trust & privacy
What we collect
The current product may collect business and contact information through the public directory, owner submission flows, and lead forms.
- business listing details such as name, city, website, booking link, phone, and hours
- owner request details when a business submits or updates a listing
- account details needed for sign-in or listing management when authentication is enabled
- time-limited verification and password-reset tokens, stored as hashes and consumed once; account emails are delivered through Mailjet when configured
- short-lived security counters to limit repeated sign-in and account requests. These use keyed hashes of request identifiers, rather than storing raw IP addresses or emails in the counters. Limits expire within 24 hours; expired counters are removed in batches as further account requests arrive.
- search inputs such as postal code, radius, and service type used to return nearby results
- first-party rating and review submissions, including moderation status
- hashed viewer signals used to dedupe public listing page-view counts
- listing views, website, booking-link and phone-link clicks, and sponsored placement appearances and clicks
Why we collect it
External Google Analytics scripts are not loaded. Account recovery links and tokens are not sent to an external page tracker. Listing performance reporting uses the first-party events described here.
We collect data to operate the directory and support core user actions.
- to publish and maintain accurate business profiles
- to review and process listing submissions, corrections, and claim requests
- to power location-based search and directory filtering
- to support account access when owners manage listings directly
- to moderate public reviews and prevent duplicate rating abuse
- to show aggregate listing page-view signals without storing raw IP addresses
- to give authenticated business owners aggregate performance counts for their own listings
Listing performance measurement
Our own event endpoint records a listing identifier, action type, timestamp, and a keyed hash used to count each action at most once per estimated visitor, listing, and UTC day. The hash is computed from the connection address and browser user-agent in memory. Raw addresses, browser strings, full referrer URLs, and booking details are not stored in these engagement records.
These events use no analytics cookies or browser storage. The collector respects Do Not Track and Global Privacy Control signals and skips recognized automated user-agents. Counts are approximate and do not confirm that a call or booking occurred.
Engagement records are stored in our Neon-hosted database and processed by our application on Vercel. Owners receive totals for their own listings over the last 30 UTC calendar days; they do not receive visitor identifiers or individual event records. These events are not sent to business booking systems or advertising providers. Our retention target for these individual event records is 90 days. A daily cleanup removes older records in bounded batches; failed runs or a backlog can delay deletion. The 30-day reporting window is separate from this retention period.
Business promotion requests
When a signed-in business owner requests a Featured Business promotion, we store the account and listing association, optional message, and submission date. Administrators use these details to review the request. Requests are not public and do not start a payment, subscription, placement, or automatic email campaign. They remain until an administrator removes them or the associated account or listing is deleted. Please do not include customer or treatment information.
Paid business promotion
If you choose a paid promotion, Stripe hosts checkout and billing management and processes your payment details. We store the owner and listing association, Stripe customer, subscription and checkout identifiers, billing status and period dates. We also keep processed webhook identifiers to prevent duplicate processing. Card details are not stored in our application. These records support billing, cancellation and payment support and remain until an administrator removes them.
Listing updates
We try to keep listing details current, but business information can change over time.
Businesses can request corrections or updates through the claim or listing request pages.
Maps, external links, and third parties
The search experience may use OpenStreetMap-based mapping and geocoding services to resolve postal codes or map clicks into nearby results. Transactional emails for account and owner claim workflows may be sent through Mailjet. Listing pages also link to external business websites or booking pages. Those external destinations have their own privacy practices and terms.
Retention and correction
We aim to keep listing details current, but some information may become outdated between updates. If you want a listing corrected or claimed, use the public claim or listing request pages.
Business billing addresses
When you purchase Featured Business, we collect the recipient business name and billing address to determine eligibility and apply Ontario HST. We send that address and your account email to Stripe for checkout, subscription invoices and tax records. The address is not added to your public listing or stored in our directory database. Stripe retains billing records under its retention requirements. Contact us through the contact page to request a billing correction or discuss an address change before your next renewal. Payment card details are entered directly in Stripe.
Policy updates
If analytics, cookies, advertising systems, payment flows, or owner-management features are added or changed, this page should be updated to reflect that.