Privacy Policy

1. Who we are

DirectoryMaker ("we", "us", "our") is a software-as-a-service platform that lets people create and run directory websites. This policy explains what data we collect, why, and how we handle it.

2. What data we collect

Account data

When you sign up, we collect:

• Email address
• Name
• Password (stored securely hashed, never in plain text)

Directory and listing data

When you create a directory or submit a listing, we store:

• Directory name, configuration, and branding (logo, colours, domain)
• Listing details: title, description, contact information, address, phone number, email, website, opening hours, images
• Blog posts and static page content

Payment data

We use Stripe to process payments. We do not store your credit card details. Stripe handles this directly and is PCI-DSS compliant. We store:

• Stripe customer and subscription identifiers
• Plan type and billing status
• Payment amounts and dates

Usage and analytics data

We collect anonymised analytics to show directory operators how their sites perform:

• Listing page views (session identifier, timestamp)
• Website link clicks (session identifier, timestamp)
• IP addresses (used for analytics and rate limiting)

Contact messages

When a visitor sends a message through a directory listing, we store the sender's name, email, phone number (if provided), and message content. This data is accessible to the directory operator.

Cookies and sessions

We use cookies for:

• Authentication: Keeping you logged in (session cookie, essential)
• Security: CSRF protection (essential)
• Rate limiting: Preventing abuse of contact forms (essential)

We do not use advertising cookies or third-party tracking cookies. All cookies we set are essential for the Platform to function.

3. How we use your data

We use your data to:

• Operate and maintain the Platform and your directories
• Process payments and manage subscriptions
• Send transactional emails (welcome messages, billing notifications, listing status updates, trial reminders)
• Provide analytics to directory operators
• Power AI features (see Section 4)
• Prevent abuse and enforce our terms

We do not sell your data. We do not send marketing emails unless you've opted in.

4. AI and third-party data processing

DirectoryMaker uses AI services to power certain features. When you use these features, some of your data is sent to third-party AI providers:

Feature	Provider	Data sent
Description generation and rewriting	Anthropic	Listing text content
Semantic search and embeddings	OpenAI	Listing text content
Business data import	Outscraper, Google Places	Search queries (business type, location)

These providers process data according to their own privacy policies and terms. We only send the minimum data needed for each feature to work. No personal account data (email, password, payment info) is sent to AI providers.

5. Third-party services

We use the following services to operate the Platform:

Service	Purpose
Amazon Web Services (AWS)	Hosting, database, email delivery (SES), file storage (S3)
Stripe	Payment processing and subscription billing
Anthropic	AI-powered content generation
OpenAI	AI-powered search embeddings
Outscraper	Business data imports
Google Places API	Business details and photos

6. Data storage and security

Your data is stored on servers managed by Amazon Web Services. We take reasonable measures to protect your data, including:

• Encrypted connections (HTTPS/TLS) for all traffic
• Secure password hashing
• Database access restricted to application servers only
• Secrets and API keys stored in AWS Secrets Manager
• Secure session cookies (HTTPS-only in production)

No system is perfectly secure. If we become aware of a data breach that affects your personal data, we will notify you as required by law.

7. Data retention

• Account data: Retained while your account is active. Deleted within 90 days of account closure.
• Directory and listing data: Retained while your account is active. Deleted within 90 days of account closure.
• Analytics data: Retained for 12 months, then automatically deleted.
• Payment records: Retained as required by tax and financial regulations.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (right to erasure)
• Export your data in a portable format
• Object to certain processing
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us through your dashboard. We will respond within 30 days.

9. Directory operators and their users

If you operate a directory on DirectoryMaker, you collect data from your own users (listing owners, visitors who send contact messages). In this relationship:

• You are the data controller for data collected through your directory
• We are the data processor, handling it on your behalf to operate the Platform

You are responsible for informing your directory's users about how their data is collected and used, and for complying with applicable privacy laws.

10. Children

DirectoryMaker is not intended for children under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We'll notify you of material changes via email or a notice on the Platform. The "last updated" date at the top reflects the most recent version.

12. Contact

Questions about this privacy policy? Reach us through the contact options in your dashboard.