Privacy Policy

Information you provide directly:

• Account information: username, email address, and password (stored as a hashed value — we never store your plaintext password).
• Contributions: tips, reviews, new listings, and corrections you submit to the directory.
• Trip plans: conversations you save and optionally make public via share links.
• Communications: messages you send to our support team.

Information collected automatically:

• Usage data: AI chat queries, search terms, and pages you visit within the Service. We track your daily AI query count to enforce free-tier limits.
• Log data: IP address, browser type, referring pages, timestamps, and error logs.
• Cookies and local storage: We use browser local storage to persist your authentication token and theme preference. We may use cookies for session management and analytics.

Payment information: All payment processing is handled by Stripe, Inc. We receive only non-sensitive billing data from Stripe (e.g., last 4 digits, card brand, expiration month/year, billing country). We store your Stripe Customer ID to manage your subscription. We never see or store your full card number, CVV, or bank account details.

• To provide, operate, and improve the Service
• To authenticate you and manage your account and subscription
• To enforce usage limits and subscription tier access
• To process payments and send billing-related communications
• To power our AI assistant (your queries are sent to Anthropic's API to generate responses)
• To conduct real-time web searches on your behalf (via Tavily) when your query requires live data
• To respond to your support requests
• To detect and prevent fraud, abuse, and security incidents
• To analyze usage trends and improve the Service's performance and features
• To send you service-related emails (account confirmation, billing receipts, important updates). We do not send marketing emails without your explicit consent.

We share data with the following third-party service providers as necessary to operate the Service:

We do not sell your personal data to third parties. We do not share your data with advertisers.

When you save a trip plan and enable the public share link, the AI conversation content of that plan becomes accessible to anyone with the link. The plan displays your username. Do not include sensitive personal information in trip plans you intend to share.

You can disable sharing or permanently delete a trip plan at any time. After deletion, the content is removed from our active database within 30 days and from backups within 90 days.

• Account data: Retained for the duration of your account. You may delete your account at any time by contacting us.
• Chat queries: We do not persist individual chat messages server-side beyond what is needed to complete the AI response. Saved trip plans are stored until you delete them.
• Billing records: Retained for 7 years as required by applicable financial regulations.
• Log data: Retained for up to 90 days.

We use browser local storage to store your authentication token (JWT) and UI preferences (theme). We may use minimal first-party cookies for session management.

We do not use third-party advertising cookies or cross-site tracking. If we integrate analytics in the future, we will update this policy and provide an opt-out mechanism.

Depending on where you live, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and associated data (subject to retention requirements for billing records).
• Portability: Request your data in a machine-readable format.
• Objection / Restriction: Object to or request restriction of certain processing activities.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at privacy@directorybro.com. We will respond within 30 days. Residents of the EU/EEA, UK, and California (CCPA) are entitled to additional protections under applicable law.

The Service is not directed at children under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we learn that we have inadvertently collected such information, we will delete it promptly. If you believe we have collected information from a minor, please contact us at privacy@directorybro.com.

We implement industry-standard security measures to protect your data, including:

• Passwords stored as bcrypt hashes — never in plaintext
• All data transmitted over HTTPS/TLS encryption
• JWT tokens with expiry for authentication
• Payment processing delegated entirely to Stripe's PCI-compliant infrastructure
• Environment variables for all secrets — never hardcoded

No method of transmission over the internet is 100% secure. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

DirectoryBro is operated from the United States. If you are accessing the Service from outside the US, your information may be transferred to, stored, and processed in the US or other countries where our service providers operate. By using the Service, you consent to such transfers. We ensure that our third-party providers maintain adequate data protection standards.

We may update this Privacy Policy from time to time. We will notify you of material changes by email (if you have an account) or by posting a notice on the Service. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

For privacy-related questions, data requests, or concerns:

DirectoryBro — Privacy Team
privacy@directorybro.com

For general support: support@directorybro.com