Privacy
Last updated April 29, 2026 · Plain-English summary first, then the legal version below
This is our promise to be clear about what we collect, why, and what we do with it. The lawyer-facing version follows the same structure so nothing is hidden.
What we collect
- Account info. Name, email, password (hashed). Optional: business affiliation when you claim a listing.
- Listing content. What you write or upload: photos, FAQs, services, hours, AI chat intake. You control this; you can edit or delete it.
- Lead capture. When a visitor sends a message to a business, we collect their name, email, phone, and message; we run a six-point qualification check on it; we route it to the business owner’s inbox.
- Page-view telemetry (planned). When activated, we will log which pages get visited and from which referrer. IP addresses will be hashed with a per-day salt before storage so we can count unique visitors without retaining raw IPs. This is not active today; this entry exists so this policy doesn’t lag the moment we turn it on.
- Chat logs. Both the universal search chat and the per-business AI concierge log the conversation. Anonymous visitors are tagged by an httpOnly cookie session token; signed-in users are tagged by user_id.
- Payments. Stripe handles all card processing. We see only customer ID, subscription state, and invoice history. Never card numbers.
What we don’t do
- We don’t sell your data to third parties.
- We don’t use ad-tech tracking pixels or behavioral retargeting.
- We don’t share lead information with anyone except the business owner the lead was sent to (and Stripe for the qualifying- lead overage charge).
- We don’t cross-link your activity across our products without asking. The directory and the chat live in separate session scopes.
Your rights
You can:
- Access your data. Email privacy@nucleardirectories.com and we’ll send a structured export within 30 days.
- Correct any wrong information yourself from your account; we’ll help with anything you can’t fix in-app.
- Delete your account. Deletion of personal data is irreversible and permanent. Listings you owned drop back to unclaimed; reviews you wrote stay on the directory but are dissociated from your account.
- Object to specific uses (e.g. AI chat training). Email us; we honor reasonable requests within 30 days.
California residents (CCPA), EU residents (GDPR), and other jurisdictions with comparable laws have additional rights. The mechanism is the same. Email us.
Cookies
- Session cookie (httpOnly). Keeps you logged in.
- Chat session cookie (httpOnly). Links anonymous chat conversations across page loads.
- We don’t use third-party tracking cookies. We don’t set cookies for advertising partners.
Children
The service isn’t for under-13s and we don’t knowingly collect their data. If you believe a child has signed up, email privacy@nucleardirectories.com and we’ll delete the account.
Changes
When we materially change this policy, we email every signed-in user. Past versions stay accessible at versioned URLs.