Your Data, Your Rules

• We collect emails for the VIBES newsletter and to unlock Garrett's Mom.
• Our email service provider handles delivery + open/click tracking.
• Our database provider stores your subscription, Guides you publish, and (if you opt in) Curator favorites.
• Top Studio Videos uses public YouTube API data. It does not require Google sign-in or access private account data.
• We don't sell your data. We don't train models on your personal data.
• You can unsubscribe or delete your data anytime by emailing hello@curationsla.com.

Email + name — when you subscribe to VIBES, unlock Garrett's Mom, or submit a venue/event.

Guides you publish — title, content, your verified email, optional display name (only shown publicly if you toggle byline).

Engagement signals — email opens, clicks, and on-site interactions such as page views and link clicks. Google Analytics and Ahrefs help us measure usage, referrals, and site performance. We use those measurements to improve CurationsLA, not to build or sell advertising profiles.

Cookies + local storage

• admin_session — HMAC-signed session for staff/curators. HttpOnly, 7-day max age.
• portal_location_id — remembers which business location an owner is managing.
• gm_subscriber (localStorage) — keeps you unlocked in Garrett's Mom for 7 days.
• Our edge network and hosting providers set a small number of operational cookies (DDoS protection, edge routing). We don't set any ad-tech cookies.

Server logs — our edge network and hosting providers keep short-lived access logs (IP, user-agent, path). Used to debug and stop abuse. Rotated within ~30 days.

• We don't use advertising pixels or sell audience profiles. We use Google Analytics and Ahrefs for site measurement, referrals, and performance reporting.
• We don't buy data from data brokers.
• We don't do cross-site tracking.
• We don't collect SSN, government ID, or precise location (unless you explicitly share an address).
• We don't train external LLMs on your personal data. AI features pass your prompt to our enterprise AI provider under contractual data-protection terms — your inputs aren't used to train their models.

• Deliver the VIBES newsletter
• Unlock Garrett's Mom and the Guide publishing flow
• Personalize what we recommend if that feature is enabled
• Run the magic-link auth flows for business owners, officials, and curators
• Detect and stop abuse (rate limiting, spam filtering)
• Improve the platform — aggregate metrics only, never sold

Service providers under contract — same operational scope, can't use your data for their own marketing:

• Edge network provider — DDoS protection, DNS, edge routing
• Hosting provider — site infrastructure
• Database provider — data storage, magic-link auth
• Email service provider — newsletter delivery + click/open tracking
• Analytics providers — Google Analytics and Ahrefs for usage, referral, and performance measurement
• Geocoding provider — address lookup (address only, no email)
• Enterprise AI provider — Garrett's Mom inference
• Payment processor — paid features only (e.g., Curator Card when launched)

We'll only share data with law enforcement when legally required (subpoena, court order) and will fight overbroad requests.

Wherever you are, you can:

• Access — see what we have on you
• Correct — fix anything wrong
• Delete — nuke your account and all linked data
• Port — get a copy of your data in a machine-readable format
• Unsubscribe — every email has a 1-click unsubscribe link
• Object — say no to specific uses (e.g., engagement-based personalization)

Email hello@curationsla.comfrom your subscribed address and we'll respond within 14 days. California residents have additional CCPA/CPRA rights — same process, just say “CCPA request.” EU/UK residents have GDPR/UK-GDPR rights — same process, just say “GDPR request.”

• Subscription records: kept while active, deleted within 30 days of unsubscribe (we keep an audit row showing unsubscribe happened — no other PII).
• Published Guides: kept indefinitely as part of the public CurationsLA archive (unless you delete them or your account).
• Server logs: ~30 days.
• Email engagement events (open/click): ~12 months.
• Web analytics: retained under our configured provider settings and deleted or aggregated when no longer needed for measurement.
• AI prompt logs (Garrett's Mom): ~90 days for debugging + abuse review, then deleted.

All traffic uses TLS. Admin sessions are HMAC-signed (constant-time verification). Subscriber tokens are HMAC-signed. Webhook callbacks verify signatures. We don't store passwords — we use magic links and HMAC tokens.

Found a vulnerability? See /.well-known/security.txt. We respond within 24 hours for critical issues.

CurationsLA isn't directed at children under 13. We don't knowingly collect data from kids. If you're a parent/guardian and think your kid signed up, email us — we'll delete it.

We'll update this policy as the platform grows. For material changes, we'll change the date at the top and notify subscribers via VIBES. Continuing to use the Services after updates means you accept them.

Privacy questions, data requests, complaints: hello@curationsla.com. Security disclosures: security@curationsla.com (or see /.well-known/security.txt).