Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you contact us, request a demo, complete an inquiry form, or sign up for a subscription, we collect information you provide directly, including:

• Name and business name
• Email address and phone number
• Business address and service area
• Payment and billing information (processed by Stripe; see Section 4)
• Content, images, and materials you submit for your website
• Communications with our team via email, phone, or SMS

1.2 Information Collected Automatically

When you visit localcred.co, we and our service providers may automatically collect:

• IP address and general geographic location
• Browser type, operating system, and device type
• Pages visited, time on page, and referring URLs
• Form interactions and conversion events

This data is collected through cookies, server logs, and analytics tools. See Section 5 (Cookies) for details.

1.3 Information from Business Directories (Outreach)

We may source business contact information (name, business name and phone number) from publicly available directories, including the Better Business Bureau (BBB), Google Maps and similar business registries, for business outreach. Automated AI-powered voice calls are a separate optional program and may be placed only if that program is activated and applicable requirements are met. A public listing does not by itself establish consent to a call. See Section 7 (Business Messaging) and Section 8A (AI Calling Program) for your opt-out rights.

1.4 Data in Client Services

When a business client purchases a supported add-on or scoped Operate capability, its site or system may handle information about that client's customers, staff, and other users. Depending on the agreed scope, this may include inquiry and lead details; HubSpot CRM contact records; Cal.com booking details and scheduling events; Shopify customer, cart, order, and fulfillment details; Sanity CMS content, authors, and editorial records; structured listings; and customer account profiles and activity in a client portal. The supported portal uses passwordless email sign-in links, session cookies, and security logs to authenticate users and protect access.

The business client decides what information its service needs and is responsible for notices and choices it gives its own users. LocalCred accesses and handles that information to build, host, maintain, secure, support, and export the agreed service under the client's instructions and contract. The particular data and provider accounts depend on the approved scope. A client's own privacy notice may also apply to people using that client's site or system.

2. How We Use Your Information

We use collected information to:

• Respond to inquiries and deliver our web design, hosting, and growth services
• Build, maintain, and update your website
• Configure and operate agreed booking, CRM, CMS, commerce, account, and workflow capabilities for business clients
• Process payments and manage your subscription account
• Send transactional emails (invoices, billing notices, project updates)
• Contact you about your subscription, renewals, and service changes
• Conduct outbound business development outreach via AI-powered voice calls only if the optional calling program is activated (see Section 8A)
• Monitor AI search engine citations only where the accepted order includes AI Visibility / GEO and the agreed service is activated (see Section 8B)
• Analyze usage to improve our website and services
• Comply with legal obligations and enforce our Terms of Service

We do not sell, rent, or share your personal information with third parties for their own marketing purposes.

3. How We Share Your Information

We share information only as described below:

3.1 Service Providers

We use service providers for our own website, billing, and communications and, where agreed, for client application hosting and storage in client-owned accounts. Their handling of data is governed by applicable contracts and their privacy terms. The table describes providers and possible uses. A listing does not mean every provider is currently active or receives data for every client. Optional features depend on the agreed scope and their activation controls.

AI-Assisted Workflows

LocalCred uses AI-assisted tools across development, service delivery and administrative work. Depending on the task, these tools may receive relevant client, prospect and business information, including contact details, intake and project instructions, supplied content and assets, business communications and operational records, as well as requirements, code and configuration. The information supplied depends on the work and tool; naming a provider does not mean every provider receives every field or performs every operation. AI use in these workflows does not by itself add a live AI feature to a client's site. Live AI features require their own agreed scope and data-handling controls.

LocalCred will not knowingly transmit sensitive personal data, such as payment card numbers or government-issued identification, to AI tools. Clients should flag sensitive requirements before supplying material. Provider processing, retention and any use for model training depend on the tool, account, settings and applicable agreements. This policy does not promise zero retention, no model training or that no client information reaches an AI provider.

3.2 Client-Directed Providers and Data Flows

A client may authorize LocalCred to connect its site or system to provider accounts it owns. For the fixed CRM Connection, website inquiry details can be delivered one way to the client's HubSpot account. With Managed CMS or an approved editorial capability, Sanity may hold content, images, author details, and publishing records. With booking, Cal.com holds scheduling state and receives details needed to create and manage appointments. With commerce, the client's Shopify store handles catalog, customer, checkout, and order data; LocalCred may receive limited order events to maintain the agreed integration. A client portal may store customer account and profile data and send passwordless sign-in links through an email delivery provider. Availability and exact flows depend on the client's approved scope.

For a scoped full application, a user's browser sends requests to the client's Vercel-hosted web service. Requests needing account or operational data pass to its Railway-hosted API and client-specific Railway PostgreSQL database. Where the approved capability accepts files or images, those objects may be stored in Cloudflare R2. These resources are used only when the approved client configuration calls for them; a simpler website may instead use Cloudflare Pages and Pages Functions.

These client-owned provider accounts are governed by the client's agreements and the providers' own privacy terms. LocalCred uses delegated access for the agreed service; the client controls account ownership, provider settings, and the customer-facing business policies. LocalCred does not sell client customer data for its own marketing.

3.3 Legal and Safety Disclosures

We may disclose your information if required by law, subpoena, or other legal process, or if we believe disclosure is necessary to protect our rights, investigate fraud, or respond to a government request.

3.4 Business Transfers

If North of Ash Limited is acquired, merges with another entity, or transfers substantially all of its assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website before your information becomes subject to a different privacy policy.

4. Payment Data & Stripe

Payments to LocalCred for plans, add-ons, and implementation are processed by Stripe, Inc.LocalCred does not store your full credit card number, CVV, or other sensitive cardholder data on our servers. Payment information is submitted directly to Stripe's PCI-compliant infrastructure.

Stripe may collect and retain information in connection with payment processing, fraud prevention, and its own compliance obligations, governed by Stripe's Privacy Policy (stripe.com/privacy).

Client commerce is separate from LocalCred billing. A client-owned Shopify store and its merchant/payment provider handle purchases by that client's customers. LocalCred's Stripe account is not used to collect those customer payments, and LocalCred is not merchant of record for client sales. We may process limited order status or transaction references when needed for the agreed integration, but do not receive full card details from the client checkout.

5. Cookies & Tracking Technologies

Our website may use cookies and similar technologies (pixel tags, local storage) to:

• Remember your preferences and session state
• Analyze traffic patterns and site performance
• Measure the effectiveness of our content and forms

Cloudflare Turnstile is used on our contact and intake forms to prevent automated spam submissions. Turnstile may set cookies and collect limited browser signals to distinguish human visitors from bots. No personal information is required to complete a Turnstile challenge.

You can control or disable cookies through your browser settings. Disabling cookies does not prevent use of the site but may limit certain analytics features. We do not currently respond to browser-level “Do Not Track” signals.

6. Data Retention

We retain your information for as long as your account is active, as long as is necessary to provide our services, and for a reasonable period afterward to fulfill the purposes described in this policy, including:

• Subscription records and billing history: retained for a minimum of 7 years for financial and tax compliance
• Client content and available data exports: available on request during the 30-calendar-day Exit Kit window after the managed service goes offline, per our Terms of Service (Section 4); service copies may then be deleted or anonymized
• Inquiry and contact form data: retained for up to 2 years unless you request earlier deletion
• Analytics data: retained in accordance with the applicable provider's retention policies
• AI outbound call recordings: if the optional AI Calling Program is activated and calls are recorded, those recordings (via ElevenLabs/Twilio) will be retained for up to 90 days and then deleted, unless retention is required by law or to resolve a dispute
• Prospect outreach data (business names, phone numbers, and contact information sourced from public directories for outbound voice outreach): retained for up to 24 months from collection, or until an opt-out request is honored, whichever comes first
• GEO monitoring query data: if the accepted order includes AI Visibility monitoring and the agreed service is activated, its query results and citation reports will be retained for up to 12 months to support trend reporting

After applicable retention periods, we delete or anonymize information. Limited records may be retained longer for financial or tax obligations, legal compliance, privacy and security duties, disputes, or backup cycles. Access to retained records is limited to those purposes, and retention ends when the applicable need ends. A service copy may therefore be removed after the Exit Kit window while a required billing, security, or dispute record remains.

Data in a client's operational system follows that client's agreed service, provider settings, and applicable law. The client may request available exports of its content, customer, lead, booking, and order data under the Exit Kit provisions in our Terms. Provider-held records may remain in the client's own HubSpot, Cal.com, Sanity, Shopify, or merchant account under that provider's settings and retention rules. We do not set a single retention period here for all of those different records.

7. Business Messaging & Client Communications

7.1 Message Frequency & Opt-Out

Message frequency varies based on your account activity and service needs. Message and data rates may apply.

To stop receiving SMS messages from LocalCred at any time, reply STOP to any message. You will receive one final confirmation and no further messages. For help, reply HELP to any message or contact us at hello@localcred.co.

Carriers are not liable for delayed or undelivered messages. We do not share, sell, or transfer phone numbers obtained through this program to any third party for marketing purposes.

7.2 Client Transactional Communications

Active clients may receive SMS or email communications related to their account, subscription, or service delivery. These communications are part of the service and are not marketing messages, though you may request communication preferences by contacting hello@localcred.co.

8A. AI-Powered Outbound Calling Program

The following disclosures apply only if LocalCred activates this optional program and places calls.

8A.1 Automated AI Voice Calls

When this program is activated, LocalCred uses an AI-powered conversational voice agent to make outbound telephone calls to prospective business clients. These calls are made using ElevenLabs AI voice synthesis technology, delivered via Twilio's telephony infrastructure. When you receive an outbound call from LocalCred, you may be interacting with an AI agent rather than a human representative.

Our AI Calling Program is intended for business contacts in Colorado. We may source numbers from public business directories (BBB, Google Maps, and similar registries), but a public listing or business classification does not itself establish consent to an automated call.

8A.2 Call Recording Notice

Calls made through our AI Calling Program may be recorded for quality assurance, training, compliance, and service improvement. The agent should identify itself and provide recording notice at the outset. Recording is subject to applicable consent and notice rules; continuing a call is not treated here as automatic consent to recording.

If calls are recorded, LocalCred will retain those recordings for up to 90 days and then securely delete them, unless retention is required for legal, compliance, or dispute resolution purposes. When recording is enabled, audio may be stored with Twilio. Recording references and transcripts may also be stored in Supabase. Access must be restricted to authorized LocalCred personnel.

8A.3 Opt-Out Rights

You may opt out of future calls from LocalCred's AI Calling Program at any time:

• During a call:Say “stop,” “remove me,” “do not call,” or a similar phrase. The AI agent will honor your request and add your number to our suppression list.
• By email: Contact us at hello@localcred.co with your business name and phone number.

Opt-out requests will be processed within 5 business days.

8A.4 Data Used in AI Calling

The AI voice agent may reference your publicly available business name, location, or category during the call. The agent is not intended to solicit payment information, government ID numbers, or other sensitive personal data; please do not provide it during a call. Conversation data processed by ElevenLabs is subject to ElevenLabs' Privacy Policy (elevenlabs.io/privacy).

8B. AI Visibility Monitoring (GEO) Service

8B.1 What This Service Does

If Client's accepted order includes AI Visibility Monitoring(GEO) and LocalCred activates the agreed service, LocalCred may track how Client's business is referenced across AI-powered search platforms, including ChatGPT (OpenAI), Gemini (Google), Google AI Mode, Perplexity, and similar platforms (“AI Search Engines”).

If this service is activated, LocalCred may submit periodic queries to AI Search Engine APIs or interfaces that include Client's business name, location, business category, and other descriptive information. The responses (citations, summaries, or references) are compiled and reported back to Client.

8B.2 Third-Party AI Services

When GEO monitoring is activated, queries may be sent to third-party AI platforms including OpenAI (ChatGPT), Google (Gemini), Perplexity, and others. These providers process the queries under their own terms of service and privacy policies. LocalCred does not control how those platforms handle, store, or use query data. Client business information submitted as part of GEO monitoring queries is limited to publicly available business descriptors (name, location, service category) and does not include Client's private data, payment information, or subscriber personal information.

8B.3 Data Retention for GEO Reports

If the agreed GEO service is activated, LocalCred will retain its AI citation query results and monitoring reports for up to 12 months to support trend analysis and historical reporting. After this period, reports are deleted or anonymized.

8. Your Rights & Choices

Depending on your location and applicable law, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information (subject to legal retention obligations)
• Object to or restrict certain processing
• Opt out of SMS or email marketing communications
• Request a copy of your data in a portable format

To exercise any of these rights, contact us at hello@localcred.co. We will respond within 30 calendar days. We may need to verify your identity before processing requests.

If your request concerns information in another business's site, booking service, store, CRM, or customer portal, contact that business first so it can identify the relevant records and instruct us where appropriate. We assist our clients with access, export, correction, and deletion requests for data we manage on their behalf, subject to the applicable service agreement, provider controls, and law.

Colorado residents: The Colorado Privacy Act (CPA) grants Colorado consumers certain rights with respect to personal data. These rights include access, correction, deletion, portability, and the right to opt out of targeted advertising or the sale of personal data. We do not sell personal data or engage in targeted advertising as defined under the CPA. To submit a CPA request, contact us at hello@localcred.co.

9. Security

We implement reasonable technical and organizational safeguards to protect your information against unauthorized access, loss, or misuse, including HTTPS/TLS encryption for data in transit (via Cloudflare), access controls on our systems, and use of PCI-compliant infrastructure for payment data (via Stripe).

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

10. Children's Privacy

Our services are directed at business owners and are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us at hello@localcred.co and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will publish the effective date of the approved policy and notify active clients by email at least 30 calendar days before changes take effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.

12. Governing Law and Venue

LocalCred exclusively serves businesses located in the State of Colorado. This Privacy Policy is governed by and construed in accordance with the laws of the State of Colorado, without regard to its conflict of law principles. Any dispute arising from this policy or LocalCred's data practices shall be resolved in Jefferson County, Colorado.

This venue provision does not limit privacy rights or remedies that cannot be waived under applicable law. LocalCred does not sell personal data or engage in targeted advertising as defined under the Colorado Privacy Act (CPA).

13. Contact Us

For privacy questions, data access requests, or to opt out of communications:

• Email: hello@localcred.co
• Mailing: North of Ash Limited d/b/a LocalCred.co, Colorado