verification
    We may require additional information from you to verify your identity before responding to your request. That verification process requires that you visit the online webform at the web address specified above and provide the requested information. You may designate an authorized agent to make a request on your behalf. To do so you must identify your initial online webform entry as originating with a designated agent, at which time we may contact you to further verify the validity of the request.

    Authorized Agent
    If you use an authorized agent to submit your request, we may require proof of the written authorization you have given. We also may require you to confirm your identity and attest to your residency of Colorado, Connecticut, Virginia or Utah in order to obtain the information.

    Time to process your request
    We will process your request within 45 days or let you know if we need additional time or cannot process your request. If you make this request by telephone, we may also ask you to provide the request in writing so that we may verify your identity. If we are unable to honor your request for any reason, we will notify you of the reason within the request time period.

    Appeals of Our Decisions
    In some states, you may appeal to us if we refuse to take action on your exercise of certain choices described above. To appeal such a refusal, please contact us using the information in the Contact Us section below with the subject line "Appeal of Refusal to Take Action on Privacy Request" and provide the relevant information in the email. If your appeal is denied, residents of certain states can contact their attorney general as follows:

    Our disclosures concerning California state consumers may be found at our CCPA Privacy Notice.

Contact Us

If you have any questions about these privacy policies contact us at:

Nachal Inc. (d/b/a Liminal)
5660 Strand Ct., Naples, FL 34110
privacy@getliminal.com