We got this email at my startup. We freaked out too, we're not from California (or even the US), we're not end-user facing so usually privacy stuff goes to our

We got this email at my startup. We freaked out too, we're not from California (or even the US), we're not end-user facing so usually privacy stuff goes to our customers. We'd never received a mail like that. We responded with a kind reply, but had a lot of internal discussion. Our nice response included questions which never got answers. Because screw real people, right? Experiments like these are training well-meaning people to ignore real privacy requests.