Privacy Policy

Last updated November 12, 2026

This policy explains what Your Local Business does with information when you use the service at yourlocalbusiness.org. Your Local Business is operated by Hector Heredia. The product is a workspace for local businesses: accounts, business profiles, pages, marketing drafts, and connections to services you choose (such as Gmail, Outlook, email tools, social networks, and ad accounts).

The interface sometimes shows the name as one word, “Yourlocalbusiness.” It is the same service.

Who this covers

This policy covers people who create an account, and the businesses they add. It also covers anyone who emails us. It does not change the privacy terms of Google, Stripe, or any other service you connect. Those services have their own policies.

Children

Your Local Business is not for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, email hectorheredia242@gmail.com and we will delete it.

Information you give us

• Account. An email address and a password. Sign-in is handled by our database host (Supabase). We do not keep a copy of your password in the product’s own documents. You may also set a name and other profile details.
• Business content. What you type or upload for a business: names, brand details, offers, posts, pages, images, and similar material. That content is stored so the workspace can show it back to you and, when you ask, publish or send it.
• Messages to us. If you email the operator, we keep that correspondence so we can reply.

Accounts you connect

You can connect services so the product can act for that business. Each connection is stored for your account only, separate from other customers. The tokens and credentials needed to act for you are kept on the server in encrypted storage. The app does not show those secrets back to the browser.

• Gmail. If you connect Gmail, Google asks you to allow sending mail (gmail.send) and to share the mailbox address (OpenID and the email identity scope). We store the access token, the refresh token, when the access token expires, the granted scopes, and the mailbox address. We use them only to send mail you later start from the product, and to show you which mailbox is connected. We do not ask to read your inbox, and the app cannot read it.
• Outlook. If you connect Outlook (a Microsoft personal, work or school account), Microsoft asks you to allow the app to send mail as you (Mail.Send), to sign you in and read your basic profile (User.Read, openid, email), and to keep access when you are away (offline_access). We use the profile only to read the mailbox address. We store the access token, the refresh token, when the access token expires, the granted permissions, the mailbox address, and when you connected. We use them only to send mail you start from the product, and to show you which mailbox is connected. We do not ask to read your mail, and the app cannot read it. Microsoft does not let an app withdraw its own access, so when you disconnect we delete the tokens here; to remove the app at Microsoft as well, use account.live.com/consent/Manage for a personal account, or myapps.microsoft.com (or your admin) for a work or school account.
• Omnisend. If you connect Omnisend, we store that connection so the product can create email drafts in your Omnisend account and read email statistics. The product does not send those campaigns for you.
• Social accounts. Facebook, Instagram, LinkedIn, TikTok, X, and YouTube connections go through Upload-Post (TONVI TECH SL, Spain). Upload-Post holds the network login. We store which accounts are connected to which business so we can post after you confirm, and so we can show that business’s own stats.
• Ad accounts. Meta, Google, LinkedIn, TikTok, Pinterest, Reddit, and Microsoft ad connections go through Zernio. We use them to read results and, when you confirm, to launch or change campaigns on your own ad account. Ad spend is billed by the ad network to you, not by us.
• Other tools. A booking tool or CRM is connected only if the operator turns that option on (through Nango). Gmail and Outlook never go through that option.

You can disconnect a service in Settings → Connected accounts. Disconnecting deletes the tokens we hold and, where the provider allows it (Google does, Microsoft does not), asks the provider to revoke the grant. Deleting your account does the same.

Data from Google and Microsoft

Your Local Business’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We hold information from Microsoft’s APIs to the same rules.

• We use information from your Google or Microsoft account (your mailbox address and the access tokens) only to send the emails you start in the product and to show which mailbox is connected.
• We do not sell it, use it for advertising, or give it to anyone else, except as needed to run this feature (our hosting and database providers below), to comply with the law, or with your permission.
• People do not read it, except with your permission, for security, or to comply with the law.
• We do not use information from Google or Microsoft APIs to develop, improve or train artificial intelligence or machine-learning models, ours or anyone else’s, and we do not send it to AI model providers.

Outreach recipients

A customer can use outreach to find other businesses and email them, one at a time, from the customer’s own Gmail or Outlook mailbox. For the people who receive those emails, the customer’s business is responsible for the email (the controller), and we process the information for that customer.

• What we process. Public business information from a maps listing (the business name, category, address, website, and public business phone line) and one general business address on that business’s own website domain, such as info@ or hello@. We never look up a named person’s address, and we do not keep names, job titles or social profiles that a data vendor returns. We also keep where the address was found, the result of a deliverability check, which emails were sent and when, and whether the recipient asked to stop or said they were interested.
• Where it comes from. The business’s own website and public listings, through treg, a data service, and the vendors it calls for us: a maps listing search, Hunter (general business addresses) and an email checker.
• Why. To let the customer offer a business-to-business service, partnership or press note to another business (legitimate interest). Every email names the sender and its business, carries the sender’s postal address, and has a link to stop further emails.
• Your right to object. Use the “Don’t email me again” link in any email. It works without signing in, for as long as we keep the email’s record. The address is then blocked for every business of that customer: we keep only a one-way hash of it so we can refuse future sends, never the address itself. You can also write to hectorheredia242@gmail.com.
• How long. Leads that were never emailed are deleted after 12 months. Records of sent emails are kept for 24 months, and the recipient’s address in them is cleared 60 days after sending. The “do not email” hashes are kept until the customer’s account is deleted.
• Email lists. An address is added to the customer’s email marketing tool only if its owner clicked “yes” and ticked the separate box asking to join the list.

Payments

Paid plans are processed by Stripe. Stripe collects your card. We do not store full card numbers. We keep what we need to run the plan: the plan name, status, renewal, business slots, and Stripe’s customer and subscription identifiers. For a plan’s trial (one per person and card) we keep keyed hashes of the email address and the card’s fingerprint, never the address or the card. Receipts stay with Stripe.

If an affiliate referred you, we record which affiliate and the commission on your payments. This doesn’t change your price. We also add the affiliate’s id and the referral’s id (ylb_aff, ylb_ref: random ids, no name or email) to your Stripe Checkout and subscription as metadata, so the payment can be checked against our records.

Usage and billing records

We keep records of plan limits and of usage that the product meters (for example analytics calls, posts, and similar counts), tied to an opaque customer tag rather than putting your email in every row. Those records are how the product applies caps and how the operator can bill. They are not sold.

We count sign-up steps (for example, finished setup, started a trial) to see where people stop. The counts are tied to the same opaque customer tag, without your email or name, and stay after an account is deleted. No third party gets them.

What is sent when you use a feature

• AI tools. Text, images, or other material you submit to a writing, image, video, or assistant feature is sent to the model provider configured for that feature, so it can return a result. Which provider is in use depends on the keys turned on for the app.
• Posting and ads. When you confirm a post or an ad change, the content you confirmed is sent to the network, through the connector named above.
• Pages and analytics. A page you publish is served to its visitors. To show rank, Maps, or Search Console numbers, we may send a page address or a public social handle to the data service the app uses for that lookup.

Why we use this information

• To run your account and show you your businesses.
• To do the thing you asked: draft, publish, connect, post, or prepare a send.
• To take payment, apply plan limits, and keep billing records.
• To protect the service: sign-in, rate limits, and checks that a connection you started is finished in the same browser.
• To answer you when you write to us.

We do not sell personal information. We do not use your connected mailbox, social accounts, or ad accounts to advertise our own service to your customers.

How long we keep it

We keep account and business information while the account is active. Connected-account tokens are deleted when you disconnect that service or delete the account. On deletion we also delete the profile and the content stored for the account.

A few narrow leftovers can remain. Usage rows may keep the opaque customer tag, without your email, so a past invoice can still be matched. Stripe may keep its own receipts under Stripe’s terms. If you started a trial, its record keeps a keyed hash of the email address and of the card you used (neither can be turned back into the address or the card), so the same email or card can’t start a second trial. A Gmail or Omnisend grant is revoked at the provider when that call succeeds; an Outlook grant can’t be revoked by the app (see Outlook above). In every case the tokens are deleted here, and you can also remove the app in the provider’s own settings.

Who else receives information

We use these providers to run the service. They receive only what that part of the product needs:

• Supabase: sign-in and the database, including encrypted storage of connection tokens.
• Replit: hosting the application.
• Stripe: payments. Stripe handles the card.
• Google: only if you connect Gmail or a Google ad account. Gmail access is the send scope and the mailbox address, not your inbox.
• Microsoft: only if you connect Outlook (or a Microsoft ad account). Outlook access is send-only plus the mailbox address, not your inbox.
• Upload-Post (TONVI TECH SL, Spain): social account connections and posting.
• Zernio: ad account connections and ad results.
• Omnisend: only if you connect it.
• treg and the data vendors it calls (maps listings, Hunter, an email checker, and for analytics, search and social lookups): only the business names, web addresses, general business email addresses (for the email check), public handles and page addresses a lookup needs.
• Nango: only if the operator turns on a booking-tool or CRM connection. Not used for email.
• The model provider turned on for an AI feature: the material you submit to that feature.

We may also disclose information if the law requires it, or to prevent abuse of the service. We do not give customer lists to advertisers.

Cookies and sign-in storage

Signing in does not set an advertising cookie. The sign-in session is stored in this browser (local storage used by Supabase Auth) so you stay signed in. You can clear it by signing out or by clearing site data.

While you connect Gmail, Outlook or Omnisend, the server sets a short-lived cookie on this host only (__Host-ylb_gmail, __Host-ylb_outlook or __Host-ylb_omnisend). It ties the provider’s return to the browser that started the connection. It lasts about ten minutes, is not readable by page scripts, and is removed when the connection finishes. It is not used to track you across other sites.

When you pay before creating an account, the server sets a cookie on this host only (__Host-ylb_payfirst). It ties your payment to this browser so the plan can be added to the account you create next. It lasts up to 30 days, is not readable by page scripts, and is removed when the plan is added from this browser (otherwise it simply expires). We keep only a scrambled copy of it, a scrambled copy of the email you typed at Stripe Checkout and a shortened form of that email (its first letter and its domain), so we can match the payment to your account.

The app also sets ylb_app in a browser that has opened it, so the home address opens the app instead of the public home page. It holds no personal information and isn’t used to track you.

If you arrive through an affiliate’s link, we set ylb_ref in this browser for up to 60 days (the program’s setting, never more than a year). The app keeps the same two facts in this browser’s local storage (ylb-ref), and after your account claims the link it notes that it did (ylb-ref-sent: followed by your account’s id), so it isn’t sent twice. They hold only the link’s code and when you first opened it, so the account you create can be credited to that affiliate. We count visits by day, without your IP address. The affiliate never sees your email, name or business. They see you as a numbered customer (“Customer 3”) with your plan and its status (signed up, on trial, paying, cancelled, refunded), and, for each of your payments, its date and the commission it earned them, including when a refund or a dispute took it back.

Your choices

• Access and correct. You can see and edit your businesses in the product. For a copy of the account data we hold, email us.
• Disconnect. Settings → Connected accounts removes a Gmail, Outlook, Omnisend, social, or ad connection and the tokens we stored for it.
• Delete. Settings → Account (or “Your account” on the plans screen, before you have a plan) deletes the account and the content and tokens we hold, aside from the leftovers described above.
• Email. If you cannot sign in, email hectorheredia242@gmail.com from the address on the account and say what you want done.

If the law where you live gives you extra rights, write to that address and we will respond. There is no separate data-protection officer. Hector Heredia is the contact.

Changes

If this policy changes, the date at the top of this page changes. The page at https://yourlocalbusiness.org/privacy is the current version.

Contact

Hector Heredia
hectorheredia242@gmail.com
Washington, USA. There is no street address on file; email is the way to reach the operator.