Privacy Policy (DRAFT – attorney review)

This document is a draft for attorney review. It is not in effect and is not legal advice. It describes how Latitude 65 Technologies LLC ("Latitude 65," "we," "us") intends to handle personal information for YayNo™. A lawyer must rewrite and approve this before any public launch, and before any vendor that processes identity documents is turned on.

Who we are and how to reach us

YayNo is operated by Latitude 65 Technologies LLC, an Alaska limited liability company. A privacy contact email and a postal address will be published here before launch. California residents will also have a method to submit a request that does not require creating an account, as the CPRA requires.

What we collect

• Account details: name, email, password (stored hashed), role (customer, business manager, or moderator), and the date you confirmed you are at least 13.
• Reviews: rating or Yay/No, title, body, optional photos, visit date, and the verification method.
• Proof documents (receipts, invoices, contracts) and files a business uploads with a policy dispute. These are stored privately. They are never posted on the review. Only you, the reviewed business, and our moderators can see proof tied to your review; dispute evidence is for the moderator, the business that uploaded it, and the review's author.
• Claim documents: business-registration documents and, when a claim requires it, a government ID and optional selfie. Government IDs are encrypted at rest, visible only to moderators (every view is logged), masked by default, never shown publicly, and deleted after the retention period below.
• Verification signals: QR scan time, a device identifier cookie, IP address (for rate limiting and fraud prevention), and optional location (only with your permission; used as a weak signal).
• Usage and log data: pages viewed, approximate device type, and security events.
• Business profile data you choose to publish if you manage a listing.
• Payments: if you buy a paid plan, payment card data is collected by the payment processor (planned: Stripe), not stored by us as full card numbers.
• In the future, and only if you choose to connect it, card or bank transaction matching through a provider such as Plaid. We would see only the merchant, date, and amount of the matched transaction. That feature is not on unless you connect it and counsel has reviewed the vendor terms.

We do not intend to sell personal information, and we do not intend to share it for cross-context behavioral advertising. If that ever changes, we will update this policy and honor opt-out rights.

How we use it

To create and secure your account; verify reviews and business claims; prevent fraud and abuse; handle disputes and legal requests; operate, improve, and measure the service; communicate with you about your account; and comply with the law. We do not use government-ID images for marketing.

Legal bases and state rights (overview)

YayNo is aimed at U.S. users. As the service grows, comprehensive state privacy laws may apply when their thresholds are met — including the California CCPA/CPRA, and laws in Virginia, Colorado, Connecticut, Texas, Oregon, and other states. Those laws can give you the right to know, access, correct, delete, and opt out of certain processing, and to appeal a denial. We will honor requests from any U.S. resident in a comparable way once the service is in production, even where a statute does not yet require it, unless a legal exception applies.

To submit a request once the service is live: use the account page at `/me/account`, or email the privacy contact. We will need to verify it is you. You may use an authorized agent where the law allows. We will not discriminate against you for exercising a privacy right.

California. Counsel should add a CPRA-compliant notice at collection, categories table, retention by category, and "Do Not Sell or Share" language (even if the answer is that we do not sell or share). Thresholds are currently based on revenue, volume of personal information, or revenue from selling or sharing — counsel should confirm the figures in force at launch.

Children (COPPA). YayNo is not directed at children under 13. We do not knowingly collect personal information from children under 13. We ask every new account to confirm they are at least 13. If we learn we have collected information from a child under 13, we will delete it. Parents may contact us to request deletion.

Biometric and government-ID data

Some claim flows may ask for a photo of a government ID and, if a third-party identity vendor is later enabled, a selfie. No identity vendor is enabled in this demo. Illinois BIPA, the Texas Capture or Use of Biometric Identifier statute, Washington's biometric law, and similar laws impose consent, notice, and retention duties on biometric identifiers (for example a scan of face geometry). Counsel must review any vendor (including Stripe Identity or similar) before it is turned on, prepare any required written consent, and confirm that YayNo itself does not create or store a biometric template if the vendor can hold that risk. Until that review is done, auto-approval of claims remains off, and face-geometry analysis should not be performed by YayNo's own systems.

Retention

Planned default periods (see also the in-product configuration, which an operator can adjust only with counsel's agreement):

• Government-ID images and extracted ID fields: 30 days after a claim decision, then deleted.
• Business-registration documents for a claim: 90 days after a decision, then deleted.
• Review proof documents (receipts, invoices, contracts): 365 days is the working default; counsel should set the final period.
• Account profile: until you delete the account, plus a short grace period if production uses one.
• Published reviews after account deletion: may be kept in de-identified form ("Deleted user") so the public record of a review is not silently erased; you may ask us to withdraw the review.
• Security and audit logs: 1–2 years, longer if a legal hold applies.

We plan to automatically redact card numbers and other sensitive details from proof documents.

Sharing

We share personal information with:

• Service providers who help us run YayNo (hosting, email, SMS, identity verification, payments, moderation), under contracts that limit their use of the data.
• A business you reviewed, only for proof documents and dispute handling, not for public posting.
• A business you ask for a quote or a question, and only if that business accepts the request. We send them the name, email, phone number, and message you submitted. We tell you this before you send it.
• Law enforcement or others when the law requires it, or to protect rights, safety, and the integrity of reviews.
• A buyer or successor if the company is sold, under appropriate safeguards.

We do not let a business pay to have a review removed.

Security and breaches

We use technical and organizational measures appropriate to the sensitivity of the data, including hashed passwords, hashed API keys, CSRF protection, encrypted storage for government IDs, access logging for ID views, and transport encryption in production. No method is perfectly secure.

If a breach of personal information occurs, we will investigate and notify affected people and regulators as applicable law requires, including Alaska's Personal Information Protection Act (AS 45.48) and the breach laws of other states where residents are affected. A written incident-response plan should be adopted before launch.

Cookies and similar technologies

We use a session cookie to keep you signed in, a device identifier cookie for fraud prevention, and a language preference. Production should include a clearer cookie notice if non-essential cookies are added. We do not currently use third-party advertising cookies.

International users

The service is hosted in the United States. If you use it from another country, your information is processed in the United States.

Changes

Once this policy is in effect, we will post updates and provide additional notice for material changes where the law requires it.

Quote and contact requests

If you use “Request a quote” on a listing, you are not posting a review and you are not verified as a customer. Your information is sent to that business only if they accept the request. We keep a record of the request, the consent text you agreed to, and the time, so the business can be billed and a dispute can be reviewed.

Calling and texting (TCPA) — attorney review. If you add a phone number, the form asks you to agree that the business may call or text you about that request. That is not permission for unrelated marketing. Before this is live, counsel must review the Telephone Consumer Protection Act, including consent rules for calls and texts, and whether the business (not YayNo) is the caller.

Email (CAN-SPAM) — attorney review. Notices YayNo sends to a business about a lead are transactional: the business asked for them, at an address the business entered. This preview does not email the customer a promotion. If YayNo later sends marketing email, CAN-SPAM applies: an honest header and subject, a physical postal address, and a working way to opt out. Counsel must confirm that line before any marketing email is sent.

A working retention period for lead contact details is not set. The ledger and the audit trail of charges, credits, and decisions are kept. Counsel should set how long the customer’s name, email, phone, and message stay attached to a closed lead.

Lawyer still to confirm

The exact CCPA/CPRA notice-at-collection table; whether a "sensitive personal information" limit-use right applies to ID images; biometric consent forms; data-processing agreements and international transfer language for each vendor; the final retention schedule; Alaska and multi-state breach-notice playbooks; and whether a formal Data Protection Assessment is needed for identity verification. Also still open: the TCPA consent for passing a phone number to a business, CAN-SPAM if any customer email is ever promotional, and the retention period for lead contact details.

Other drafts: Terms of Use · Privacy Policy · Content & Review Guidelines · Content & Review Guidelines · Business Terms · Founding 1,000 terms · Refunds · Legal Takedown & Dispute Process · DMCA Policy