Privacy Policy

Effective date: October 14, 2026 Last updated: October 14, 2026

This policy explains what personal information Embarc Creative Co. LLC, doing business as allthethings.gay ("allthethings.gay," "we," "us"), collects, why, who we share it with, and the choices and rights you have. It covers allthethings.gay, its subdomains, our newsletter, apps, and forms (the "Service").

The Short Version

• You can search without an account or giving us your name.
• We do not sell your personal information or share it for targeted advertising. We never have, and we will tell you before that could ever change (it won't happen without your opt-in consent).
• We treat everything about your sexual orientation, gender identity, and health as sensitive, including what you can infer from the fact that you use an LGBTQIA+ directory. We collect as little of it as we can.
• Ads follow the page, not you. No ad trackers, no behavioral targeting, and no targeting by orientation or gender identity.
• Analytics never run on health, therapy, crisis, or search pages. Elsewhere we use Google Analytics with Google's ad features turned off.
• Want something deleted? Email privacy@allthethings.gay.

1. Information We Collect

Information You Give Us

You don't have to tell us anything about your sexual orientation, gender identity, or health to use the Service, and we ask you not to put that in suggestions or reviews unless you want it to be public.

Information Collected Automatically

• Device and log data. Our hosting provider records IP address, browser type, pages requested, referring page, and time, for security and to keep the Service running.
• Analytics. On pages where it runs, Google Analytics 4 records pages viewed, approximate location (city level), device type, and events such as clicks on "Call" or "Website." We have turned off Google signals and ad personalization, and Google Analytics does not store full IP addresses. It never loads on health, therapy, dental, crisis, or health access pages, on listings in those categories, or on any search results page, because what you search can say more about you than a page view should.
• Map tiles. When you open a map, your browser loads map images from OpenFreeMap, which receives your IP address and the map area you're viewing, like any website you load images from.
• Device storage. We save your most recent search in your browser's local storage so it's there when you return. It stays on your device; you can clear it from the homepage.

We do not collect precise GPS location unless you choose to use "near me," and if you do, it's used in your browser to sort results and is not stored by us.

Information From Others

• Public sources such as business websites, licensing boards, and public records, used to build and check listings. These are mostly about businesses, but may include names of owners or licensed professionals.
• Businesses and community members who suggest or correct listings.
• Stripe tells us whether a payment succeeded; it does not give us your full card number.

2. Sensitive Information

Several state laws treat information about sexual orientation, sex life, gender identity or transgender or nonbinary status, health, and precise location as "sensitive." Some of what we handle could reveal these things, even by inference.

What we do about it:

1. Minimize. We don't ask for it, and our forms don't have fields for it.
2. No analytics on sensitive pages, as described above.
3. No sale, no sharing for advertising, no profiling. We never sell sensitive information, use it for targeted advertising, or make inferences about individuals' orientation, identity, or health.
4. Consent. If a feature ever needs sensitive information (for example, optional profile fields about identity), we'll ask for your clear, opt-in consent first, explain why, and let you withdraw it at any time.
5. Consumer health data. We do not intentionally collect "consumer health data" as defined in Washington's My Health My Data Act or Nevada's similar law. If we ever do, we'll publish a separate Consumer Health Data Privacy Policy and get consent first.
6. Legal demands. We will not voluntarily give anyone information to identify a person's sexual orientation, gender identity, or use of reproductive or gender-affirming care. We'll require valid legal process, narrow it where we can, and notify the affected person unless legally prohibited.

3. How We Use Information

• Run the Service: show listings, process suggestions, publish reviews, send newsletters you asked for.
• Check listings, verify businesses, and award or pause badges.
• Process business plans and sponsorships and send receipts, renewal reminders, and account notices.
• Keep people safe: prevent fraud, spam, fake reviews, and abuse; enforce our terms.
• Understand which pages and features are useful, in aggregate.
• Report aggregate results to businesses and sponsors (for example, "your listing was viewed 340 times"). These reports never identify individual visitors.
• Comply with law.

We do not use personal information for automated decisions that have legal or similarly significant effects on you.

4. How We Share Information

We share personal information only:

• With service providers that process it for us under contracts that limit their use of it:

| Provider | Purpose | |---|---| | Vercel | Website hosting | | Supabase | Database | | Resend | Sending email | | Stripe | Payments for business plans and sponsorships; marketplace payments (see Section 7) | | Google (Analytics 4) | Aggregate site analytics, on non-sensitive pages only | | OpenFreeMap | Map tiles | | Stripe Identity | Verified badge checks | | Our mail vendor | Mailing verification codes to business addresses |

• With the business you contact. If you send a message or booking request to a business through the Service, we pass it to that business.
• Publicly, when you post. Reviews and suggestions you choose to publish are public with your display name.
• For legal reasons, as described in Section 2, item 6, or to protect people from serious harm.
• In a business transfer. If we're involved in a merger, acquisition, or sale of assets, information may transfer, but this policy (including the no-sale promise) will continue to apply to it, and we'll notify you.
• With your consent.

We don't sell personal information and we don't "share" it (as California defines that word) for cross-context behavioral advertising. We have not done so in the past 12 months.

Sponsors and advertisers get aggregate numbers only (impressions, clicks). We don't allow advertisers to place tracking pixels or tags on our pages.

5. Cookies and Similar Technologies

We don't use advertising cookies. You can block or delete cookies in your browser; the Service works without the analytics cookies.

Global Privacy Control and Do Not Track. We honor Global Privacy Control (GPC) signals as a request to opt out of sale and sharing, though we don't sell or share. We treat Do Not Track the same way.

6. Email

We send marketing email (like the newsletter) only to people who signed up. Every message includes an unsubscribe link and our postal address, and we process unsubscribes within 10 business days (usually right away). Businesses and sponsors also receive transactional email about their accounts, which they can't opt out of while they have an active plan.

When we email businesses that are listed but haven't claimed their listing, we identify ourselves, include our address, and honor requests to stop.

7. Marketplace Purchases (When Available)

When you buy from a seller, the payment is made to that seller through the seller's own Stripe account. The seller receives your name, shipping address, email, order details, and anything you write to them, so they can fill and support your order. The seller's own privacy policy governs how they use it. Stripe processes your payment details under the Stripe Privacy Policy; we never see your full card number.

We receive order records (what was bought, from whom, amount, and status) so we can run the marketplace, help with problems, and prevent fraud.

Sellers: when you provide personal data to set up payments, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.

8. How Long We Keep Information

9. Security

We use encryption in transit (HTTPS), access controls, least-privilege access for staff, and reputable providers. No system is perfectly secure. If a breach affects your personal information, we'll notify you and regulators as required by law, including the Arkansas Personal Information Protection Act.

10. Children and Teens

The Service is a general-audience resource and isn't directed to children. We don't knowingly collect personal information from anyone under 18. If you believe someone under that age gave us personal information, email privacy@allthethings.gay and we'll delete it. We never use any person's information for targeted advertising, and we never knowingly target minors.

11. Your Privacy Rights

Wherever you live, you can ask us to:

• Access the personal information we have about you, and get a portable copy.
• Correct it.
• Delete it.
• Opt out of sale, sharing, targeted advertising, and profiling (we don't do these, but you can still record the request).
• Withdraw consent you've given for sensitive information.

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with privacy laws have these rights by law, and we extend them to everyone.

How to make a request. Email privacy@allthethings.gay with "Privacy Request" in the subject, or write to the address below. Tell us what you'd like and the email you used with us. We'll verify your request by confirming you control that email (and, for businesses, the account). An authorized agent may make a request for you with your signed permission. We'll respond within 45 days (we may extend once by 45 days if needed and will tell you why). We won't charge you or treat you differently for using your rights.

Appeals. If we deny your request, you can appeal by replying to our decision with "Appeal" in the subject. We'll respond within 45 days (60 days in some states). If you're unhappy with the result, you can contact your state attorney general.

California. In the past 12 months we collected these categories: identifiers (name, email, IP address); commercial information (plan purchases, for businesses); internet activity (pages viewed on non-sensitive pages); approximate geolocation (city level from IP); professional information (for business contacts); and inferences limited to aggregate content interests (no individual profiles). Sources and purposes are described above. We disclosed them for business purposes only to the service providers in Section 4. We don't sell or share personal information, and we don't use or disclose sensitive personal information for purposes that would trigger the right to limit under the CCPA.

Nevada. We don't sell covered information as defined in Nevada law.

12. Changes to This Policy

We'll post any change here with a new "Last updated" date. If a change is material, we'll give notice on the Service and by email if we have yours, before it takes effect. We'll never start selling or sharing personal information, or use sensitive information in a new way, without your opt-in consent.

13. Contact Us

Embarc Creative Co. LLC, doing business as allthethings.gay 815 Technology Drive, Suite 241001 Little Rock, AR 72223 privacy@allthethings.gay