How we handle your data

1. The short version

• We collect only what we need to deliver the build, run your subscription, and make your site work.
• We do not sell your data. Ever. To anyone.
• We use Stripe for payments, Supabase for data storage, Resend for email, and Vercel for hosting. Each one is bound by its own privacy policies.
• For any client receiving monthly reports, Google Business Profile data may be read only after the owner authorizes the exact profile. Live reports remain transient. With a separate monthly-reporting addendum, we may retain one bounded aggregate summary per completed month; we do not retain raw profile payloads, daily metric points, search terms, review text, reviewer identity, provider cursors, or checkpoints, and we never turn Google API data into website testimonials.
• You can request a copy or deletion of your data at any time by emailing support@localcraftdigital.com.

2. Who we are

LocalCraft Digital is an Illinois sole proprietorship operated from Edwardsville, IL. We can be reached at support@localcraftdigital.com or (314) 246-9224.

3. Information we collect

3a. Information you give us directly

• Contact information: name, business name, email, phone, best time to call.
• Intake form responses: business details, services, hours, brand voice, photos, and other content you submit so we can build your site.
• Payment information: Stripe handles your card data directly. We receive only a token, the last four digits, card brand, and billing zip from Stripe; we never see or store your full card number.
• Account credentials: if you create a client dashboard account, your email and a hashed password (managed by Supabase Auth).
• Communications: emails, texts, and call notes when you reach out to support.

3b. Information collected automatically when you visit localcraftdigital.com

• Standard server logs via Vercel: IP address, browser type, pages visited, referrer, timestamps. Used for security and basic site analytics. Retained 30 days.
• Affiliate referral cookie (lc_ref): if you arrive via a partner referral link, we set a 30-day cookie to attribute the referral.
• Theme preference (lc-theme): a cookie that remembers your light/dark mode choice. No personal data.
• Stripe may set its own cookies on the checkout pages for fraud detection. See Stripe's privacy policy.

3c. Information collected by the tracking pixel on YOUR site (if you are on a monthly plan)

If LocalCraft Digital built your website and you are a paying client, your site includes a lightweight tracking pixel (track.js) that records visitor activity so you can see leads, conversions, and traffic patterns in your dashboard. The pixel collects:

• Page views (URL path, referrer, timestamp)
• Click events on links and buttons
• Phone-link taps, email-link taps, SMS-link taps, map-link taps
• Form submissions (we capture the fact a form was submitted; form contents go to your inbox via your form provider, not to us)
• Scroll depth on long pages
• Visitor IP address and user agent for spam detection

The pixel respects the visitor's Do-Not-Track browser setting and the prefers-reduced-data media query. It does not use third-party cookies, fingerprinting, or any cross-site tracking. We do not sell, share, or use this data for advertising. It exists solely to populate your dashboard and is bound by the same retention and access rules as your other account data.

3d. Google Business Profile reporting and independent testimonials

When our administrator connects the approved jake@localcraftdigital.com Google account, we request the business.manage permission. Google does not offer a narrower read-only scope, so our application restricts itself to a fixed set of read requests. For a client receiving monthly reports, we use that access only after recording the owner's authorization and confirming that the exact Business Profile ID supplied during setup points at the client's current live-site domain and has the owner-confirmed name. Setup probes that exact ID directly. If Google does not resolve accounts/me for a Manager-held profile, the server may transiently read at most 40 account resource names and probe only the unchanged profile ID beneath those account parents; it does not list sibling profiles, retain or return that account inventory, or use this discovery during routine reporting.

We encrypt that exact account/location locator at the application layer before storing it and keep a separate keyed, non-readable fingerprint only to prevent duplicate bindings. Its plaintext value is not stored, logged, or returned to the browser after setup. While authorization is active, the server decrypts it only in memory to address the exact approved profile. The live report may compare current profile details with facts the owner previously supplied to LocalCraft, identify profile-completeness or consistency findings, and display current Google performance metrics and search terms.

Live Google profile content, reviews, metrics, search terms, and derived findings are held only in memory for that request. If the owner separately approves the versioned monthly-reporting addendum, a scheduled read may store one summary per completed calendar month containing only aggregate profile appearances, call clicks, website clicks, direction requests, bookings, average rating and review count, derived finding-severity totals and bounded finding rule keys, the reporting month, and observation timestamps. That summary may be included in the client's governed monthly report. We do not store raw profile or review payloads, daily metric points, search terms, review text, reviewer identity, place IDs, API cursors, or provider checkpoints. Google data is not sent to source control, used to create an automated website-change task, compared with testimonial inventory, or used to select or publish a testimonial.

We retain the LocalCraft evidence needed to govern access: the client and site, owner-confirmed profile label and live domain, authorization wording and evidence reference, lifecycle timestamps, and any obligation and evidence showing that our Manager permission was removed. Withdrawal revokes application authorization immediately, and any report result racing with withdrawal is withheld. The encrypted locator is then restricted to Manager-removal verification. Verified completion deletes it immediately; at the seven-business-day deadline it becomes inaccessible to the application and is queued for automated deletion.

Website testimonial work is a separate process. An administrator must enter the exact quote and attribution from a documented source outside any Google API response, identify that independent source record and submitter, and attest that the submitter has publication authority. We store that submitted content and audit information in Supabase. Once authorized, our governed publishing system may place the exact submitted quote in a customer's private website repository and email our administrator metadata about the resulting pull request. Nothing is merged, deployed, or made live without a later release instruction.

4. How we use the information

• Build, deliver, and operate your website.
• Run your subscription (recurring billing via Stripe, sending receipts, notifying you of failed payments).
• Provide support, answer questions, troubleshoot issues.
• Send transactional emails (order confirmations, password resets, magic links).
• Improve our service, internal analytics, and the build process.
• Provide owner-authorized Google Business Profile audit and performance reporting for clients receiving monthly reports, including a separately authorized bounded monthly aggregate, without using Google data for testimonial selection or website publishing.
• Document publication rights and prepare governed website changes for testimonials supplied independently of Google APIs.
• Detect and prevent fraud, spam, and abuse.
• Comply with legal obligations.

We do not use your data to train third-party AI models, sell your contact list, or run targeted advertising.

5. Who we share information with

We share information only with vendors required to operate the service. Each is bound by data-processing terms with us. None resell your data:

• Stripe handles payment processing. stripe.com/privacy
• Supabase handles database and authentication. supabase.com/privacy
• Resend handles transactional email delivery. resend.com/legal/privacy-policy
• Vercel handles site hosting and DNS edge. vercel.com/legal/privacy-policy
• Google Workspace runs internal email at localcraftdigital.com addresses we operate from.
• Google Business Profile API supplies current listing, review, performance, and search-term information for authenticated, owner-authorized live reporting and the separately authorized monthly aggregate. Only that bounded aggregate is stored in Supabase and used in monthly client reporting; we do not send raw Google API content to our other vendors or use it in testimonial publishing. See Google's Privacy Policy.

We may also disclose information when required by law, valid subpoena, court order, or to protect rights, property, or safety.

6. Cookies

localcraftdigital.com sets minimal first-party cookies for affiliate attribution (lc_ref, 30-day) and theme preference (lc-theme, persistent). Stripe sets its own cookies on payment screens for fraud prevention. We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking.

7. Data retention

• Active client data (account, subscriptions, intake submissions, tracking events): retained as long as your account is active.
• Independent testimonial submissions and publication records: retained as customer website content and its supporting authorization while the account is active, then handled under the cancellation schedule below unless law or an active release requires longer preservation.
• Google Business Profile API content and derived findings: live report content is not retained after the authenticated request. A separately authorized monthly summary retains only the bounded aggregates and finding rule keys described in section 3d while both the profile authorization and addendum remain active. Those summaries are deleted when either authorization stops; the authorization evidence is retained for audit. The exact account/location locator is stored only in application-encrypted form, with its keyed anti-duplication fingerprint, while authorization is active. After withdrawal the locator can be used only to verify Manager removal until verified completion or the seven-business-day deadline. Verified completion deletes it immediately; at the deadline both the encrypted locator and fingerprint become application-inaccessible and are queued for the scheduled deletion worker. A failed deletion is retried. The shared OAuth credential is retained until the administrator disconnects Google or the grant is revoked. Owner authorization and Manager-removal evidence are retained with the client account lifecycle.
• After cancellation: account and tracking events retained for 90 days, then deleted unless you request earlier deletion.
• Payment records: retained for 7 years for tax and audit purposes.
• Server logs: 30 days.

8. Your rights

You have the right to:

• Access your data. Request a copy of everything we hold on you.
• Correct inaccurate information.
• Delete your data (subject to legal retention requirements like the 7-year payment record).
• Export your data in a portable format.
• Object to certain uses.
• Withdraw consent at any time where processing relies on consent.

To exercise any of these, email support@localcraftdigital.com. We respond within 30 days.

An eligible client owner can separately stop monthly Business Profile enrichment; that deletes the stored monthly summaries and stops scheduled collection while leaving an otherwise active live, no-store authorization in place. The owner can also withdraw Local Presence completely from account Settings. Full withdrawal revokes application authorization immediately, and any racing report result is withheld. LocalCraft must remove jake@localcraftdigital.com as Manager from that client's profile within seven business days and record completion evidence. During that period the encrypted locator is available only for removal verification. Verified completion deletes it immediately; at the deadline it becomes inaccessible to the application and is queued for automated deletion. If the obligation remains overdue after the deadline, completion relies on explicit manual evidence rather than profile discovery. Our administrator can also disassociate the shared Google connection from the Integrations screen, which removes LocalCraft's stored connection credentials and stops Business Profile access for every client. The grant can also be revoked from the connected Google account. A customer may ask us to correct or delete an independent testimonial submission by using the contact address above.

9. California residents (CCPA/CPRA)

California residents have the same rights described in section 8, plus the right to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of, but you can still contact us to confirm.

10. Children

Our services are not directed at children under 13. We do not knowingly collect data from children. If you believe we have collected information from a child, email us and we will delete it.

11. Security

We use industry-standard practices to protect your data: TLS encryption in transit, encrypted-at-rest storage at Supabase and Stripe, application-layer authenticated encryption for the exact Google Business Profile locator, hashed passwords, and row-level security policies enforcing tenant isolation. No system is perfectly secure; we cannot guarantee against every threat, but we work to address incidents promptly and notify affected users when required by law.

12. International users

We are based in the United States. If you visit the site from outside the US, your information is transferred to and stored in the US. By using the service, you consent to that transfer.

13. Changes to this policy

We may update this policy. If a change is material, we will notify you by email at least 30 days before it takes effect. The "Last updated" date at the top reflects the most recent version.

14. Contact

Questions or to exercise your rights:

LocalCraft Digital
Edwardsville, IL
support@localcraftdigital.com
(314) 246-9224

Effective October 22, 2026. See also our Terms of Service.