Privacy Policy

Local Perks Passport (www.localperkspassport.com) helps people find participating local businesses and the perks they offer, one destination at a time. The site is operated by [Owner to confirm: legal entity name, state of organization and mailing address].

Questions about this policy or your information: [Owner to confirm: privacy contact - our emails currently name admin@localperkspassport.com], or use our contact form.

When you create a profile or buy a Passport: your first and last name, email address, phone number, age range and a password. Your password is handled by our sign-in provider (Supabase Auth); we never see or store it in readable form.

Optional profile details you can add in Account Settings: street address, city, state and ZIP code, your Passport travel dates, and a Passport photo. Your Passport photo is kept in private storage and shown only to you, through a link that expires after an hour.

When you use your Passport: the businesses you save as favorites, the perks you redeem (which perk, where and when), the badges and punch-card rewards you earn, your notification settings, and which notifications you've read.

Business owners and staff: the business's details (name, address, phone, website, category, region, hours, description, social media links, logo and photos), the owner's name, work email and contact phone, the perks you submit, and the email addresses of staff you add. Business details you publish are shown on the business's public page once it's approved and live.

Affiliates: the details in your application (name, email, phone, state, region, social media profiles, audience size and message) and your public affiliate profile (display name, city, bio and photo - the photo is kept in publicly accessible file storage). For payouts we record the payout method and a reference; we don't collect bank account or tax ID numbers on the site.

Career applications: what you enter on our Careers page - your name, email, phone, city and state, the area you're interested in, your experience, interest and availability, how you heard about us, and anything optional you add (occupation, website or LinkedIn, local connections). A group application also includes the group's size, plans and, if you give them, other members' names - never their contact details. Only our national team can see applications. We email you a receipt and let our team know; applying doesn't add you to any marketing list. We don't collect Social Security numbers, tax documents or bank details through this form.

Contact form: your name, email address and message, which we email to our team. We keep a record that the message was delivered, not the message itself.

State waitlist: if you ask to hear when a state launches, your name and email address.

Businesses we invite to join: to find and contact local businesses that might want to take part, we keep a business's public details (name, address, website, phone, public email and social media pages, gathered from public sources such as business listings and websites), the people there we're in touch with and their work contact details, notes from our conversations, and whether each person agreed to hear from us or asked us to stop. Emails to them are sent through Brevo, which tells us whether an email was delivered, opened or clicked, and records unsubscribes and bounces so we stop emailing that address. [Owner to confirm: confirm this description and how prospects can ask to be removed]

Purchases: Passport checkout is handled by Stripe on Stripe's own payment page. We receive the order details (what was bought, the amount, any discount or referral code applied, and the payment status) - never your card number. [Owner to confirm: Passport purchases are not switched on yet; review this section before they are]

Referrals and affiliate links: which referral or affiliate code was used for a purchase or sign-up, so the right person can be credited. Affiliates see the people they referred only as a first name and last initial.

Automatically, if you allow analytics: analytics is off until you turn it on in your privacy choices (see "Your privacy choices" below). With it on, when you view our public pages we record which page (its address without anything after a "?"), its title, the time, the kind of device and browser (worked out from your browser's user agent, which isn't stored), and where the visit came from - the referring site's domain only, and any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term and utm_content), with anything that looks like an email address or phone number dropped. These records carry the scrambled lpp_vid and lpp_sid ids below, never your name, email address or account. We also count visits to business pages (once per visitor per day) and to our business launch pages, clicks on a business's website link, and the perks shown on a business page. Your IP address is used only for a moment, scrambled together with the date, to stop one source flooding our statistics; it isn't stored. Whatever you choose, our hosting provider processes standard request information, such as IP addresses, to deliver the site, and we count clicks on affiliate links (a daily total per link, with no information about you) so affiliates can be credited.

We don't use your browser's location. We don't collect your date of birth.

We use only these first-party cookies. Necessary cookies make the site work and are always on; analytics cookies are set only if you allow analytics. We don't use advertising cookies, cross-site tracking or session recording.

Site traffic statistics (analytics). If you allow analytics, we also use Vercel Web Analytics, from our hosting provider, to count visits to our public pages. It sets no cookies. It records the page's address without anything after a "?" (so no search terms, referral or affiliate codes, or links from emails), and it never records signed-in pages (your account, business and affiliate portals, admin) or one-time links such as password resets.

Our own visit statistics (analytics). If you allow analytics, we also keep our own statistics of visits to public pages (see "Automatically, if you allow analytics" above), so we can see which destinations, businesses and campaigns people find useful. They never record signed-in pages or one-time links, and only our site administrators can see them. Detailed records are kept for 400 days; after that only daily totals remain, with no visitor or visit ids. [Owner to confirm: confirm the 400-day retention period]

We also count a few steps people complete - a business registration started or finished, a business profile completed, a first perk added, a Passport checkout started or a purchase confirmed, an affiliate application sent, a career application sent, and a perk redeemed. These carry only short labels, such as the destination, how the registration was reached, whether the order was free, or whether an application was individual or group - never names, email addresses, phone numbers, passwords or codes. Only if you allow analytics are they linked to the scrambled visit id above, so we can see which pages and campaigns lead to them; otherwise they're counted on their own.

Analytics is off until you turn it on. The first time you visit we ask; you can accept, reject, or choose for yourself, and change your mind any time with Privacy Choices at the bottom of every page. Turning analytics off stops it straight away, removes the lpp_vid and lpp_sid cookies, and anything not yet sent is never sent. Your choice is kept in this browser for a year; on another browser or device, or after clearing your cookies, we ask again.

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a no to analytics: nothing optional runs, without you needing to sign in or confirm anything, and we don't ask you to override it. We don't sell personal information or use it for targeted advertising. [Owner to confirm: confirm this statement with legal review]

• To run your account, your Passports and your favorites, and to verify perk redemptions.
• To review and publish businesses and perks, and to give business owners their portal and reports.
• To send service emails: a welcome when you get a Passport or register a business, password resets, approval and review updates for business owners, and replies to messages you send us.
• To send promotional emails from participating businesses - only if you turn this on in Account Settings. Every promotional email has an unsubscribe link.
• To credit referrals and affiliates, and to keep the site secure and stop abuse.
• To see how the site is used and improve it, through the traffic statistics described above, if you allow analytics.
• To find and contact businesses that might want to join, as described above.
• Business reports show businesses totals only (views, redemptions, repeat visits), never who the visitors were.

• Participating businesses see the redemptions of their own perks. When their staff look up a Passport by its number to redeem a perk, they see the holder's first name.
• Affiliates see the people they referred as a first name and last initial.
• Service providers that run the site for us: Supabase (database, sign-in and file storage, in the United States), Vercel (hosting and, if you allow analytics, site traffic statistics), Resend (email delivery), Brevo (emails to businesses we invite to join - see below) and, once purchases are switched on, Stripe (payments).
• When the law requires it.

[Owner to confirm: whether to state that personal information is not sold or shared for advertising, and which state privacy laws (for example California's) apply]

• Turn analytics on or off any time with Privacy Choices at the bottom of every page (see Your privacy choices).
• Update your name, phone, age range and address any time in Account Settings.
• Choose which notifications you get, and turn promotional emails on or off, in Account Settings.
• Remove your Passport photo from your Passport page.
• To have your account deleted or to get a copy of your information, contact us. [Owner to confirm: how deletion and access requests are handled and how long they take - the site has no self-service deletion today]

We keep your information while your account is open. [Owner to confirm: retention periods for accounts, closed accounts, redemption records, email delivery records, business applications and career applications - nothing is deleted automatically today]

[Owner to confirm: a minimum age for accounts. The sign-up form currently offers an "Under 18" age range and doesn't ask for a date of birth]

Access to your information is limited by rules in our database, so each account can reach only its own data (and businesses only their own). No method of storing or sending information is completely secure.

When we change this policy we'll update it on this page and change the date at the top.