Privacy Policy

Effective Date: 7/4/2026

Last Updated: 7/4/2026

TL;DR

• Your Data: We collect location (session only), account info if you sign up, and how you use the platform. No payment data ever touches our servers.
• Your Content: Check-ins, ratings, and favorites are stored so the app works. You can delete them.
• The Rules: We share data with service providers only. We do not sell your personal information.
• The Catch: We may need to share data if a court orders it. If that happens, we tell you first if we legally can.

1. Who This Policy Applies To
   This Privacy Policy applies to all visitors and users of the Stumblon platform, including End Users and Bar Operators. It describes how Stumblon LLC collects, uses, shares, and protects personal information.
2. What Do We Collect?
   
   1. Information You Give Us
      If you create an account, we collect your name, email address, and date of birth (to verify age). If you are a Bar Operator, we also collect your business name, business address, and billing contact information. We do not collect or store any credit card numbers, bank account information, or payment credentials. All payments are processed by Stripe.
   2. Location Information
      When you access the platform, your browser will ask your permission to share your location. If you allow it, we receive a one-time latitude and longitude coordinate for that session. We use it to show you nearby bars. We query the Google Maps API to convert that coordinate into a usable search area. We do not store your precise coordinates after the session ends. We store a session cookie to remember that you granted location permission during that visit. We do not track your movement between sessions or across other websites.
   3. Usage Information
      We automatically collect standard web server log data when you visit the platform, including your IP address, browser type, device type, pages visited, and time of visit. We use this data to understand how people use the platform, fix bugs, and improve the experience. We may use session-level analytics to understand user flows, but we do not currently use cross-session behavioral advertising tracking.
   4. User Content
      Check-ins, ratings, photos, and any other content you post are stored by us so the platform can display them. You can delete your User Content through your account settings.
   5. Bar Operator Data
      We collect the content Bar Operators upload, including event listings, specials, hours, menus, photos, and webcam URLs. We store this data to power the platform. We may aggregate anonymized data from bar operator content to show trends (e.g., which event types get the most views) and report that to Bar Operators as part of subscription analytics.
   6. Check-In and Engagement Data
      If we implement user-facing analytics for Bar Operators (e.g., "32 users viewed your listing, 16 checked in"), we collect engagement signals such as listing views, check-ins, and time on page. This data is stored in association with bar listings, not tied to individual user identities in the reports delivered to Bar Operators.
3. Why Do We Use It?
   
   

   Data Type	Purpose	Legal Basis
   Account information	Create and manage your account	Performance of contract
   Location (session)	Show bars near you	Consent (you choose to allow it)
   Usage data / logs	Improve the platform, fix bugs	Legitimate interest (platform operation)
   Engagement data	Provide analytics to Bar Operators	Legitimate interest (service delivery)
   Date of birth	Verify you are 18 or older	Legal obligation (age restriction)

4. Who Do We Share It With?
   We do not sell your personal information. We do not share your personal information with advertisers. We share personal information with the following categories of service providers:
   1. Stripe. Payment processing for Bar Operator subscriptions. Stripe receives the billing contact information necessary to process payments. We do not receive or store your payment card details.
   2. Google APIs. Mapping and geolocation services. Your session-level location coordinate is transmitted to the Google Maps API to identify nearby bars. Google's use of this data is governed by Google's Privacy Policy.
   3. Hosting and Infrastructure Providers. The platform runs on third-party servers. Those providers may have access to data stored on those servers in the ordinary course of providing infrastructure services. We select providers that maintain appropriate data security standards.
   4. Legal and Compliance. We may disclose information if required by a valid court order, subpoena, or applicable law, or if we believe disclosure is necessary to prevent fraud, criminal activity, or harm to any person. We will attempt to notify you before complying with any legal demand if we are legally permitted to do so.
   If we are acquired by or merge with another company, your information may be transferred as part of that transaction. We will notify you if that happens and if it results in a material change to how your information is used.
5. What Are Your Rights?
   Depending on where you live, you may have the following rights regarding your personal information:
   1. Access. You can request a copy of the personal information we hold about you.
   2. Deletion. You can request that we delete your personal information. We will delete it unless we are required to keep it for legal or operational reasons.
   3. Correction. You can correct inaccurate personal information through your account settings or by contacting us.
   4. Portability. You can request that we export your data in a machine-readable format.
   5. Opt-Out of Sale. We do not sell personal information. There is nothing to opt out of.
   6. Non-Discrimination. We will not treat you differently for exercising any of these rights.
   To exercise any of these rights, email us at privacy@stumblon.com. We will respond within 30 days. We may need to verify your identity before acting on your request. California residents have additional rights under the California Consumer Privacy Act (CCPA), Cal. Civ. Code § 1798.100 et seq. New Hampshire and Maine residents have rights under their respective state privacy laws. The rights described above are intended to satisfy all applicable state privacy law requirements. If you believe we have not honored a specific statutory right, contact us and we will address it.
6. How Do We Protect Your Data?
   We use industry-standard security measures to protect the information we hold, including TLS encryption for data in transit and encrypted storage for account credentials. We limit access to personal data to personnel and systems that need it to provide the service. No internet-based system is 100% secure. We cannot guarantee the absolute security of your information. If we become aware of a data security incident that is likely to compromise your personal information, we will notify affected users by email within 72 hours of our discovery of the incident, to the extent we are required to do so by applicable law.
7. Cookies
   We use the following cookies:
   1. Session Location Cookie. Stores that you granted location permission during this browser session. Expires when you close your browser.
   2. Authentication Cookie. If you are logged in, keeps you logged in during your session. Expires when you log out or after 30 days of inactivity. We do not use third-party advertising cookies. We do not participate in any ad retargeting program. If we add analytics tools in the future that use cookies, we will update this Policy and present you with an appropriate consent mechanism.
8. Children
   The platform is not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will delete their account and all associated information.
9. Changes to This Policy
   We may update this Privacy Policy at any time. If the change materially affects how we use your personal information, we will notify registered users by email at least 14 days before the change takes effect and will post a notice on the platform. Continued use of the platform after the effective date constitutes acceptance of the updated Policy.
10. Contact Us
    Questions about this Privacy Policy or requests to exercise your rights:
    Stumblon LLC
    8 The Green STE B
    Dover, DE 19901
    privacy@stumblon.com
    We will respond within 30 days of receiving any request.
11. California Data Privacy Rights (CPRA / CCPA)
    This section applies solely to residents of the State of California and supplements the general rights described in Section 5 above. It is provided in accordance with the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), Cal. Civ. Code § 1798.100 et seq. Terms used in this section have the meanings given to them in the CCPA/CPRA.
    1. Categories of Personal Information Collected. In the preceding twelve (12) months, we have collected the following categories of personal information, as defined by the CCPA/CPRA:
       1. Identifiers - name, email address, IP address, and device identifiers.
       2. Personal records - date of birth (for age verification); business name and address (Bar Operators only).
       3. Commercial information - subscription and payment records held by our payment processor (Stripe); we do not store payment card data ourselves.
       4. Internet or other network activity - log data, pages visited, time of visit, browser and device type.
       5. Geolocation data - session-level latitude and longitude, which is not retained after the session ends.
       6. Inferences - aggregate engagement signals derived from usage data (e.g., listing views, check-in counts), used to provide analytics to Bar Operators.
    2. Categories of Sources. We collect personal information directly from you (when you create an account or use the platform), automatically from your device and browser, and from third-party service providers (Google Maps API for geolocation enrichment).
    3. Business or Commercial Purposes for Collection. We collect personal information to operate, maintain, and improve the platform; to verify user age; to facilitate payments for Bar Operator subscriptions; to provide analytics to Bar Operators; and to comply with applicable legal obligations. See Section 3 for the full purpose table.
    4. Categories of Third Parties with Whom We Share Personal Information. We share personal information with service providers acting on our behalf (Stripe, Google APIs, infrastructure/hosting providers) solely for the purposes described in Section 4. We do not sell personal information. We do not share personal information for cross-context behavioral advertising purposes.
    5. Your California Privacy Rights. Subject to applicable exceptions under the CCPA/CPRA, California residents have the right to:
       1. Know - request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we have shared it.
       2. Delete - request deletion of personal information we hold about you, subject to certain exceptions.
       3. Correct - request correction of inaccurate personal information.
       4. Opt-Out of Sale or Sharing - we do not sell personal information and do not share it for cross-context behavioral advertising. You have nothing to opt out of.
       5. Limit Use of Sensitive Personal Information - we do not use sensitive personal information (as defined by the CPRA) for purposes beyond what is necessary to provide the platform. No limitation request is required.
       6. Non-Discrimination - we will not deny services, charge a different price, or provide a different level of service because you exercised any of the rights above.
    6. Shine the Light. California Civil Code § 1798.83 ("Shine the Light" law) permits California residents to request information about personal information disclosed to third parties for their direct marketing purposes during the preceding calendar year. We do not disclose personal information to third parties for their direct marketing purposes.
    7. How to Submit a Request. To exercise your rights, submit a verifiable consumer request by emailing privacy@stumblon.com with the subject line "California Privacy Request." We will acknowledge receipt within 10 business days and respond within 45 calendar days. If we require additional time, we will notify you in writing. We may ask you to verify your identity before acting on your request. You may designate an authorized agent to submit a request on your behalf; the agent must provide written proof of authorization and you must verify your identity directly with us.