Privacy Policy

Last updated: June 30, 2026  ·  Effective: June 30, 2026

This Privacy Policy explains how BackLocal, LLC ("BackLocal," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the BackLocal website and mobile application (the "Platform"). The Platform is intended for users in the United States. By using the Platform you agree to this Policy.

1. Scope

This Policy applies to the BackLocal website, mobile app, and related services. It does not apply to third-party services we integrate with, which have their own privacy policies (see Section 5).

2. Information We Collect

2.1 Information you provide:

Account and profile data such as your first and last name, email address, phone number, mailing/business address, business name and details, hours, photos, and the content you post (descriptions, posts, deals, ratings, reviews, owner replies). We store a securely hashed version of your password — never the plaintext.

2.2 Location information:

To power "businesses near you" search, the Platform may collect your device's precise geolocation only with your permission (your browser or device will prompt you). You can decline and search by ZIP code instead. For businesses, we geocode the business address you provide into coordinates so customers can find you. We do not persist a customer's device location after computing nearby results.

2.3 Information collected automatically:

When you use the Platform, our servers log technical data such as IP address, browser/device type, access times, referring URLs, and session details. We use a first-party session cookie to keep you signed in (see Section 4).

2.4 Payment information:

Payments are handled by our processors (Stripe, NOWPayments). We receive limited transaction data and processor identifiers (e.g., a customer or subscription ID) but do not collect or store full payment-card numbers.

3. How We Use Information

We use personal information to: provide and operate the Platform; create and manage your account; process payments and subscriptions; power search and location features; send transactional messages (e.g., account, security, billing, and subscription-renewal notices); respond to inquiries; maintain safety and security and prevent fraud; comply with legal obligations; and improve our services. We will only send promotional email if permitted, and you can opt out at any time (see Section 13).

4. Cookies and Similar Technologies

We use a single first-party session cookie (set by our server) to keep you logged in and operate core features. We do not use third-party advertising cookies, analytics trackers, or tracking pixels. Some pages load web fonts from a content-delivery network, which may receive your IP address as part of delivering the font; no account data is shared with it. You can control cookies through your browser, but disabling the session cookie will prevent you from signing in.

5. How We Share Information — Service Providers

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share limited data with vetted service providers ("processors") only as needed to run the Platform:

• Stripe — card payment processing and subscription billing.
• NOWPayments — cryptocurrency payment processing.
• LocationIQ and OpenStreetMap / Nominatim — geocoding business addresses and ZIP codes into map coordinates.
• Email/SMTP provider — delivering transactional email (e.g., password resets, verification, billing reminders).
• Meta (Facebook/Instagram), X, and TikTok — only if a business owner connects a social account to auto-publish their own posts; we send the post content the owner chose to publish.
• Square — only if a business owner connects Square POS to apply deal discounts; we exchange order and discount data for that transaction.
• Hosting and infrastructure — our hosting provider stores Platform data.

We may also disclose information to comply with law, enforce our Terms, protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).

6. Business Website Crawler

When a business owner submits their own website URL, our crawler may fetch that website to import the owner's menu/services. The crawler only accesses the URL the owner provides and is restricted from internal/private network addresses.

7. Data Retention and Deletion

We retain personal information for as long as your account is active and as needed to provide the Platform, comply with legal obligations, resolve disputes, and enforce agreements. You may close your account at any time; closing schedules a recovery (grace) period after which the account is archived. You may also request permanent deletion of your account and associated personal data from within the app (Account → Delete account), on the web at backlocal.com/delete-account.php, or by emailing privacy@backlocal.com. We will delete or de-identify your personal data except where retention is required by law (e.g., tax/transaction records) or for legitimate fraud-prevention purposes.

We may also delete an account and its associated personal data after a prolonged lapse or non-renewal of a subscription, following advance email notice and a grace period during which you can reopen the account, as described in our Terms.

8. Security

We use reasonable administrative and technical safeguards, including password hashing (Argon2id), encryption in transit (HTTPS/TLS), and access controls. No system is perfectly secure; we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify you and authorities as required by applicable law.

9. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to: know/access the personal information we collect and how we use and share it; delete personal information we hold about you; correct inaccurate information; and opt out of the sale or sharing of personal information. We do not sell or share personal information (as those terms are defined under the CPRA), so there is nothing to opt out of, but you may still exercise your other rights. We will not discriminate against you for exercising these rights. To exercise a right, email privacy@backlocal.com; we may need to verify your identity, and you may use an authorized agent.

Categories of personal information we collect (CCPA/CPRA): identifiers (name, email, phone, mailing/business address, account and device identifiers); commercial information (subscriptions and transaction records); internet or other electronic activity (log data, searches, and interactions on the Platform); geolocation data (precise device location, only with your permission); and audio/visual information (photos you upload). The sources are you, your device, and our service providers. We collect these for the purposes described in Section 3 (operating the Platform, payments, search/location, communications, security, and legal compliance), and we disclose certain categories to the service providers listed in Section 5 for those purposes. We have not sold or "shared" any category of personal information.

Sensitive personal information. Precise geolocation is "sensitive personal information" under the CPRA. We use it only to provide the search/"near you" feature you request, and we do not use it to infer characteristics or for any purpose that would trigger the right to limit the use of sensitive personal information.

Retention. We keep each category for as long as your account is active and as needed for the purposes above; transaction and tax records are retained as required by law (generally up to seven years). After your account is deleted we remove or de-identify your personal data except where retention is legally required.

10. Other U.S. State Privacy Rights

Residents of states with comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Utah, and others) may have similar rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising or sale (which we do not do). To exercise these rights, contact privacy@backlocal.com.

11. Intended for U.S. Users

The Platform is intended for users located in the United States and is not directed to, or offered to, individuals in the European Economic Area or the United Kingdom. If you choose to access the Platform from outside the United States, you do so on your own initiative, you are responsible for compliance with your local laws, and you consent to the collection and processing of your information in the United States.

12. Children's Privacy

The Platform is intended for users 18 and older and is not directed to children or minors. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from someone under 18, we will delete it. Contact privacy@backlocal.com if you believe someone under 18 has provided us personal information.

13. Marketing Communications and Opt-Out

We send transactional messages necessary to operate your account and subscription (these are not promotional and may not be opted out of while you have an account). Any promotional email will include an unsubscribe link, and you may also email privacy@backlocal.com to opt out. We do not currently send SMS marketing.

14. Changes to This Policy

We may update this Policy from time to time. We will revise the "Last updated" date above and, for material changes, provide additional notice. Your continued use after the effective date constitutes acceptance.

15. Contact Us

For privacy questions or to exercise your rights, contact privacy@backlocal.com (or contact@backlocal.com). Mailing address: Mailing address available on request at legal@backlocal.com.