Privacy Policy

Newsletter signups. When you subscribe to our newsletter we collect your email address, the exact consent wording shown to you at signup, your IP address, your browser user agent, and the date/time of subscription. We store this record so we can prove your consent and honor unsubscribe requests.

QR scan tracking. When you scan a QR code on one of our printed postcards, we log the campaign, referring page, the browser user agent, and a pseudonymized hash derived from your IP address using a rotating server-only secret. This hash is used to deduplicate scans and detect abusive traffic for billing integrity. We do not store the raw IP address of scan traffic.

Basic site analytics. Standard server logs and application error reports may record IP addresses, user agents, and URLs visited on a short-term basis to keep the site running and secure.

Accounts, orders, and reviews. If features requiring an account are enabled for your session (e.g. ordering, seller/restaurant/driver onboarding, reviews, wishlists), we collect the personal information needed to operate those features (name, email, phone, delivery address, order contents, review text, etc.). These features are not part of the current limited launch of the public site.

We collect personal information only to: (a) provide the specific service you requested; (b) communicate with you when you opted in; (c) measure campaign performance for the local businesses we serve; (d) prevent fraud and abuse; and (e) meet legal obligations.

We keep newsletter subscription records for as long as you remain subscribed and for a reasonable period afterward to prove your prior consent and honor suppression lists. QR scan records are retained only as long as needed to report campaign performance to the relevant client and for billing/audit purposes. You may request deletion at any time, subject to legal exceptions.

We use the following service providers (“subprocessors”) to run this website. Each is contractually obligated to process personal information only to provide services to us:

• Supabase — database, authentication, and file storage.
• Stripe — payment processing (used only when purchase/checkout features are enabled for a given user or launch phase).
• Google Maps — mapping, geocoding, and delivery-tracking display (used only when delivery/dispatch features are enabled).
• Jotform — hosts our business application and spotlight forms; processes the business and contact details you enter, any photographs you upload, and your media-release responses, and emails your submission to us.
• PostHog — website analytics. It helps us understand how people find and use the site (which pages are visited, which links are clicked). We have session recording turned off, and it does not collect the content of anything you type into our forms.

This is not an exhaustive list of third-party service providers used by the underlying platform, and may change as our services evolve.

We do not sell your personal information and do not share it with third parties for cross-context behavioral advertising, as those terms are defined under CCPA/CPRA.

If you are a California resident, you have the right to:

• Know what personal information we have collected about you and request a copy (right to access).
• Request that we delete personal information we hold about you (right to deletion).
• Request that we correct inaccurate personal information (right to correction).
• Opt out of the sale or sharing of your personal information (right to opt out).
• Not be discriminated against for exercising any of these rights.

To exercise any of these rights, please submit a request through our Privacy Request form. We will contact you at the email address you provide to verify your identity before processing. We will respond within 45 days of receiving a verifiable request, as required by California law.

You may also designate an authorized agent to make a request on your behalf. We may require the agent to provide proof of your written permission and, in some cases, may require you to verify your own identity directly with us.

Questions about this policy or your personal information should be sent to supportlocalca@gmail.com.