Privacy Policy

1. Who we are

LocalAd is operated by Kastana LLC, a company organized under the laws of the State of Oregon with its mailing address in Portland, Oregon, USA. For the purposes of privacy law, Kastana LLC is the “controller” of personal information collected through the Service. Questions about this policy or a specific data request can be emailed to hello+privacy@localad.io.

2. Data we collect

We collect only what we need to run the Service. The categories below are exhaustive. If something is not listed here, we are not collecting it.

• Account information. When you create an account we collect your name, email address, and a hashed password. You may optionally provide a business name, phone number, and physical address.
• Purchase information. When you buy a slot we record the zone, drop, slot type, ad content you submit, and the order total. Credit-card numbers are not stored by LocalAd; they are collected and processed directly by our payment processor (see Section 4 for the named sub-processor). We keep only a non-sensitive payment token and the last four digits of the card for receipts and refunds.
• QR scan events.When someone scans one of your ad's QR codes we log the timestamp, the IP address, the browser user agent, a device class derived from that user agent, and an approximate city and ZIP prefix derived from the IP. We do not collect precise GPS location. We count a repeat visit as the same visitor by comparing the IP and user agent within a 24-hour window; we do not build or store a persistent fingerprint. If the browser sends a Global Privacy Control signal we record the scan for counting purposes with the IP, user agent, and device class left empty.
• Ad design data. The business details you enter, the prompts built from them, and every AI-generated draft, whether or not you buy it. For drafts made before you sign in we also store the requesting IP address, which is how the free-generation allowance is enforced. Generated images are scanned for text so we can check them against our Ad Content Policy.
• Unfinished checkouts. While you are configuring a card we keep a draft of it on our servers: your business details, the email address you typed, the design you picked, the offer you wrote, and how far through you got. It is what lets you close the tab and come back to your work rather than start over. We also count these drafts to see how many people stop before paying. The draft is reachable only by the random token in the localad_purchase_resume cookie described in Section 6.
• Assistant conversations. If you use the in-product assistant we store the conversation, your email address where you gave one, and a flag marking messages that contained personal data.
• Lists you join. Waitlists, city-interest submissions, and sweepstakes entries store the email address you gave and whatever the form asked for alongside it.
• Offer claims from households. If someone who received a card claims an offer, we collect what the claim form asks for, which can include their name, email, phone, street address, and ZIP. That person is not our customer. We collect it to pass the claim to the advertiser and to stop the same offer being claimed twice.
• Business contact data we discovered.We build a list of local businesses to introduce LocalAd to, using public sources: business directory listings, map listings, and the business's own website. That record can include the business name, address, phone number, website, and a published business email address. Nobody on that list asked us to contact them, so every message carries an unsubscribe link and we keep a permanent do-not-contact record for anyone who uses it. See Section 5 for how to be removed.
• Privacy requests. A request submitted through this policy is itself recorded, with the email address, the request type, the notes you wrote, and the IP address it came from. That record is what proves we handled the request, so it outlives the data it was about.
• Site usage. Standard server logs capture requested URLs, referrer, response status, and timing. These logs are used for security and debugging and are retained for a short window. We run no web analytics product on the marketing site.

3. Why we collect it

• Deliver the Service. Process your purchases, generate and approve ad designs, print and mail your cards, operate the QR redirect, and show you dashboard analytics.
• Operate QR tracking. Attribute scans to the right ad, count unique visitors, and produce the analytics dashboard.
• Billing. Authorize payments via our payment processor and send receipts.
• Transactional email. Send you order confirmations, drop status updates, underfill notifications, and occasional service announcements.
• Security and fraud prevention. Detect account takeover attempts, scraping, and abuse of the Service.

4. Sharing & sub-processors

We use the following sub-processors to run the Service:

• Vercel, Inc.: Hosting and edge network for the LocalAd web application. Receives request logs, including IP addresses, for operations and security purposes. vercel.com/legal/privacy-policy
• Supabase, Inc.: Managed Postgres database and authentication. Stores your account records and ad data, encrypted at rest. supabase.com/privacy
• Stripe, Inc.: Payments. Collects and stores cardholder data on our behalf under its own privacy policy, including a saved card where you reserved a shared slot. We never see or store full card numbers. stripe.com/privacy
• Resend, Inc.: Transactional and outreach email delivery. Receives recipient email addresses, sender identity, and message bodies, and sends back delivery, bounce, and complaint events. resend.com/legal/privacy-policy
• Anthropic, PBC: The in-product assistant, ad-copy drafting, content moderation, and business research. Receives the text of the prompts we build from what you submit. Anthropic does not train on customer inputs by default. www.anthropic.com/legal/privacy
• Google LLC: Three separate services. The Gemini API generates ad images and receives the business-info inputs and the image outputs. The Cloud Vision API reads the text off a generated image so we can check it against our Ad Content Policy. The Places API returns public business listings when we build the list described in Section 2. policies.google.com/privacy
• OpenAI OpCo, LLC: Ad image generation, but only when we have switched the image model to OpenAI. Our default is Google Gemini. Receives the design brief we build from what you submit and any logo or brand photos you gave us, and sends back the finished image. OpenAI does not train on data sent through its API unless the customer opts in. openai.com/policies/privacy-policy
• Functional Software, Inc. (Sentry): Error and performance monitoring, running both on our servers and in your browser. It may receive limited request metadata. We strip personal data (email, phone, IP, address, tokens) from every event before it is sent, from the browser and from the server. Session replay, which would record what is on your screen, is switched off. sentry.io/privacy
• USPS and the print vendor for a given drop: We share the finished-ad artwork and the mailing information needed to print and deliver your cards, and nothing else. Print is contracted per drop rather than to one standing partner, so the specific vendor can differ between drops.
• Video hosts, only where an advertiser adds a video: An offer page can embed a video the advertiser supplied. Where the host is YouTube we use its no-cookie player. Vimeo and TikTok embeds follow their own policies and can set their own storage in your browser. No embed appears unless that advertiser added a video.

We do not share your data with advertising networks. We do not sell your data. We do not run marketing pixels, retargeting scripts, or third-party analytics trackers on the LocalAd site. Section 6 names the two things that do run in your browser, so you can check that sentence rather than take it. We may disclose information if compelled by law (subpoena, court order) or to protect the rights and safety of LocalAd, our customers, or the public.

5. Your rights

Use the request form at localad.io/privacy/request. It emails you a verification link, which is how we confirm the request came from you rather than from someone typing your address. You can also email hello+privacy@localad.io from the address on file.

We aim to acknowledge within 7 business days and to complete your request within 30 days, and in every case inside the deadline the law gives you: 45 days under California law and one month under GDPR. Where a request is complex enough that the law allows an extension, we will tell you we are taking one and why, before the first deadline passes.

• Access. Request a copy of the personal information we hold about you.
• Correction. Ask us to fix inaccurate or incomplete data.
• Deletion. Ask us to delete your account and personal data. We may retain minimal records required for tax, audit, or legal purposes.
• Portability. Receive your data in a common machine-readable format.
• Opt out of marketing email. Every marketing email has an unsubscribe link. Transactional email (receipts, drop status) will continue while your account is active.

6. Cookies & tracking

Every cookie LocalAd sets is listed here. There are five, all first-party, and none of them is used for advertising:

• Session cookies that keep you signed in and carry the security token for your session.
• geo, which holds the city, region, and country our host infers from your IP address so the site can show you the right zone without asking. It lasts one hour and it holds no identifier.
• localad_purchase_resume, set once you start configuring a card. It is a random value with no meaning outside our database, and it is what lets you reopen an unfinished checkout in another tab or the next day and find your work still there. It lasts 30 days and your browser will not let a script read it.
• localad_design_owner, set the first time you generate an ad design without being signed in. It is a random value that proves the drafts are yours, so we can show them back to you without making you create an account. It lasts 30 days and your browser will not let a script read it.
• localad_saved_deals, set only if you tap “save” on an offer page after scanning a card. It holds the short codes of the offers you saved, on your device, and lasts a year. Clearing your cookies clears it.

We run no marketing cookies, advertising pixels, retargeting scripts, or third-party analytics on the LocalAd site. Two other things do run in your browser and are worth naming rather than filing under an exception. Our error monitor reports JavaScript errors and page-load timings, along with the page you were on when one happened, so we can find breakage; it does not record your screen, and personal data is stripped from every report before it is sent. And an offer page shows an embedded video player only where that advertiser supplied a video, in which case the video host can set its own storage in your browser.

If your browser sends a Global Privacy Control (GPC) signal we honor it as a valid opt-out request under state law. On a scan we record the visit for counting purposes and store no IP address, user agent, or device class for it.

7. Data retention

• Account data is retained while your account is active and deleted on request (see Section 5).
• QR scan events are retained for 36 months, after which a daily job rolls them into monthly per-ad totals and deletes the underlying rows. The totals identify nobody.
• AI design drafts are retained for 36 months and then deleted by a daily job. If you ask us to delete your account before that, we will remove the link between you and any draft we have to keep, so the record that an ad was generated and reviewed survives without you attached to it. We do that by hand, as part of the request; there is no automatic account deletion on this site.
• Unfinished checkout drafts are kept until you finish the purchase or ask us to remove them. Nothing deletes them on a schedule today. If that matters to you, ask and we will delete yours.
• Purchase records are retained for the period required by tax and accounting law (generally 7 years).
• Server logs are retained for up to 90 days for security and debugging.
• Do-not-contact records (unsubscribes, bounces, complaints) are kept indefinitely and are not deleted on request. Deleting the record of your opt-out is what would cause us to contact you again.

8. Children

LocalAd is a B2B service intended for adults operating a business. The Service is not directed at children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, email hello+privacy@localad.io and we will delete it.

9. California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we have collected about you, the sources, and the purposes.
• Delete personal information we have collected (subject to the retention carve-outs in Section 7).
• Correct inaccurate personal information.
• Opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising. Note: we do not sell or share personal information as those terms are defined under the CCPA.
• Non-discrimination. We will not deny service, charge a different price, or provide a different level of quality because you exercised any right under the CCPA.

Exercise these rights by emailing hello+privacy@localad.iowith “California request” in the subject line.

10. GDPR (European Economic Area, UK, Switzerland)

If you are in the EEA, UK, or Switzerland, Kastana LLC acts as the data controller for your personal information. Our legal bases for processing are: (a) performance of the contract (your order), (b) legitimate interests (security, product improvement, fraud prevention), and (c) consent (where specifically requested, such as for marketing email). You have the rights described in Sections 5 and 9 above, plus the right to lodge a complaint with your local supervisory authority. Contact hello+privacy@localad.io to exercise any right.

11. Security

We use encryption in transit (TLS) and at rest, password hashing handled by our authentication provider, row-level access rules in the database, and audit logging of administrative actions. LocalAd is operated by one person, so administrative access is held by one person. No system is perfectly secure. If we detect a breach affecting your data we will notify affected users as required by applicable law.

12. Changes to this policy

We may update this policy as the Service, our sub-processors, or applicable law changes. The “last updated” date at the top reflects the most recent revision. For material changes we will notify active users by email or in-product notice at least 14 days before they take effect.

13. Contact

Privacy questions, access requests, and deletion requests: hello+privacy@localad.io.

Kastana LLC
Portland, Oregon, USA