Privacy Policy

This page explains what information Our Local Spotlight (“OLS,” “we,” “us”) collects, why we collect it, who we share it with, and how you can change your mind at any time. It’s deliberately written in plain English. If something here is unclear, email us at localspotlightinfo@gmail.com.

Who we are. Our Local Spotlight is a direct-mail and digital advertising platform operated by 9x12 Method LLC, headquartered at 27 Atlantic Ave, York, ME 03909. 9x12 Method LLC is the controller of the personal information described in this policy. We operate www.ourlocalspotlight.com and the partner landing pages, virtual postcards and local business directories accessible under /c/…, /partners/…, /local/… and /business/….

Who uses it. Our platform serves partners (the people who run community postcards), consumers (the people who scan a postcard’s QR code, redeem an offer or browse our local directories), and local businesses (businesses listed in our directories, and the owners who manage those listings). Different sections below describe what data each one encounters.

Information you give us as a consumer

When you redeem an offer or sign up for future drops:

• Your name and email address. Required so we can deliver the coupon code and so the partner who published the card can see who claimed an offer.
• Your phone number (optional). Collected only if you provide it, and used for text messages only if you also tick the separate SMS opt-in box. Providing a phone number is never a condition of redeeming an offer. See Text messages below for the full terms.
• Your opt-in choices. Whether you ticked the email checkbox (“Email me local deals from Our Local Spotlight and nearby businesses”), the SMS checkbox, and/or “Share my info with the advertiser” are stored alongside the disclosure text you saw at the time, so we can prove exactly what you agreed to.
• IP address and browser user-agent. Recorded automatically with each redemption to deter automated abuse. Never shown to partners, never sold.

Information you give us as a partner

• Account details. Your name, business name, mailing address, business email, phone, ZIP codes you mail to, and other application fields used to set up your partner account.
• Advertiser details you save. Names, logos, contact emails, contact phones, and optional Google Business Profile links for the local businesses you feature on your community cards.
• Payment information. Subscription payments are processed by Stripe. We don’t see or store your card details — Stripe does. We retain a customer ID and the most recent payment status.

Information about businesses in our directory

Our local directories list businesses, not people. A listing holds details about the business: its name, address, phone, website, hours, photos, logo, social links and a description. We gather them from:

• The business’s own website, which we read the way a visitor would.
• A Google Maps link, if one is given. We keep only the link and Google’s place ID; we ask Google for the business’s website address and read that site. We don’t copy Google’s business details or reviews.
• OpenStreetMap, to find a street address when a business’s site doesn’t show one.
• The business’s owner, or a local partner, who can add and change details.

A listing’s description may be drafted with the help of AI (Anthropic’s Claude) from the business’s own website, and the owner can change it anytime. We also keep the email address a business publishes on its own website, to confirm who runs it when someone claims the listing and to tell the business it’s listed (see Emails to businesses).

Information you give us as a business owner

• Your name, email and (optionally) phone, when you add, claim or request a listing. We use them to confirm you run the business, to sign you in, and to email you about your listing, including a few emails about getting your business featured, which you can stop any time.
• Sign-in links instead of passwords. We email you a single-use link; opening it signs you in on that device with a cookie that lasts 30 days.
• Featured payments are handled by Stripe. We don’t see or store your card details; we keep a customer ID and your subscription’s status.
• What you add to your listing: photos, offers, hours and other details, shown publicly on your listing.

When you contact a business or us

• Quote requests. Your name, email, phone (if you give it) and message are saved and sent to the people who manage that business, so they can reply. They can see it on their business page too.
• Requests to remove a listing go to our team, with your name and email so we can follow up.
• Listing requests from our advertise page (your name, email, business, ZIP code and link) are used to build your listing and email you about it.

How we use this information

• Deliver the service you signed up for — sending coupon emails, displaying partner landing pages, routing leads to partners, processing partner subscription payments.
• Send transactional emails (e.g. redemption confirmations, application updates, payment receipts) using Resend as our outbound email provider.
• Send marketing email to consumers who opted in — local deals from Our Local Spotlight and the participating businesses in their area — see Marketing email below.
• Produce aggregated and de-identified analytics about how the platform is used (for example, platform-wide scan and redemption trends) to operate and improve the service. These aggregates don’t identify you.
• Defend the platform against fraud and abuse (rate limits, bot challenges, audit logs).
• Comply with our legal obligations (preserving evidence of consent, honoring deletion requests, responding to court orders).

How and when we share your information

We never sell your personal information. We share it ONLY in the following narrow situations:

• With the partner whose card you redeemed. When you claim an offer, the partner who published that card receives your name, email, and (if you provided it) phone, so they can keep a record of who responded to their cards. This is the core function of the platform.
• With an advertiser only when you affirmatively opt in. The redemption form has a separate checkbox that says “Share my info with the advertiser so they can contact me.” That checkbox is unchecked by default. If you tick it, your name, email, and phone (if provided) are forwarded to that specific advertiser via a one-time email. They may then contact you about the offer you claimed. Untick the box to keep your info with the partner only.
• With service providers we use to run the platform. These are limited to what each provider actually needs to do their job:
  • Supabase (database hosting) — stores the data described above.
  • Vercel (web hosting) — serves the pages, processes form submissions.
  • Resend (transactional + broadcast email) — receives the recipient address and email body to deliver each message.
  • Stripe (payments) — handles partner subscriptions and Featured listing payments.
  • Anthropic (AI writing) — receives the public text of a business’s website to draft its listing description. Never consumer data.
  • U.S. Census Bureau geocoder and OpenStreetMap — receive a business’s name and address to place it on the map.
  • Cloudflare Turnstile (bot challenge) — runs the invisible check on our forms that stops automated abuse.
  • Google Places API — when a partner saves a Google Maps URL for an advertiser, we call Google to fetch the cached business profile (address, hours, rating). We don’t send any consumer data to Google.
  • Google reviews on Featured listings — when you scroll to them, we ask Google for that business’s reviews and show them as Google sends them; we don’t store them. Reviewers’ photos load from Google. This is covered by Google’s Privacy Policy.
  • Mapbox — renders the maps on partner landing pages and in the local directories. We send anonymous map-tile requests only.
• If required by law. A subpoena, court order, or written request from a law-enforcement agency we’re legally required to comply with.
• To protect ourselves and others. If we believe disclosure is necessary to prevent fraud, abuse, or imminent harm.

We don’t use cross-site behavioral tracking. We don’t share data with ad networks. We don’t participate in third-party retargeting.

Marketing email

If you tick the email opt-in checkbox when you redeem or subscribe, you join Our Local Spotlight and are added to the subscriber list connected to the partner whose card you scanned. Marketing emails are sent by Our Local Spotlight and feature local deals from that partner’s cards and participating businesses in your area — typically when a new community card drops, about once a month.

Every marketing email we send includes:

• A clear sender identification (“From” line).
• A one-click unsubscribe link at the footer that takes effect immediately and applies to every future broadcast from that partner.
• The physical postal address required by the CAN-SPAM Act (27 Atlantic Ave, York, ME 03909).

Unsubscribing from one partner does NOT unsubscribe you from another partner you also opted in to. Each partner’s subscriber list is independent.

Emails to businesses

We may send a business a few emails about its own listing, for example that it’s listed and how to claim it, at the email address published on its own website. Every one says who it’s from, includes our postal address and has a one-click opt-out. Once a business opts out, we don’t email that address about listings again.

Text messages

Text messages require their own explicit opt-in — a separate, never-pre-checked SMS checkbox on the redemption and subscribe forms. Providing a phone number alone does not opt you into texts, and neither the phone number nor the SMS opt-in is ever a condition of redeeming an offer.

Ticking the SMS box is TCPA prior express written consent for Our Local Spotlight (and the partner whose card you scanned) to text you about local deals. The disclosure on the checkbox says:

Text me local deals from Our Local Spotlight. Msg & data rates may apply; reply STOP to opt out. Consent isn’t required to redeem.

You can opt out any time by replying STOP to any message. If you want us to delete your phone number from our systems entirely, email localspotlightinfo@gmail.com.

Cookies and tracking

We use a small number of cookies, all functional or essential:

• Auth cookie (partners only) — issued by Supabase to keep partners signed in. HttpOnly and Secure.
• Business sign-in cookie (business owners only) — keeps you signed in to your business page for 30 days. HttpOnly and Secure.
• Partner referral cookie — if you arrive through a local partner’s link, remembers which partner for 30 days so they get credit if you buy a Featured listing.
• Visitor ID — a random ID set when you open a community card, kept for one year, so we can tell a return visit from a new one and connect your scans and offers. On its own it doesn’t identify you.
• Session ID — random per-tab UUID kept in sessionStorage on the consumer side. Used so a page reload doesn’t double-count as a pageview. Dies when you close the tab.

No third-party analytics, no Facebook Pixel, no Google Analytics, no advertising trackers.

How long we keep your data

• Redemption records — kept as long as the partner who owns the card keeps their account. If the partner deletes a card, the underlying redemption rows are preserved for analytics and dispute resolution. If you ask us to delete your data, we’ll remove it within 30 days regardless.
• Subscription list — kept until you unsubscribe, or until the partner deletes their account.
• Email suppression list — kept permanently. If your address has hard-bounced or been marked as spam, we preserve that record indefinitely so we never try to send to it again, which protects every partner’s deliverability.
• Consent records — kept as long as the redemption / subscription row they attach to.
• Business listings — kept while the listing is in the directory. Any business can have its listing removed with “Remove this listing” on its page: we take it down, delete its photos and logo, and keep only what we need to avoid listing it again (its website address, Google place ID and phone number). An owner can also hide their listing anytime.
• Business owner details and quote requests — kept while you manage a listing, or until you ask us to delete them.
• Partner account data — kept while the partner subscription is active and for 12 months after cancellation, after which all PII is purged.

Your rights — and how to use them

Regardless of where you live, you can do the following at any time by emailing localspotlightinfo@gmail.com from the address on file:

• See what we have. We’ll send you a copy of the personal data tied to your email address.
• Fix it. If something’s wrong, we’ll correct it.
• Delete it. We’ll remove your redemption rows, subscription rows, and any contact info — within 30 days. Note: we’ll keep your email on the global suppression list if you unsubscribed, so we never re-add you accidentally.
• Opt out of marketing email — click Unsubscribe in any email, or email us.
• Opt out of advertiser sharing — uncheck the “Share my info with the advertiser” box at the time of redemption. If you already redeemed, email us and we’ll forward a request to the advertiser to delete your record from their own list.

We don’t require an account, login, or fee for any of these requests. We may ask for one piece of identifying information (e.g. confirming you redeemed a specific offer) to make sure we’re responding to the right person.

California privacy rights (CCPA / CPRA)

If you’re a California resident, the California Consumer Privacy Act and California Privacy Rights Act give you specific rights on top of the rights above:

• Right to know. The categories of personal information we’ve collected about you in the past 12 months, the sources of that information, the purposes for collection, and the categories of third parties we’ve shared it with — all listed explicitly in this policy.
• Right to delete. See above.
• Right to correct. See above.
• Right to opt out of “sale” or “sharing.” We do not sell personal information for money. The only time we “share” in the CCPA sense is when you affirmatively tick the box to share your info with a specific advertiser at redemption time — which is itself an opt-in. To revoke that share for a past redemption, email localspotlightinfo@gmail.com with the subject line “Do Not Sell or Share My Personal Information.”
• Right to limit use of sensitive PI. We don’t collect “sensitive personal information” as the CPRA defines it (no SSNs, financial accounts, geolocation precision beyond ZIP, health, biometric, etc.).
• Non-discrimination. Exercising any of the rights above does not affect any service or pricing offered to you.

If you’re an authorized agent acting on a California resident’s behalf, please include written authorization in your request.

Other state privacy laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and the growing list of other states with comprehensive privacy laws have access to substantially the same rights described in the California section. Email us using the contact above to exercise any of them. We don’t engage in “targeted advertising,” “profiling,” or “sale of personal data” as those terms are defined in the various state laws.

Visiting from outside the US

Our service is operated from the United States. If you visit from another country, the personal information you provide is transferred to and processed in the US.

If you’re a Canadian or EU/UK resident interacting with a partner’s page, you’re entitled to the equivalents of CASL, PIPEDA, and GDPR / UK GDPR rights respectively. The mechanisms described above (email us to access, correct, delete, or opt out) apply equally. Our lawful basis for processing your information under GDPR is your consent (when you tick a box) and our legitimate interest in delivering the service you signed up for.

Children's privacy

Our Local Spotlight is a service for adults — local offers, business advertising, and marketing communications. It is not directed to children, and we don’t knowingly collect personal information from anyone under 16. If you believe a child has submitted information through one of our forms, email localspotlightinfo@gmail.com and we’ll delete it.

Changes to this policy

We’ll update this page when our practices change. Material changes that affect how we share your data will be announced via an email to all partners (and, where relevant, to consumers on the affected partners’ subscriber lists). The “Last updated” date at the top reflects the most recent revision.

Contact us

Privacy questions, deletion requests, opt-out requests, or anything else — email localspotlightinfo@gmail.com or write to: