Privacy Policy

Last updated: September 8, 2026  ·  Effective: September 8, 2026

This Privacy Policy explains how BackLocal, LLC ("BackLocal," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the BackLocal website and mobile application (the "Platform"). The Platform is intended for users in the United States. By using the Platform you agree to this Policy.

1. Scope

This Policy applies to the BackLocal website, mobile app, and related services. It does not apply to third-party services we integrate with, which have their own privacy policies (see Section 5).

2. Information We Collect

2.1 Information you provide:

Account and profile data such as your first and last name, email address, phone number, mailing/business address, business name and details, hours, photos, and the content you post (descriptions, posts, deals, ratings, reviews, owner replies). We store a securely hashed version of your password — never the plaintext.

2.2 Location information:

To power "businesses near you" search, the Platform may collect your device's precise geolocation only with your permission (your browser or device will prompt you). You can decline and search by ZIP code instead. For businesses, we geocode the business address you provide into coordinates so customers can find you. We do not persist a customer's device location after computing nearby results.

2.3 Information collected automatically:

When you use the Platform, our servers log technical data such as IP address, browser/device type, access times, referring URLs, and session details. We use a first-party session cookie to keep you signed in (see Section 4).

2.4 Payment information:

Payments are handled by our processors (Stripe, NOWPayments). We receive limited transaction data and processor identifiers (e.g., a customer or subscription ID) but do not collect or store full payment-card numbers.

3. How We Use Information

We use personal information to: provide and operate the Platform; create and manage your account; process payments and subscriptions; power search and location features; send transactional messages (e.g., account, security, billing, and subscription-renewal notices); respond to inquiries; maintain safety and security and prevent fraud; comply with legal obligations; and improve our services. We will only send promotional email if permitted, and you can opt out at any time (see Section 13).

4. Cookies and Similar Technologies

We use only first-party cookies set by our own server, all of them strictly necessary to run the Platform — which is why we do not show a cookie banner:

• Session cookie (PHPSESSID) — keeps you signed in and operates core features; deleted when you close your browser.
• Device cookie (bl_dev) — a random identifier with no personal information, set when a business owner opens the AI-assisted setup; it lets us limit how many AI drafts one device can request (abuse prevention, see Section 6). Lasts up to one year.

The website may also store small non-identifying settings in your browser's local storage (for example your light/dark preference or that you dismissed a banner); these never leave your device. When you pay, Stripe's hosted checkout page sets its own cookies under Stripe's privacy policy. We do not use third-party advertising cookies, analytics trackers, or tracking pixels. Some pages load web fonts from a content-delivery network, which may receive your IP address as part of delivering the font; no account data is shared with it. You can control cookies through your browser, but disabling the session cookie will prevent you from signing in.

5. How We Share Information — Service Providers

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share limited data with vetted service providers ("processors") only as needed to run the Platform:

• Stripe — card payment processing and subscription billing.
• NOWPayments — cryptocurrency payment processing.
• LocationIQ and OpenStreetMap / Nominatim — geocoding business addresses and ZIP codes into map coordinates.
• Email/SMTP provider — delivering transactional email (e.g., password resets, verification, billing reminders).
• Meta (Facebook/Instagram), X, and TikTok — only if a business owner connects a social account to auto-publish their own posts; we send the post content the owner chose to publish.
• Square — only if a business owner connects Square POS to apply deal discounts; we exchange order and discount data for that transaction.
• Anthropic — our AI provider, used only if a business owner chooses an AI-assisted feature (for example, drafting a business profile at sign-up). We send only the business name, website address and city/state the owner types; we do not send the owner's name, email, phone, password or account data. Anthropic processes this under its commercial API terms, which do not allow it to use our data to train its models.
• Hosting and infrastructure — our hosting provider stores Platform data.

We may also disclose information to comply with law, enforce our Terms, protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).

6. Business Website Crawler and AI-Assisted Features

When a business owner submits their own website URL, our crawler may fetch that website to import the owner's menu/services. The crawler only accesses the URL the owner provides and is restricted from internal/private network addresses.

AI-assisted profile drafting (optional). At sign-up, a business owner may choose to have BackLocal draft their profile instead of typing it. If they do, we send the business name, website address and city/state they entered to our AI provider (see Section 5), which searches the public web and reads the business's website and public listings to propose a draft: description, address, hours, keywords, service options, logo, menu or service items, and any testimonials the business publishes on its own website. Nothing is published until the owner reviews and confirms it, and every value is validated by BackLocal before it is saved. We keep a record of what was proposed, the sources used, and what the owner confirmed, so the owner can see where each detail came from. We do not copy reviews from Google, Yelp, Facebook or other third-party sites. Any testimonials imported from the business's own website are shown separately from BackLocal customer reviews, labelled as coming from the owner's website, and do not affect the business's BackLocal rating.

AI-assisted features are optional, are never used to make decisions about customers, and do not involve customer personal information. We may offer additional optional AI-assisted tools to business owners in future (for example, help writing a deal); each will be clearly labelled as AI-assisted and will follow the same rules: minimum necessary data, owner review before publishing, and no customer personal information sent to the AI provider.

7. Data Retention and Deletion

We retain personal information for as long as your account is active and as needed to provide the Platform, comply with legal obligations, resolve disputes, and enforce agreements. You may close your account at any time; closing schedules a recovery (grace) period after which the account is archived. You may also request permanent deletion of your account and associated personal data from within the app (Account → Delete account), on the web at backlocal.com/delete-account.php, or by emailing privacy@backlocal.com. We will delete or de-identify your personal data except where retention is required by law (e.g., tax/transaction records) or for legitimate fraud-prevention purposes.

We may also delete an account and its associated personal data after a prolonged lapse or non-renewal of a subscription, following advance email notice and a grace period during which you can reopen the account, as described in our Terms.

8. Security

We use reasonable administrative and technical safeguards, including password hashing (Argon2id), encryption in transit (HTTPS/TLS), and access controls. No system is perfectly secure; we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify you and authorities as required by applicable law.

9. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to: know/access the personal information we collect and how we use and share it; delete personal information we hold about you; correct inaccurate information; and opt out of the sale or sharing of personal information. We do not sell or share personal information (as those terms are defined under the CPRA), so there is nothing to opt out of, but you may still exercise your other rights. We will not discriminate against you for exercising these rights. To exercise a right, email privacy@backlocal.com; we may need to verify your identity, and you may use an authorized agent.

Categories of personal information we collect (CCPA/CPRA): identifiers (name, email, phone, mailing/business address, account and device identifiers); commercial information (subscriptions and transaction records); internet or other electronic activity (log data, searches, and interactions on the Platform); geolocation data (precise device location, only with your permission); and audio/visual information (photos you upload). The sources are you, your device, and our service providers. We collect these for the purposes described in Section 3 (operating the Platform, payments, search/location, communications, security, and legal compliance), and we disclose certain categories to the service providers listed in Section 5 for those purposes. We have not sold or "shared" any category of personal information.

Sensitive personal information. Precise geolocation is "sensitive personal information" under the CPRA. We use it only to provide the search/"near you" feature you request, and we do not use it to infer characteristics or for any purpose that would trigger the right to limit the use of sensitive personal information.

Retention. We keep each category for as long as your account is active and as needed for the purposes above; transaction and tax records are retained as required by law (generally up to seven years). After your account is deleted we remove or de-identify your personal data except where retention is legally required.

10. Other U.S. State Privacy Rights

Residents of states with comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Utah, and others) may have similar rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising or sale (which we do not do). To exercise these rights, contact privacy@backlocal.com.

11. Intended for U.S. Users

The Platform is intended for users located in the United States and is not directed to, or offered to, individuals in the European Economic Area or the United Kingdom. If you choose to access the Platform from outside the United States, you do so on your own initiative, you are responsible for compliance with your local laws, and you consent to the collection and processing of your information in the United States.

12. Children's Privacy

The Platform is intended for users 18 and older and is not directed to children or minors. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from someone under 18, we will delete it. Contact privacy@backlocal.com if you believe someone under 18 has provided us personal information.

13. Marketing Communications and Opt-Out

We send transactional messages necessary to operate your account and subscription (these are not promotional and may not be opted out of while you have an account). Any promotional email will include an unsubscribe link, and you may also email privacy@backlocal.com to opt out. We do not currently send SMS marketing.

14. Changes to This Policy

We may update this Policy from time to time. We will revise the "Last updated" date above and, for material changes, provide additional notice. Your continued use after the effective date constitutes acceptance.

15. Contact Us

For privacy questions or to exercise your rights, contact privacy@backlocal.com (or contact@backlocal.com). Mailing address: 11161 E State Rd 70 PMB 2016, Ste 110, Lakewood Ranch, FL 34202.