privacy policy

This Privacy Policy explains what data [Operator legal name] (“we”, “us”) collects through notfromhere for business — the subscription dashboard on the web and in the notfromhere app — and this website, including its free public pages (together, the “Service”), why, and what choices you have.

1. data we collect from subscribers

If you sign up for notfromhere for business, we collect what you give us:

• Account details: your full name, email address, and phone number. There is no password: to log in, we email you a one-time code that expires after 10 minutes and works once. We store only a one-way hash of each code, never the code itself.
• Sign-up details: the business you sign up for (its name, location, and contact details), the plan you choose, a discount code if you enter one, and a record of the price and renewal terms shown to you and that you agreed to them.
• What you add in the dashboard: service costs, monthly sales figures, and alert settings, which stay private to you; and changes to your services, prices, and business’s details, which update your business’s public listing (Section 2).
• Messages to the AI assistant: the messages you send are used to answer you and are not kept by us afterwards, except a request you make through it to cancel your subscription or delete your account, which we record (business, email, and your reason) so a person can act on it.
• Confirming you run the business: how you confirmed it (a one-time code sent to the phone or email on the business’s listing or to an address at its website’s domain, a code placed on its website, or a manual check) and when; for a code, the phone number or email it went to; for a manual check, the note you send us. We keep only a scrambled form of emailed codes, never the code itself.
• Billing: your payment is handled by our payment processor. We receive your subscription’s plan, status, and billing dates, never your full card details.
• Session data: when you log in on the web we set a session cookie (Section 6); in the app, your login is kept in your device’s secure storage.

The public pages, including the public price map, need no account, and we do not ask visitors for a name, address, or payment details to use them. “Favorite cities” and “saved places” there are stored only in your browser’s local storage; we never see them.

2. if your business is listed

The Service lists businesses that never signed up, so their owners can compare prices with them and they can compare with others. If your business is listed, this is what you should know. When the business is a sole trader, or a listing names a person, this information is personal data.

• What we hold: the business’s name, address, phone number, email address, website, social media links, opening hours, and the names and prices of the services it offers, with the page and date each price was read and the heading it was listed under; and, from official records, whether the business is registered as a company or a sole trader, whether a licence it shows on its website is active, and whether it appears to have closed.
• Where it comes from: the business’s own public website, which we read automatically (we respect robots.txt and never log in, and we don’t read booking platforms, review sites or directories), OpenStreetMap, open places datasets such as Overture Maps and Foursquare Open Source Places, and official public records: state business registries and licence lists, the federal health-care provider registry (NPPES) and Medicare files, and the federal motor-carrier registers. Until late October 2026 we also used public business directories.
• Why, and on what basis: to give local businesses an accurate picture of the prices and services around them. We rely on our legitimate interest in providing that market comparison, and we limit it to information the business publishes for customers.
• Who sees it: anyone visiting our public map (a sole trader’s listing without its street address, phone or exact location), our paying subscribers (other local businesses), and the service providers in Section 5 that host and process it for us.
• How long: while the business is publicly listed and its website is online; we remove it when you ask, or when the information is no longer public. A business whose website no longer exists and that an official record shows as closed is hidden.
• Your choices: you can object at any time and have the listing removed on the “remove my business” page, have it corrected on the “correct my business” page, or ask for a copy of what we hold, or deletion at [contact email]. Once removed, we don’t collect the business again. Your other rights are in Section 10.

3. business contact data we use for outreach

We sometimes contact business owners directly by email to tell them about the Service, using an email address gathered from the business’s own public website or listing — never purchased or harvested from a third-party list. Every such email includes a working, one-click unsubscribe link; once you unsubscribe, we keep a record that you opted out so we don’t email that address again. You can also ask us directly at [contact email] to stop. You can object to this outreach at any time, and we then always stop. We email businesses in the United States only; we do not send this email to businesses in the European Union.

4. how we use your information

We use the information described above to:

• Provide the dashboard and the app: your comparisons, recommendations, insights, and alerts;
• Operate your account, including emailing you login codes and keeping you signed in;
• Set up and manage your subscription, check that a business is yours, and handle cancellation and deletion requests;
• Send you service email: sign-up and subscription confirmations, renewal reminders and notice of price changes, and the competitor alerts you turn on;
• Answer you through the AI assistant;
• Protect the Service against abuse (Section 9), and find and fix errors;
• Contact business owners about the Service, as described in Section 3.

Your service costs, sales figures, and alert settings are never shown to other subscribers or on the public pages. We do not use your information for advertising, and we do not build advertising profiles from it.

Our legal basis for each (GDPR article 6):

• your account, subscription, dashboard, app, alerts, service email and the assistant: performing our contract with you;
• billing records: our legal obligation to keep them (tax law);
• the record of the terms you agreed to, checking that a business is yours, and holding a listing’s contact changes for 48 hours: our legitimate interest in proving what was agreed and in protecting businesses from someone taking over their listing;
• listing businesses and their public prices (Section 2): our legitimate interest in offering a market comparison;
• outreach email (Section 3): our legitimate interest in telling businesses about the Service;
• security logging and website analytics: our legitimate interest in keeping the Service safe and working.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Price recommendations and AI insights are suggestions for you to judge.

5. third parties we share data with

Depending on which features you use, data may be processed by:

• AI providers: Google (Gemini), Groq and Mistral, whichever is available at the time. They receive public business website text, to read services and prices from it; your business’s category, location and public prices compared with the market (never its name), when you use AI analysis or news & trends; and the question you pick (nothing about your business) when you use the support assistant. We never send them the sales figures or costs you enter. See each provider’s own privacy terms; free-tier usage of some providers may be used to improve their models.
• Cloudflare: our hosting, CDN, and security infrastructure. Cloudflare processes standard web request data (IP address, request metadata) as part of operating the site.
• Supabase: our database host, where business data and subscribers’ account, sign-up, and dashboard data are stored.
• Resend: our email-sending provider, for login codes, service email, alerts, and business outreach (Section 3). It processes the recipient address and message content needed to deliver each email.
• Twilio: when you confirm you run a business by phone, it texts or calls the phone number on that business’s listing with a one-time code. It processes that phone number and the code. (We use it only once it’s switched on.)
• Our payment processor: it processes your payment details and billing address as a separate controller, under its own privacy policy.
• PostHog: product analytics and error reporting on the website (US hosting). It receives which pages are visited, which buttons are clicked, and error reports, with standard request data (IP address, browser and device type). It runs without cookies or local storage, does not record sessions, and is not used for advertising. It is not loaded for visitors in Europe, or when your browser sends a Do Not Track or Global Privacy Control signal. The app does not use it.
• Sentry: error reporting for the website, the app and our servers (EU hosting). When something breaks it receives the error message and where it happened (the page or screen, without anything after a “?”), with email addresses masked. No cookies, account or user details are sent, and it is set not to store IP addresses.
• OpenFreeMap: serves the background maps. Your browser or app requests map images from it directly, which shares your IP address and the area being shown.
• Apple and Google: distribute the app through their app stores, under their own privacy terms.
• Services that help us check business information — address lookups (OpenStreetMap’s Nominatim): only business addresses and cities are sent, never anything about you.

We do not sell your personal information, and we do not share it with third parties for their own advertising or cross-context behavioral advertising purposes.

6. cookies

This site does not use cookies for tracking or advertising. If you log in on the web, we set a session cookie that identifies your logged-in session — it is required for the account to work and is removed when you log out or your session expires. Your theme preference and any “favorite cities”/“saved places” are stored in your browser’s local storage, not a cookie. When your browser sends a Do Not Track or Global Privacy Control signal, we do not load website analytics at all.

7. data retention

We keep your account and what you add in the dashboard for as long as your account exists, and delete them when you delete your account (Section 10). A login session expires automatically after a period of inactivity. Specifically:

• login codes: 10 minutes; checks that a business is yours: 1 year (deleted automatically);
• held contact changes to a listing: 1 year after they apply or are cancelled (deleted automatically);
• removal and correction requests: 3 years after we answer them (deleted automatically), so we can show we acted;
• a removal or correction request we never answered: 1 year after it came in (deleted automatically);
• competitor alerts in a subscriber’s dashboard: 1 year (deleted automatically);
• the record of an email we sent to a listed business: 2 years (deleted automatically), so we can show an opt-out was honoured;
• sign-ups and the record of the terms you agreed to, and billing records: 7 years, as Dutch tax law requires;
• a listed business’s details: while it is listed (Section 2); a listing whose website has been unreachable for 12 months is removed;
• unsubscribes and removed businesses: kept as a short “do not contact / do not collect” record, so we keep honouring them;
• a listing we deleted (a duplicate merged into another, for example): only its source dataset’s reference is kept, so it isn’t added again;
• security logs (Section 9): only as long as needed to detect and respond to abuse, and never in our application database.

8. security

We use industry-standard safeguards appropriate to the data involved — including single-use, short-lived login codes stored only as one-way hashes, limits on login attempts and on how many codes can be requested, and checking on every request that an account may see a business’s private data — but no method of transmission or storage is 100% secure. If we become aware of a security incident that compromises your personal information, we will notify affected users and any required regulator as required by applicable law.

9. security logging

To protect the Service against abuse, requests to certain endpoints are rate-limited and failed authentication attempts are logged with the requesting IP address and the endpoint involved. These logs exist to detect and respond to abuse; they are not linked to any other data about you and are not retained in our application database.

10. your rights

If data protection law that applies to you gives you rights over your data, you can exercise them by contacting us at [contact email]:

• Access: ask what personal information we hold about you, and get a copy of it.
• Correction: ask us to correct inaccurate information.
• Deletion: ask us to delete your account, from the settings in the app or at [contact email], or any other personal information we hold about you. A person handles each request promptly and confirms by email. Some records (such as billing records, or the record of a sign-up) may be kept as described in Section 7.
• Objection: object to or ask us to restrict processing, including of a business’s information described in Section 2. You can always object to outreach email, and we then stop.
• Portability: get the data you gave us in a common machine-readable format (the dashboard’s CSV downloads, or on request).
• Opt out: we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of in that respect.
• Non-discrimination: we will not deny you service, charge you a different price, or provide a different level of service because you exercised any of these rights.

This includes rights available under the GDPR (for EU/EEA residents) and under US state privacy laws such as the California Consumer Privacy Act, as applicable to you and to us. We will respond to a verified request within the time required by applicable law (for example, 45 days under California law). You may designate an authorized agent to make a request on your behalf. Under the GDPR we answer within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority where you live.

11. international data transfers

Some of the third parties listed in Section 5 are based outside the European Economic Area (notably in the United States). Where that is the case, we rely on the provider’s certification under the EU–US Data Privacy Framework, or otherwise on the European Commission’s Standard Contractual Clauses in our agreement with it. Ask us at [contact email] for a copy of the safeguards.

12. children

The Service is for businesses and is not directed at children; subscribers must be at least 18. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age where you live), consistent with the US Children’s Online Privacy Protection Act (COPPA) and similar laws elsewhere. If you believe a child has provided us personal information, contact us at [contact email] and we will delete it.

13. changes to this policy

We may update this policy as the Service changes. Material changes will be reflected here with an updated “Last updated” date, and we will tell active subscribers by email.

14. contact

Questions about this policy, or a request relating to your data: [contact email]. This Service is operated from the Netherlands. The controller of your data is [Operator legal name], [postal address], registered with the Dutch Chamber of Commerce (KvK) under number [KvK number].