Privacy Policy | Humboldt.fyi

Humboldt.fyi is operated by 99 Agents Agency, based in Eureka, California(“Humboldt.fyi,” “we,” “us,” or “our”). This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use Humboldt.fyi.

1. Scope

This Policy applies to our website, accounts, local business directory, business onboarding and dashboard tools, subscriptions, Xander and other AI-assisted features, trip planning, community submissions, advertising services, Footprint Finder, the Branch Challenge Invite Token program, partner programs, embedded business widgets, and related support and communications (collectively, the “Services”).

It does not govern a third party's website, app, or service, even when Humboldt.fyi links to or displays content from that third party.

2. Information We Collect

2.1 Information you provide

Account and identity information: name, email address, profile image, role, login credentials, and authentication information. Passwords are stored as cryptographic hashes, not plaintext. If you use Google sign-in, we receive account information authorized through that service.
Business and partner information: business or organization name, ownership or affiliation, contact details, address, service area, location coordinates, website, hours, categories, licensing information, descriptions, business history, photos, logos, FAQs, and other profile or onboarding answers.
Transaction and subscription information: selected plan, billing cycle, subscription status, Stripe customer and subscription identifiers, invoice and payment status, and limited transaction history. Stripe processes payment card details; Humboldt.fyi does not store full card numbers.
Community and program information: ratings and reviews, event or place submissions, trip plans, saved businesses, mobile food schedules, contest or program entries, partner applications, Branch Challenge Invite Token activity, and related approvals or rewards.
AI and search content: searches, questions, prompts, conversation context, images you choose to attach, and feedback submitted to AI-assisted features. Do not include confidential, financial, health, or other sensitive information in an AI prompt.
Communications and support: emails, support requests, bug reports, optional reply addresses, page URLs, device details, and screenshots you choose to send. A screenshot can contain information visible on your screen, so review it before uploading.

2.2 Information collected automatically

Device and log information: IP address, browser and device type, user agent, request timestamps, security events, and similar technical information.
Usage and analytics information: pages viewed, referring domain, links or buttons selected, searches and form submissions, business profile visits, website clicks, AI referral or crawler activity, widget impressions, and feature use. Our current site analytics are first-party and do not create a cross-site advertising profile.
Location information: with browser permission, certain location-based features may process precise device location to show nearby destinations, verify a location-dependent interaction, or support Footprint Finder. Some location processing occurs only in your browser. Business addresses and destination coordinates may be stored and publicly displayed as part of a listing.

2.3 Information from other sources

We may obtain information from:

Public websites, public records, business profiles, event pages, and directory or map providers, including information used to create unclaimed listings or suggest content.
Business owners, partner organizations, and people who refer, claim, or help verify a business.
Payment, authentication, mapping, email, analytics, and other service providers that return transaction status or technical information needed to operate the Services.

2.4 Xander conversations

When you use Xander, our automated AI concierge, we collect the messages and attachments you submit, the responses generated, conversation and session identifiers, timestamps, feedback, and basic context such as the page where the conversation began. Xander is not a human being. Do not share sensitive personal information, account credentials, or payment details in a conversation.

3. Cookies, Local Storage, and Similar Technologies

Humboldt.fyi uses:

Essential cookies for secure sessions, authentication, fraud prevention, and Google sign-in handoffs.
Browser storage for settings and continuity, such as cookie choices, onboarding drafts, trip state, account display state, Xander session identifiers, and Footprint Finder progress.
First-party analytics signals to understand page views and important actions and to provide business performance reporting. These signals may include a page path, referring domain, and browser user agent, but the current system does not use third-party behavioral advertising cookies.

You can restrict cookies or clear browser storage using browser controls, but doing so may sign you out, erase locally saved progress, or prevent parts of the Services from working. Our cookie notice records whether you selected “Accept all” or “Essential only.”

Do Not Track and Global Privacy Control

Some browsers offer a Do Not Track signal, but there is no uniform industry standard for responding to it. Our Services do not currently use personal information for cross-site behavioral advertising or sell or share it as those terms are defined by the California Consumer Privacy Act. As a result, a Global Privacy Control signal does not change our current practices. If those practices change, we will update this Policy and honor legally required opt-out preference signals.

4. How We Use Information

We use information to:

Provide, personalize, maintain, and improve the Services.
Create, review, verify, publish, and manage business listings and public content.
Process subscriptions, payments, refunds, partner commissions, and account access.
Operate search, recommendations, Xander, content drafting, structured data, and other AI-assisted features.
Provide analytics to business customers, measure campaigns, and monitor embedded widget installation and performance.
Send account, verification, onboarding, billing, renewal, security, program, and support communications, and marketing communications where permitted.
Detect, investigate, and prevent fraud, abuse, spam, and security incidents.
Comply with law, enforce our agreements, and protect our users and community.

5. Public Information

Business listings, approved event or place submissions, public ratings and review text, partner directory profiles, mobile food schedules, and similar content are public by design. Public content may be indexed by search engines, included in structured data, processed by AI systems or other third parties, and copied outside our control. A review author's email address is not intended for public display.

Unclaimed listings may be assembled from public or licensed sources. Business owners can contact us to claim a listing or request a correction.

6. How We Disclose Information

6.1 Service providers

We disclose information to providers that help us operate the Services, including cloud hosting and databases, file storage, security, authentication, payment processing (Stripe), email delivery (Resend), maps and business information (Google), workflow automation, customer support, and AI or content-processing providers. Depending on the feature, prompts or submitted content may be sent to providers such as Google, OpenAI, Anthropic, or the Xander service. These providers process information under their own agreements and privacy terms.

6.2 Business owners and partner organizations

We provide business owners with aggregated or business-level analytics about their listings, embedded widgets, campaign activity, and customer interactions. We do not provide them with a visitor's private account details merely because the visitor viewed a listing.

If a business joins through a partner organization or participates using a Branch Challenge Invite Token connected to a partner, we may share the business name, public business contact information, activation and handoff activity, and program milestones with that partner. We do not share an individual's private account password, payment card number, private trip, or private AI conversation with a partner for this purpose.

6.3 Legal, safety, and business transfers

We may disclose information when reasonably necessary to comply with law or legal process, enforce our agreements, investigate fraud or security issues, protect rights or safety, or complete a financing, merger, acquisition, reorganization, or sale of assets. A successor would receive information subject to this Policy or notice of materially different practices.

7. No Sale or Cross-Context Behavioral Advertising

We do not sell personal information for money. We also do not currently share personal information for cross-context behavioral advertising or use sensitive personal information to infer characteristics about you. We may display contextual advertising and measure ad impressions or clicks within Humboldt.fyi.

8. Data Retention

We keep personal information only for as long as reasonably needed for the purposes described in this Policy. The period depends on the type of information and may include:

Account and business data while an account or listing remains active.
Billing, consent, security, and transaction records for the period needed for tax, accounting, dispute, fraud-prevention, and legal obligations.
Public content until it is removed, corrected, or no longer useful to the directory.
Logs, analytics, drafts, support messages, and backups for operationally reasonable periods, after which they are deleted, aggregated, or de-identified.

Information stored only in your browser remains until you clear it or the applicable feature removes it.

9. Security

We use safeguards designed for the nature of the information, including encrypted connections, hashed passwords, HttpOnly session cookies, access controls, provider authentication, and request validation. No online service can guarantee absolute security. Use a strong, unique password and notify us if you suspect unauthorized access.

10. Your Choices and Privacy Rights

You can update many account and business details from your dashboard.
You can cancel a subscription using the controls provided in your account.
You can unsubscribe from marketing email using the link in the message. We may still send service messages about your account, transactions, security, or requested programs.
You can manage browser permissions for location, camera, cookies, and local storage.
You can request access, correction, or deletion by emailing hello@humboldt.fyi. Some information may be retained where legally permitted or required.

California privacy rights

Where the California Consumer Privacy Act applies, California residents may request to know the categories and specific pieces of personal information collected, request deletion, request correction, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service and pricing when exercising their rights. Because we do not currently sell or share personal information for cross-context behavioral advertising, there is no such activity to opt out of.

To submit a request, email hello@humboldt.fyi with the subject “Privacy Request” and describe the request. We will verify requests using information reasonably related to your account and respond within the period required by applicable law. An authorized agent may submit a request, but we may require proof of authority and identity. We will not discriminate against you for exercising a privacy right.

11. Children

The account, business, subscription, partner, and submission features are intended for people at least 18 years old. The general directory may be viewed by a broader audience, but the Services are not directed to children under 13 and we do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided personal information.

12. Processing Location

Humboldt.fyi is based in the United States. We and our providers may process information in the United States and other countries where data protection rules may differ from those where you live.

13. Changes to This Policy

We may update this Policy as the Services or law changes. We will post the updated version and effective date here. If a change materially affects how we use personal information, we will provide additional notice by email or in the Services when required.

14. Contact Us

Email privacy questions or requests to hello@humboldt.fyi. Humboldt.fyi is operated by 99 Agents Agency in Eureka, California.