Legal · Colorado

Colorado
privacy notice.

Your rights under the Colorado Privacy Act (CPA).

Last Updated: June 12, 2026

This Colorado Privacy Notice supplements Navien OptiSleep’s Privacy Policy and applies solely to residents of the State of Colorado. Navien OptiSleep (“we,” “us,” or “our”) complies with the Colorado Privacy Act (“CPA”).

I. Personal Data We Collect

Depending on how you interact with Navien OptiSleep, we may collect the following categories of personal data:

  • Identifiers (such as name, email address, phone number, and device identifiers)
  • Commercial information (including purchase history and order details)
  • Internet and application activity (including browsing behavior, site interactions, and application usage)
  • Device and application data (including device type, operating system, and diagnostics)
  • Precise geolocation data (GPS latitude and longitude, when required for application functionality)
  • Sensitive personal data collected through optional application features, including sleep-related information and audio-derived signals (such as breathing sound data), when expressly enabled by the user
  • Inferences derived from personal data (such as preferences, usage patterns, or behavioral insights)

Sensitive personal data is collected only with your affirmative consent and only for the purposes described in this Notice. Sensitive personal data is not used for targeted advertising.

II. Sources of Personal Data

We collect personal data from the following sources:

  • Directly from you (e.g., checkout forms, account inputs, customer support interactions)
  • Indirectly through cookies and similar technologies
  • Third-party vendors (such as payment processors and shipping providers)
  • Mobile applications and connected product features (e.g., device identifiers and push notification tokens)
  • Optional application features expressly enabled by you
  • Analytics and attribution tools
  • Advertising and marketing technologies
  • Affiliate and referral tracking systems
  • Consent and preference management platforms

III. Business Purposes for Processing

We process personal data to:

  • Provide, operate, and improve our products, applications, and services
  • Process orders, payments, shipping, returns, and warranties
  • Provide customer service and respond to inquiries
  • Communicate with you, including marketing communications where permitted
  • Conduct analytics and measure performance
  • Detect and prevent fraud and security incidents
  • Comply with legal and regulatory obligations
  • Provide optional features (including sleep-related functionality) that you choose to enable
  • Operate and improve product features based on aggregated usage data

IV. Third Parties With Whom We Share Personal Data

We may share personal data with the following categories of third parties:

  • Payment processors
  • Shipping and logistics providers
  • Hosting, infrastructure, and cloud service providers
  • Marketing, advertising, analytics, attribution, and communications service providers
  • Affiliate and referral tracking providers
  • Customer feedback and review platforms
  • Service providers supporting optional application features, acting solely on our behalf

Navien OptiSleep does not sell personal data in exchange for monetary compensation. However, we may process personal data for targeted advertising purposes as described below.

V. Targeted Advertising

We may process personal data (such as identifiers, device information, and Internet activity) for targeted advertising purposes.

You have the right to opt out of the processing of your personal data for targeted advertising.

You may exercise this right by:

  • Using our consent management tool available on the website, or
  • Submitting a request using the contact methods provided below

VI. Sensitive Personal Data

We may process sensitive personal data, including:

  • Precise geolocation data
  • Sleep-related information
  • Audio-derived signals used for optional functionality

We process sensitive personal data only:

  • with your affirmative consent, where required
  • to provide requested services or product features
  • for security, fraud prevention, or compliance purposes

You may withdraw your consent at any time by disabling the relevant feature or contacting us.

Sensitive personal data is not used for targeted advertising.

VII. Data Retention

We retain personal data only as long as reasonably necessary to fulfill the purposes described in this Notice, including:

  • Order records, as required for accounting and legal compliance
  • Customer service records for a limited period following resolution
  • Data subject to legal obligations, disputes, or enforcement needs

Personal data collected through optional features is retained until service termination or withdrawal of consent, unless retention is required or permitted by law.

VIII. Your Rights Under the Colorado Privacy Act

Colorado residents have the following rights, subject to certain exceptions:

  • The right to access personal data
  • The right to correct inaccuracies in personal data
  • The right to delete personal data
  • The right to obtain a portable copy of personal data
  • The right to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects
  • The right to appeal a denial of a privacy rights request
  • The right to non-discrimination for exercising privacy rights

IX. Automated Processing and Profiling

We use automated processing in connection with certain product features (such as temperature adjustments based on usage patterns).

These processes:

  • are designed to enhance functionality and user experience
  • do not produce legal or similarly significant effects

X. Global Privacy Control (GPC)

We recognize and honor Global Privacy Control (GPC) signals where required by law as a valid request to opt out of targeted advertising.

XI. Submitting a Request

Colorado residents may submit privacy requests using the following methods:

Verification
We may request information such as your name, email address, and physical address to verify your identity.

Response Time
We will respond within 45 days, with one 45-day extension where permitted by law.

Appeals
If we decline to act on your request, you may appeal that decision by contacting us using the information above.