Privacy policy

Who this applies to

Andover Local is a local business directory for Andover, MN, published at andoverlocal.com. This policy covers everything the site does with personal information: the forms you can fill in, the traffic measurement running quietly in the background, and the business details published on the listing pages.

The site is run from British Columbia, Canada, so it handles personal information under Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). Some US states have privacy laws of their own. Whether or not one of them applies to a site this size, the choices and rights described below are open to everyone, wherever you live.

What is collected

Apart from public material, such as the business details covered further down, personal information reaches this site three ways.

Information you type into a form

The site runs three forms: contact, add a listing, and claim a listing. Between them they ask for a name, an email address, a phone number, your role at the business when you claim one, the business details you want published (including an optional logo and photos), and whatever you write in the message box. The IP address and country each submission came from are saved with it. You choose what goes in. Nothing is pre-filled from somewhere else, and the site has never bought a contact list. If you write by email or by post instead, that message is handled and kept under the same rules as a contact message.

Information your browser sends on its own

The server records the requests it receives, the way every web server does: the page requested, the date and time, the referring page, your browser and device type, and your IP address. The network provider counts visits in aggregate, and search engine reports show which pages and search terms bring people here. That is how the site decides what to write next.

Information PayPal sends when you buy Premium

A Premium upgrade is paid on PayPal's own checkout, so your card or bank details go to PayPal and never to this site. PayPal sends the site the subscription's ID, status and billing dates, and the name, email address and payer ID on the PayPal account that paid. The subscription ID, status, dates, email address and payer ID are kept with the listing the upgrade belongs to, and the name is not kept. What PayPal does with your information is covered by PayPal's own privacy policy.

Outside PayPal's checkout, the site does not ask for financial information, government identifiers or health information, and would have no use for them if you sent them. Please keep them out of the forms.

Why it is collected

• To write back to you, and to follow up on a correction.
• To review a listing submission or a claim, and to check that the person sending it is actually connected to the business.
• To publish the business information you asked to have published.
• To keep the site running, spot abuse, and block automated spam.
• To see which pages are useful, so more gets written of what people actually need.
• To run a Premium upgrade you paid for, and to keep the records that tax rules require.

The site does not build advertising profiles. It does not sell personal information, and it does not share it for targeted advertising: not to a marketing list, not to a lead broker, not for any amount of money anyone has offered. Those are the main uses US state privacy laws let you opt out of, and neither happens here, so there is nothing to opt out of.

Consent, and how to withdraw it

Sending a form is your consent for the site to use what is in it for the purposes listed above. If your information is ever wanted for something outside that list, you will be asked first.

You can withdraw consent whenever you like by writing through the contact form. Say what you want deleted and it will be deleted, apart from anything the site is legally required to hold on to. Withdrawing consent for a published listing takes the listing down with it.

Cookies and analytics

This site sets two cookies on every visit. The session cookie is strictly necessary: the forms need it to work, and it is what protects them against cross-site request forgery. The second cookie holds a copy of the same anti-forgery code, which the site's framework sets by default. Both expire after 2 hours without activity. The security provider in front of the site, and the bot check on the forms, may set short-lived cookies of their own to tell people apart from automated traffic.

The cookies themselves hold only random, encrypted codes. The session cookie links your visit to a short-lived record on the server holding your IP address, your browser type and the address of the last page you opened here. After you send a form, the record can also hold what you typed, until the next page has been shown to you. Expired records are deleted as the site runs.

The analytics measure traffic in aggregate rather than following individuals around. There are no advertising cookies here, no retargeting pixels and no social media tracking widgets, which is also why no consent banner is sitting on top of this page waiting for you to dismiss it.

You can block or delete cookies in your browser settings. Blocking them will not stop you reading anything on the site, though it may stop a form from submitting. Nothing here tracks you across other websites, and nothing here sells or shares your information for advertising, so a Do Not Track or Global Privacy Control signal has nothing to switch off: the site treats you the same either way. If that ever changes, those signals will be honored, and this policy will say so first.

Business listing information

Most of what gets published here is business contact information: a company name, an address, a phone number, opening hours, a website. It is the information a business puts out so customers can reach it, and it is published here for that same reason.

Listings are put together from publicly available sources, including the open map data published by OpenStreetMap and Overture Maps, and from submissions by business owners. The site does not publish an owner's or an employee's home address, personal phone number or personal email. If a listing has picked up something personal by mistake, say so and it comes off the same day the message is read.

If you would rather your business was not listed at all, ask and it will be removed. No reason is needed, and there will be no argument about it.

Who else sees it

Personal information goes to service providers only where they need it to keep the site working, and only for that:

• the company that hosts the server this site runs on;
• the network and security provider that sits in front of it, filters malicious traffic, runs the bot check on the forms and counts page views;
• the email service that carries the site's replies and the form notifications;
• PayPal, which processes a Premium payment if you buy an upgrade;
• an IP-location service, ip-api.com, which the site's review tools ask which country a form submission's IP address comes from;
• the map service, OpenStreetMap, whose map tiles your browser loads on any page that shows a map, such as a listing page, so it sees your IP address and the part of the map you are looking at.

The host, the network provider and the email service may use the information only to provide their service. PayPal, ip-api.com and OpenStreetMap handle what they receive under their own privacy policies. Past these, personal information is disclosed only where the law leaves no choice: a court order, a warrant, or a legal obligation that cannot be declined.

Where it is stored

Form submissions sit in a database on a server the site controls. The site is run from Canada, and the server and the providers above may be in Canada, the United States or elsewhere, so information you send may be stored in or accessed from those countries and may be subject to their laws. If that concerns you, send less. The forms only need enough to write back to you.

How long it is kept

• Contact messages: kept while the matter is being dealt with and for up to two years afterwards, so the history of a listing that has been corrected before can be seen.
• Listing submissions and claims: kept for as long as the listing is published, plus two years, so the site can show why an entry says what it says.
• Premium subscription records (the subscription ID, the PayPal email address and payer ID, status and dates): kept while the subscription runs, and afterwards for as long as tax rules require. PayPal keeps its own record of each payment.
• Server logs: rotated and deleted within 90 days.
• Analytics: aggregate figures only. They identify no one, so they have no time limit; the network provider and the search engine keep their own reports for as long as their services do.

Anything past its retention period is deleted rather than quietly archived somewhere.

How it is protected

The whole site is served over an encrypted connection. Access to the database and to form submissions is limited to the people who run the site, and the software gets patched.

No system is perfect, and this policy does not pretend otherwise. If a breach ever puts your information at real risk, you will be told promptly, and every authority the law requires to be notified will be.

Your rights

You can ask the site to:

• tell you what personal information it holds about you and what has been done with it;
• correct anything that is wrong or out of date;
• delete what it holds, or take a listing down;
• stop contacting you.

Send the request through the contact form. You will get a response within 30 days. Before a record is handed over, you may be asked a question or two to confirm you are who you say you are, and that check exists to protect you rather than the site. Asking costs nothing, and it never changes how your business is treated in the directory.

If you are not satisfied with how it was handled, you can complain to the Office of the Privacy Commissioner of Canada, which handles complaints about Canadian-run organizations, including from people outside Canada, or to the consumer protection office of your state attorney general. Neither charges a fee.

Children

This site exists for adults looking up local businesses. It does not knowingly collect personal information from anyone under 13. If you think a child has sent something through a form, say so and it will be deleted.

Links to other sites

Listings link out to business websites, social profiles and mapping services. Follow one of those links and you are on somebody else's site, under somebody else's privacy policy. This site has no control over what they collect, and this policy stops at the edge of this site.

Changes to this policy

When this policy changes, the effective date at the top changes with it. If a change materially affects how information already collected is handled, the page will say so instead of quietly editing a sentence and hoping nobody notices.

How to get in touch

Privacy questions, access requests, corrections and removals all go to the same place. Use the contact form and say what you need. It reaches a person, not a ticket queue.

Andover Local does not publish a postal address or a telephone number, because there is no public office and no phone line to publish. Everything here is handled in writing.