Privacy Policy

1. Who we are

BakeStands.info is operated by Manner Media LLC (doing business as Olono Web Solutions), based in Hilo, Hawaiʻi, USA ("we," "us," "our"). For the purposes of the EU General Data Protection Regulation (GDPR), Manner Media LLC is the data controller for personal information processed through this site.

Privacy questions and requests: [email protected].

2. Information we collect

From bake stand operators (listing submissions)

• Identifiers: your name, business name, email address, phone number
• Location data: your stand's street address and map coordinates, which you place voluntarily
• Commercial information: what you sell (tags), hours of operation, photos, and optional profile content

From site visitors

• We do not require accounts, and we do not use advertising cookies or tracking pixels.
• Our infrastructure providers (Cloudflare, Netlify) process standard request data — IP address, browser type, pages requested — for routing, security, and performance. This data is not used to build visitor profiles.
• If you tap "Near me," your device location is processed entirely in your browser to sort results by distance. It is never transmitted to or stored on our servers.

3. How we use information

Purpose	Data used	GDPR lawful basis
Publishing your listing (name, location, hours, tags, photos shown publicly)	Operator submission data	Performance of a contract (Art. 6(1)(b))
Account, listing, and service communications	Email, phone	Performance of a contract
Site security, routing, abuse prevention	Request/log data	Legitimate interests (Art. 6(1)(f))
Optional marketing emails (e.g., feature offers)	Email	Consent (Art. 6(1)(a)) — withdraw any time via unsubscribe
Payment processing for optional paid features	Handled by Stripe; we never receive card numbers	Performance of a contract

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising. We have not done so in the preceding 12 months.

4. Who we share information with

We share personal information only with service providers who process it on our behalf under contractual confidentiality obligations:

• Airtable (database), Netlify (hosting, serverless functions, admin authentication), Cloudflare (DNS, routing, edge caching), Stripe (payments), Google (address geocoding — the address you type is sent to Google's Geocoding API to place your map pin), and OpenStreetMap (map tiles; your browser requests tiles directly from OSM servers).
• Regional administrators. As BakeStands.info grows, we may authorize regional account managers (for example, a manager for a specific state's directory) to review and manage listings in their region. Regional administrators access operator information only as needed to operate their regional directory, under confidentiality and data-protection obligations equivalent to this policy. They are prohibited from using your information for any other purpose.
• We may disclose information if required by law, court order, or to protect the rights and safety of our users.

5. International transfers

Our servers and service providers are located in the United States. If you use BakeStands.info from the European Economic Area, the United Kingdom, or Switzerland, your information is transferred to the US. Our providers rely on recognized transfer mechanisms including the EU–US Data Privacy Framework and Standard Contractual Clauses. By submitting a listing you acknowledge this transfer.

6. How long we keep information

Data	Retention
Active listing data	For as long as your listing is live
Deactivated listing data	Up to 90 days, then permanently deleted
Payment records (Stripe)	As required by tax and accounting law
Infrastructure logs (Cloudflare/Netlify)	Short rolling windows set by those providers

You can request immediate deletion at any time (see Sections 8–9). We process deletion requests within 10 business days.

7. Cookies and local storage

The public site sets no first-party tracking cookies. Cloudflare may set strictly-necessary cookies for security and bot mitigation. The admin area (used only by our staff and regional administrators) uses Netlify Identity, which stores an authentication token in the administrator's browser. Stripe sets cookies on its own checkout pages if you purchase a paid feature.

8. Your California privacy rights (CCPA/CPRA)

We honor the rights granted by the California Consumer Privacy Act as amended by the CPRA for all users, regardless of whether the law's thresholds technically apply to us. If you are a California resident, you have the right to:

• Know — request the categories and specific pieces of personal information we hold about you, the sources, purposes, and third parties with whom it is shared
• Delete — request deletion of your personal information
• Correct — request correction of inaccurate personal information
• Opt out of sale or sharing — we do not sell or share personal information as defined by the CPRA, so there is nothing to opt out of; if that ever changes, we will provide a "Do Not Sell or Share My Personal Information" link before doing so
• Limit use of sensitive personal information — we do not collect sensitive personal information as defined by the CPRA
• Non-discrimination — we will never deny service, charge different prices, or provide a different quality of service because you exercised your privacy rights

To exercise any right, email [email protected] with the subject "Privacy Request." We will confirm receipt within 10 days and respond within 45 days (extendable once by 45 days where reasonably necessary, with notice). We verify requests by matching the email address on file for your listing. You may use an authorized agent by providing signed written permission.

9. Your European privacy rights (GDPR/UK GDPR)

If you are in the EEA, UK, or Switzerland, you have the right to access, rectify, erase, restrict, or object to our processing of your personal data, the right to data portability, and the right to withdraw consent at any time where processing is based on consent. Contact [email protected] to exercise these rights. You also have the right to lodge a complaint with your local supervisory authority.

10. Children

BakeStands.info is not directed at children under 13 (or under 16 in the EEA), and we do not knowingly collect their personal information. If you believe a child has submitted information, contact us and we will delete it promptly.

11. Security

Listing data is stored in access-controlled systems. Administrative access requires authenticated login. Payment card data never touches our systems. No method of transmission or storage is 100% secure, but we take reasonable measures appropriate to the sensitivity of the data we handle.

12. Changes to this policy

We will post any changes on this page and update the date above. Material changes affecting operator data will be announced by email to listed operators before they take effect.

13. Contact

Manner Media LLC (dba Olono Web Solutions)
Hilo, Hawaiʻi, USA
[email protected]