Privacy Policy

This Privacy Policy explains what data [Operator legal name] (“we”, “us”) collects through this website and the services offered through it (the “Service”), why, and what choices you have. The Service helps people find and compare prices for services from local businesses, using a public map/search directory, and offers a paid Enterprise plan for business owners.

1. Data we collect

Visiting the public directory itself requires no account, registration, or login, and we do not ask visitors for a name, address, or payment details to use it. “Favorite cities” and “saved places” are stored only in your browser’s local storage — they are never sent to our servers and we never see them.

If you create an Enterprise account or submit a business signup request, we collect what you give us directly:

• Account details: your full name, email address, and phone number. Enterprise accounts have no password: to log in, we email you a one-time code that expires after 10 minutes and works once. We store only a one-way hash of each code, never the code itself.
• Signup request details: the business name, location, and contact information you provide when claiming or submitting a business, and your own name/email/phone as the requester.
• Session data: when you log in, we set a session cookie (Section 7) so you stay signed in; we store a random session token to recognize that session.

2. Business directory data

The businesses, services, and prices shown on this site are not personal data about our visitors — they are information about businesses, gathered from publicly available sources (business websites, OpenStreetMap, and similar public directories). If you are a business owner and want a listing corrected, updated, or removed, contact us at [contact email].

3. Business contact data we use for outreach

Separately from the directory above, we sometimes contact business owners directly by email to tell them about the Service, using an email address gathered from the business’s own public website or listing — never purchased or harvested from a third-party list. Every such email includes a working, one-click unsubscribe link; once you unsubscribe, we keep a record that you opted out so we don’t email that address again, but we stop sending anything further. You can also ask us directly at [contact email] to stop.

4. How we use your information

We use the information described above to:

• Operate and maintain your Enterprise account, including emailing you one-time login codes and keeping you signed in;
• Review and follow up on business signup/claim requests;
• Send you service-related email, such as confirming a request or (where enabled) verifying your email address;
• Protect the Service against abuse (Section 9);
• Contact business owners about the Service, as described in Section 3.

We do not use your information for advertising, and we do not build advertising profiles from it.

5. Third parties we share data with

Depending on which features you use, data may be processed by:

• AI providers (for extracting service names/prices from business websites, and for the Enterprise dashboard’s own AI-assisted features): Google (Gemini), Groq, and Mistral — whichever is available at the time. For directory extraction, only public business website text is sent, never anything about you as a visitor. See each provider’s own privacy terms for how they handle that text; in particular, free-tier usage of some providers may be used to improve their models.
• Cloudflare: our hosting, CDN, and security infrastructure. Cloudflare processes standard web request data (IP address, request metadata) as part of operating the site.
• Supabase: our database host, where directory data and, for Enterprise users, account and signup-request data are stored.
• Resend: our email-sending provider, used to deliver account-related email (such as, where enabled, email verification) and business outreach email (Section 3). Resend processes the recipient address and message content needed to deliver that email.
• PostHog: our product analytics and error-reporting provider (US hosting). It receives which pages are visited, which buttons are clicked, and error reports from the site, along with standard request data (IP address, browser and device type), so we can see where the site breaks or confuses people. It runs without cookies or local storage, does not record sessions, and is not used for advertising.
• DuckDuckGo and Google: used server-side to help locate a business’s official website; only business names and cities are sent, never anything about you as a visitor.

We do not sell your personal information, and we do not share it with third parties for their own advertising or cross-context behavioral advertising purposes.

6. Cookies

This site does not use cookies for tracking or advertising. If you log in to an Enterprise account, we set a session cookie that identifies your logged-in session — it is required for the account to work and is removed when you log out or your session expires. Your dark/light theme preference and any “favorite cities”/“saved places” are stored in your browser’s local storage, not a cookie.

7. Data retention

We keep your Enterprise account for as long as it is active, or until you delete it (Section 10). A login session expires automatically after a period of inactivity and is removed once it does. We keep business signup requests for as long as reasonably needed to review and act on them, and as a record of having done so. Security logs (Section 9) are kept only as long as needed to detect and respond to abuse.

8. Security

We use industry-standard safeguards appropriate to the data involved — including single-use, short-lived login codes stored only as one-way hashes, and limits on login attempts and on how many codes can be requested — but no method of transmission or storage is 100% secure. If we become aware of a security incident that compromises your personal information, we will notify affected users and any required regulator as required by applicable law.

9. Security logging

To protect the Service against abuse, requests to certain endpoints are rate-limited and failed authentication attempts are logged with the requesting IP address and the endpoint involved. These logs exist to detect and respond to abuse; they are not linked to any other data about you and are not retained in our application database.

10. Your rights

If data protection law that applies to you gives you rights over your data, you can exercise them by contacting us at [contact email]:

• Access: ask what personal information we hold about you.
• Correction: ask us to correct inaccurate information.
• Deletion: ask us to delete your Enterprise account, or any other personal information we hold about you, at any time — we will process the request promptly. Deleting your account removes your login credentials immediately; some records (such as a business signup request you submitted) may be kept as our own business record as described in Section 7.
• Opt out: we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of in that respect; you can still object to or restrict other processing by contacting us.
• Non-discrimination: we will not deny you service, charge you a different price, or provide a different level of service because you exercised any of these rights.

This includes rights available under the GDPR (for EU/EEA residents) and under US state privacy laws such as the California Consumer Privacy Act, as applicable to you and to us. We will respond to a verified request within the time required by applicable law (for example, 45 days under California law). You may designate an authorized agent to make a request on your behalf.

11. International data transfers

Some of the third parties listed in Section 5 are based outside the European Economic Area (notably in the United States). Where that is the case, we rely on that provider’s own published safeguards for international transfers (such as Standard Contractual Clauses) — check the relevant provider’s own terms for specifics.

12. Children

This Service is not directed at children under 13 (or the equivalent minimum age where you live), and we do not knowingly collect personal information from children, consistent with the US Children’s Online Privacy Protection Act (COPPA) and similar laws elsewhere. If you believe a child has provided us personal information, contact us at [contact email] and we will delete it.

13. Changes to this policy

We may update this policy as the Service changes. Material changes will be reflected here with an updated “Last updated” date.

14. Contact

Questions about this policy, or a request relating to your data: [contact email]. This Service is operated from [operator's country/jurisdiction, e.g. the Netherlands].