Localr Privacy Policy

This Privacy Policy explains how Artemis Labs Pte. Ltd. ("Artemis Labs", "we", "us" or "our") collects, uses, discloses and protects personal data in connection with the Localr website at localr.io and the services offered through it (the "Service").

Artemis Labs is a company incorporated in Singapore (UEN 202613447D) with its registered office at 9 Raffles Place, #29-05, Republic Plaza, Singapore 048619. We are the organization responsible for personal data processed through the Service for the purposes of Singapore's Personal Data Protection Act 2012 ("PDPA") and the "business" or "controller" for the purposes of applicable United States state privacy laws.

Our Data Protection Officer can be reached at contact@localr.io.

1. Scope

This Policy applies to:

• visitors who browse or search Localr;
• business owners and their representatives who claim or manage a business profile ("Business Users");
• individuals whose information appears in a business profile, whether or not they have an account.

It does not apply to the practices of businesses listed on Localr or of third-party websites we link to.

2. Personal data we collect

2.1 Information you give us

• Account information: name, email address, password (stored as a hash), and whether you signed in with Google. If you sign in with Google we receive your name, email address and profile image from Google.
• Claim and verification information: the business you claim, the email address used to verify ownership, and any documents you choose to upload to prove authority to act for the business.
• Profile content: everything a Business User adds to a profile, including descriptions, services, prices, hours, credentials, licenses, photos, FAQ, languages spoken and social links. Where this includes names, photos or roles of staff, the Business User is responsible for having the right to publish it.
• Payment-related information: if you buy a paid plan, our payment processor collects your payment details directly. We receive your name, email, the plan purchased, the amount and a transaction reference. We do not receive or store full card numbers.
• Communications: the content of messages you send us at contact@localr.io or through the Service.

2.2 Information collected automatically

• Usage data: pages viewed, searches made, links clicked, referring URL, time and duration of visits.
• Device and connection data: IP address, browser type and version, operating system, screen size and language.
• Approximate location: derived from your IP address or, if you grant permission in your browser, from your device's location service, to show results near you. Precise location is used only for that request and is not stored.
• Cookies and similar technologies: see Section 7.

2.3 Information about businesses from other sources

Localr compiles business profiles from publicly available sources and from licensed third-party data providers. For a business this may include its name, address, phone number, website, hours, category, photos and the content of its public website. Where a business is a sole proprietorship or is named after an individual, some of this information may be personal data about that individual.

Under the PDPA, business contact information (an individual's name, position, business telephone number, business address, business email address and similar information provided for business purposes) is not subject to the consent, access and correction obligations of the Act, and we rely on that exclusion where it applies.

3. How we use personal data and our legal grounds

We use personal data for the following purposes. Where the PDPA applies we rely on your consent, on deemed consent, or on an exception in the Act such as legitimate interests or business improvement; where US state privacy laws apply we process data for the business purposes described below.

We do not use personal data for automated decision-making that produces legal or similarly significant effects about you.

4. Public nature of business profiles and automated access

Business profiles on Localr are public. Anyone can view them, and they are indexed by search engines. Localr also publishes each profile in machine-readable formats (structured data and a plain-text version) and permits access by automated systems including AI assistants and their crawlers, so that businesses on Localr can be found and cited by those systems. Information you add to a business profile should be information you are willing to make public in this way.

Account information, verification documents and payment information are never published.

5. How we disclose personal data

We disclose personal data to:

• Service providers who process data on our behalf under contracts that restrict their use of it. These currently include providers of cloud hosting and database services, email delivery, background job processing, payment processing, business data licensing, map tiles, geocoding and large language model processing used to extract profile content from business websites. Several of these providers are located in the United States.
• Business Users, who see the questions and content submitted about their business, but not the account details of the people who submitted them unless those people choose to disclose them.
• The public and automated systems, in the case of profile content as described in Section 4.
• Professional advisers such as lawyers, auditors and insurers where necessary.
• Authorities and other third parties where required by law, to respond to legal process, to protect the rights, property or safety of Artemis Labs, our users or others, or to enforce our Terms.
• A successor in the event of a merger, acquisition, reorganization or sale of all or part of our business, in which case this Policy will continue to apply to your personal data.

We do not sell personal data for money. We do not share personal data with third parties for cross-context behavioral advertising, and we do not run third-party advertising on the Service. Because profile content is published openly, including to automated systems, some US state laws could treat that publication as a "sale" or "sharing"; Section 9 explains your rights in that respect.

6. International transfers

Artemis Labs is based in Singapore. Our service providers are located mainly in the United States. Personal data we collect will therefore be transferred to, stored and processed in Singapore, the United States and other countries where our providers operate.

Where we transfer personal data out of Singapore, we take steps required by the PDPA to ensure the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA, including contractual clauses with our service providers.

7. Cookies and similar technologies

We use a small number of cookies and local storage entries:

• Strictly necessary: to keep you signed in, to remember which business you are managing, to protect against cross-site request forgery and to apply rate limits. These cannot be switched off while using the Service.
• Preferences: to remember choices such as list or map view.
• Analytics: to understand aggregate usage of the Service. Where we use analytics that set cookies, we will present a consent banner to visitors in jurisdictions that require one.

We do not use advertising cookies. We honor the Global Privacy Control signal and browser "Do Not Track" settings as a request to opt out of any sale or sharing of personal data as defined by applicable US state laws.

You can control cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in.

8. Retention

We keep personal data only as long as needed for the purposes described above or as required by law.

• Account information: for the life of your account and for up to 12 months after closure, unless a longer period is needed to resolve disputes or comply with law.
• Verification documents: deleted within 90 days of the claim being decided.
• Payment records: 7 years, as required by Singapore tax and accounting law.
• Profile content: for as long as the business profile exists. Business contact information that is publicly available may remain after a Business User closes their account, subject to the removal process in our Terms.
• Usage and connection logs: up to 13 months, then aggregated or deleted.
• Communications: up to 3 years after the matter is closed.

When personal data is no longer needed we delete it or anonymize it so it can no longer be associated with you.

9. Your rights

9.1 All users

You may at any time:

• request access to the personal data we hold about you and information about how we have used or disclosed it in the past year;
• request correction of inaccurate or incomplete personal data;
• withdraw consent to any processing that is based on consent, including by unsubscribing from marketing emails;
• request deletion of your account.

Business Users can view and edit most of their personal data and all of their profile content directly in the Localr dashboard.

9.2 Singapore

If you are in Singapore, the PDPA gives you rights of access and correction. We will respond to an access or correction request within 30 days, or tell you within that time when we will be able to respond. We may charge a reasonable fee for access requests as permitted by the PDPA and will tell you the fee before proceeding. You may withdraw consent by notifying us; we will tell you the likely consequences of withdrawal, which may include our inability to continue providing parts of the Service to you. We will not send telemarketing messages to any Singapore telephone number registered on the Do Not Call Registry unless we have your clear and unambiguous consent.

If you are not satisfied with our response you may complain to the Personal Data Protection Commission of Singapore.

9.3 United States

If you are a resident of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia or another state with a comprehensive privacy law, you may have the right to:

• know what personal data we have collected about you, the categories of sources, the purposes of collection, and the categories of third parties to whom it has been disclosed;
• access and obtain a portable copy of your personal data;
• correct inaccurate personal data;
• delete your personal data, subject to exceptions;
• opt out of the sale or sharing of personal data, of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects;
• limit the use of sensitive personal data;
• not be discriminated against for exercising these rights;
• appeal a decision we make on your request.

We do not sell personal data for money, do not engage in targeted advertising and do not profile users for significant decisions. If you believe the publication of business profile content constitutes a sale or sharing under your state's law and you wish to opt out, contact us at contact@localr.io and we will act on your request in accordance with that law, which may require removing the content from the profile. You may also use the Global Privacy Control signal as described in Section 7.

To exercise any right, email contact@localr.io with the subject line "Privacy request" and tell us which right you are exercising and the state in which you reside. We will verify your identity by matching the information you provide with information in our records, and may ask you to confirm the request from the email address on your account. You may authorize an agent to make a request for you; we will ask for evidence of that authority. We will respond within 45 days and may extend by a further 45 days where reasonably necessary, in which case we will tell you. If we deny your request you may appeal by replying to our decision; we will respond to the appeal within 45 days and, if we deny it, will tell you how to contact your state attorney general.

For California residents: in the preceding 12 months we have collected the categories of personal data described in Section 2, for the purposes in Section 3, and disclosed them for business purposes to the categories of recipients in Section 5. We have not sold personal data for monetary consideration, and we do not knowingly sell or share the personal data of consumers under 16. California's "Shine the Light" law permits you to request information about disclosures of personal data to third parties for their direct marketing purposes; we make no such disclosures.

10. Children

The Service is not directed to children. We do not knowingly collect personal data from anyone under 18, and under no circumstances from children under 13 as defined by the US Children's Online Privacy Protection Act. If you believe a child has provided us personal data, contact us at contact@localr.io and we will delete it.

11. Security

We protect personal data with technical and organizational measures appropriate to its sensitivity, including encryption in transit, encryption at rest for our databases, hashed passwords, role-based access controls, row-level security in our database, and restricted access to production systems. No system is completely secure. If a data breach occurs that is likely to result in significant harm to affected individuals, or that affects 500 or more individuals, we will notify the Personal Data Protection Commission of Singapore within 3 calendar days of assessing that the breach is notifiable, will notify affected individuals as required by the PDPA, and will notify affected US residents and authorities as required by the breach notification laws of their states.

12. Third-party links and map tiles

The Service links to business websites, booking systems and social media profiles that are operated by third parties under their own privacy policies. Map tiles on the Service are loaded by your browser from OpenFreeMap, which may receive your IP address and the map area you viewed; OpenFreeMap states that it does not log or track users.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy on the Service with a new effective date and, where a change materially affects how we use personal data of account holders, will notify them by email or in-product notice before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

14. Contact

Questions, requests and complaints about this Policy or our handling of personal data should be sent to our Data Protection Officer:

Artemis Labs Pte. Ltd. Attention: Data Protection Officer 9 Raffles Place, #29-05, Republic Plaza Singapore 048619 contact@localr.io