Privacy policy

1. Who is responsible for your data

This policy explains how Nearboard handles personal data. The controller is Ricky Espinal De La Cruz (North Providence, Rhode Island 02911, USA). Privacy contact: hello@nearboard.net.

2. What data we collect

If you only visit the site (no account):

• Anonymous usage statistics. To know how many times a listing is viewed or contacted, we calculate an irreversible code for your visit from your IP address, your browser and the day, mixed with a secret. That code changes every day and does not allow your IP to be reconstructed or you to be identified. We do not store your IP in those statistics. We only count traffic that looks like people (not automated programs) and we record nothing if your browser sends the “Do Not Track” or GPC signal.
• Technical security and operation data that our hosting provider (Cloudflare) processes to deliver and protect the site, such as the IP address, the browser type and the date and time of the request.

If you create an account and publish a listing:

• Data from your Google account: your email address, your name and your language, when you sign in with Google. We do not receive your Google password.
• Listing data: business name, category, location or service area, description, hours, languages, phone, WhatsApp, contact email, social media usernames, website, logo and images. All of this is public once your listing is published.
• Subscription and payment data: the chosen plan, the dates of your subscription and a customer identifier from our payment provider. Your card details are received and stored by Stripe, not by us.
• Record of acceptance of the Terms (date, time and version) and communications with you (for example, emails about your listing or your payment).
• Reports you send about listings (the reason and the detail you write).

3. What we use the data for

• Create and maintain your account, review and publish your listing and show it to visitors.
• Charge your subscription, send you receipts and notices of renewal or payment failures.
• Send you service emails: listing received, approved, rejected (with the reason), team messages and statistics summaries. We do not send advertising or sell your email.
• Show statistics to advertisers (impressions, visits, calls) and understand how the site is used.
• Moderate content, handle reports, prevent fraud and abuse, and comply with legal and tax obligations.
• Improve the service.

If you are in a place where the law requires a “legal basis” (for example, the European Economic Area or the United Kingdom), the bases are: performance of the contract with you, our legitimate interest in operating and protecting the service, compliance with legal obligations and, where needed, your consent.

4. Cookies

We only use necessary cookies so that sign-in works (keeping your session open and protecting the Google sign-in process). Apart from the Meta pixel, which only loads if you accept it, we do not use advertising cookies or cross-site tracking cookies. Visit statistics do not use cookies. We also use Cloudflare Web Analytics to measure general site use (page views, approximate country and performance) without cookies, without fingerprinting and without following people across sites; it does not load if your browser sends “Do Not Track” (DNT) or GPC. If in the future we add additional analytics tools, we will tell you here and ask for your consent where the law requires it.

Meta pixel (optional). If you accept the cookie notice, we load the Meta pixel (Facebook and Instagram), which uses cookies to measure and improve our ads on those platforms. It does not load if you reject it or if your browser sends “Do Not Track” (DNT) or GPC. You can change your choice at any time in “Cookie preferences” at the bottom of the site.

5. Who we share data with

We do not sell your personal data and we do not share it for third-party advertising. We use providers that process data on our behalf, only to provide the service:

• Google: sign-in.
• Supabase: database and authentication.
• Cloudflare: site hosting, security and image storage.
• Resend: sending service emails.
• Stripe: subscription billing and the payment management portal.
• YouTube (Google): only if you tap “Watch video” on a listing that includes one. Until then nothing from YouTube is loaded; when you play it, YouTube receives data about your visit under its own policies (we use its player without tracking cookies, youtube-nocookie.com).

We may also disclose data if the law or a legal order requires it, to protect rights or safety or to prevent fraud, or in a sale or reorganization of the business (with notice). What you publish in your listing is public and may be seen, copied or indexed by search engines and third parties.

6. Where the data is processed

Our providers may process data in the United States and in other countries. Where the law requires it, we use appropriate measures to protect the data in those transfers.

7. How long we keep it

We keep your account and listing data as long as your account exists. If you ask us to delete it, we delete or anonymize your data, except what we must keep for legal or tax obligations (for example, payment records), to resolve disputes or to prevent fraud. Anonymous statistics may be kept in aggregate form.

8. Your rights

Depending on where you live (for example, California or other US states, the European Economic Area or the United Kingdom), you may have the right to: know what data we have about you, access it and receive a copy; correct it; ask us to delete it; limit or object to certain uses; withdraw your consent; and not be discriminated against for exercising your rights. We do not sell or “share” personal data for targeted advertising.

To exercise any of them, write to us at hello@nearboard.net from your account email. We may ask you to confirm your identity. We will reply within the deadlines required by law. You can also file a complaint with your data protection authority.

9. Security

We use reasonable measures to protect the data: encrypted connections, role-based restricted access, security rules in the database, and payments handled by a certified provider. No system is 100% secure, so we cannot guarantee absolute security. If a data breach that affects you occurs, we will notify you as required by law.

10. Minors

The service is for adult businesses and professionals. It is not aimed at people under 18 and we do not knowingly collect data from them. If you believe a minor gave us data, write to us and we will delete it.

11. Changes to this policy

We may update this policy. We will publish the new version with its date and, if the change is important, notify you by email or on the site.