Privacy Policy

Welcome to NepCircle's Privacy Policy. This policy describes how Appcly IT Solution, doing business as NepCircle ("we," "us," or "our"), collects, uses, stores, and protects your personal information when you use our platform, website, mobile applications, and related services (collectively, the "Service").

By using NepCircle, you consent to the data practices described in this policy. If you do not agree with our practices, please do not use our Service.

Your Rights: You have rights regarding your personal data, including the right to access, correct, delete, and control how your information is used. We are committed to protecting your privacy and complying with applicable data protection laws including GDPR, CCPA, and other regulations.

2.1 Information You Provide

We collect information that you voluntarily provide when using our Service:

• Account Information: Name, email address, phone number, password, profile picture, and bio
• Profile Data: Location, preferences, community interests, language preferences
• Content: Posts, listings, comments, messages, photos, videos, and other content you create or share
• Community directory listings: When you add a free business listing, we store the details you submit (such as business name, contact name, description, phone, email, website, and city or area). Information you include may be shown on your public listing page so other members can discover and contact you. Please only share contact information you are comfortable appearing publicly.
• Communications: Messages sent through our platform, customer support inquiries, feedback
• Payment Information: When you purchase premium features, we collect payment details through our payment processors (we do not store credit card numbers directly)
• Verification Data: Identity verification documents if you choose to verify your account

2.2 Automatically Collected Information

We automatically collect certain information when you use our Service:

• Device Information: IP address, browser type, device type, operating system, mobile network information
• Usage Data: Pages visited, features used, search queries, clicks, time spent on pages, referral sources
• Location Data: Approximate location based on IP address, precise location if you grant permission. If you use our homepage location picker or "Our neighborhood" section, your chosen city and coordinates are sent to Geoapify and Photon (map data providers) solely to fetch nearby business results — this look-up does not send your name, email, or any other account information to those providers.
• Cookies & Tracking: Information collected through cookies, web beacons, and similar technologies (see Section 8)
• Log Data: Server logs including access times, app crashes, and system activity

2.3 Information from Third Parties

We may receive information about you from:

• Social Media: If you connect your social media accounts, we may receive profile information
• Authentication Services: Information from Google, Facebook, or other authentication providers
• Social Login Data: We collect your name and email from GitHub Login, Facebook Login, and Google/Gmail Login for authentication and account management.
• Analytics Providers: Aggregated usage and demographic data
• Other Users: Information other users provide about you (e.g., when they tag you in posts)

We use your information for the following purposes:

3.1 Service Provision & Operation

• Create and manage your account
• Enable you to post content and interact with other users
• Facilitate transactions and communications between users
• Provide customer support and respond to inquiries
• Process payments and manage subscriptions

3.2 Platform Improvement & Personalization

• Analyze usage patterns to improve our Service
• Personalize your experience and content recommendations
• Develop new features and functionality
• Conduct research and analytics
• Test and optimize platform performance

3.3 Safety & Security

• Verify user identity and prevent fraud
• Detect and prevent spam, abuse, and illegal activity
• Enforce our Terms of Service and community guidelines
• Protect the rights, property, and safety of our users
• Comply with legal obligations and respond to legal requests

3.4 Communications

• Send you service-related notifications and updates
• Respond to your comments and questions
• Send marketing communications (with your consent)
• Notify you about new features and community updates

We may share your information in the following circumstances:

4.1 Public Information

Information you choose to make public (such as your profile, posts, listings, and comments) is visible to other users and may be indexed by search engines.

4.2 Service Providers

We share information with third-party service providers who perform services on our behalf:

• Cloud Hosting: Supabase (database), Vercel (hosting)
• Media Storage: Cloudinary (image and video hosting)
• Analytics: Google Analytics, Vercel Analytics
• Payment Processing: Stripe or similar payment processors
• Email Services: Transactional and marketing email providers
• Customer Support: Support ticket and chat systems

4.3 Legal Requirements

We may disclose information if required by law or in good faith belief that such disclosure is necessary to:

• Comply with legal obligations, court orders, or government requests
• Enforce our Terms of Service or other agreements
• Protect the rights, property, or safety of NepCircle, our users, or the public
• Investigate fraud, security issues, or technical problems

4.4 Business Transfers

If NepCircle is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our Service of any change in ownership or use of your information.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

Important: We do not sell your personal information to third parties for their marketing purposes.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Below are specific retention periods for different types of data:

5.1 Specific Retention Periods

• Active Account Data: Retained while your account is active and for 90 days after account deletion (to prevent fraud and assist with investigations)
• Public Content (Posts, Listings, Comments): Retained while your account is active. After account deletion, you must delete individual posts; otherwise, they remain visible for up to 30 days before permanent deletion
• Community feed: Community feed posts are user-generated short-form content and may remain visible per platform retention rules. Content may not be pre-screened before publication, and users are responsible for posted content.
• Private Messages: Retained while your account is active and for 30 days after account deletion
• Transaction Records: Retained for 7 years (tax and legal compliance requirements)
• Payment Information: Stored by our payment processor (Stripe) according to their retention policies; we do not store full payment card details
• Customer Support Communications: Retained for 3 years from the date of last communication
• Server Logs & Access Logs: Retained for 90 days (security and debugging purposes)
• Analytics Data: Aggregated and anonymized data may be retained indefinitely (no longer personally identifiable)
• Cookie Data: Session cookies expire when you close your browser; persistent cookies expire after 90 days to 2 years depending on cookie type
• Inactive Account Profiles: Profiles with no activity may be deleted after 6 months of inactivity, and this deletion may occur without prior notice.
• Legal Hold: Information subject to legal hold, litigation, or regulatory investigation will be retained until the hold is lifted, regardless of other retention periods

5.2 Account Deletion

When you request account deletion, we will:

• Immediately disable your account and remove it from public view
• Delete your personal information within 30 days, except where retention is required for legal or legitimate business purposes
• Retain certain information in backup systems for up to 90 days (then permanently deleted)
• Anonymize or aggregate data that is kept for analytics or research purposes

5.3 Data Minimization

We regularly review the data we hold and delete or anonymize information that is no longer necessary. When we no longer need your information, we will securely delete or anonymize it in accordance with industry standards and data protection regulations.

Note: Even after deletion, some information may persist in backup systems or archives for a limited time before permanent removal. Additionally, information that has been shared with third parties (such as publicly posted content) may not be immediately removed from their systems.

You have the following rights regarding your personal information:

6.1 Access & Portability

• Request access to your personal information
• Receive a copy of your data in a structured, machine-readable format
• Download your content and data

6.2 Correction & Updating

• Update your profile information at any time through account settings
• Request correction of inaccurate or incomplete information

6.3 Deletion (Right to be Forgotten)

• Request deletion of your account and personal information
• Delete individual posts, listings, or content
• Note: Some information may be retained for legal or legitimate business purposes

6.4 Objection & Restriction

• Object to processing of your information for direct marketing
• Request restriction of processing in certain circumstances
• Opt-out of non-essential data collection

6.5 Marketing Communications

• Unsubscribe from marketing emails via the link in each email
• Adjust notification preferences in account settings
• Note: You cannot opt-out of service-related communications

6.6 Cookie Controls

You can control cookies through your browser settings. Note that disabling cookies may affect functionality. See Section 8 for details.

6.7 California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information (subject to exceptions)
• Right to opt-out of sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising CCPA rights

6.8 Additional U.S. State Privacy Rights

Residents of the following states have additional privacy rights under their respective state laws:

Virginia (VCDPA)

Virginia residents may exercise the following rights:

• Right to access personal data
• Right to correct inaccuracies in personal data
• Right to delete personal data
• Right to data portability
• Right to opt-out of targeted advertising, sale of personal data, and profiling
• Right to appeal a decision regarding your rights request

Colorado (CPA)

Colorado residents may exercise the following rights:

• Right to access personal data
• Right to correct inaccuracies in personal data
• Right to delete personal data
• Right to data portability
• Right to opt-out of targeted advertising and sale of personal data
• Right to opt-out of profiling for furtherance of decisions with legal or significant effects

Connecticut (CTDPA)

Connecticut residents may exercise the following rights:

• Right to confirm whether we process personal data and access that data
• Right to correct inaccuracies in personal data
• Right to delete personal data
• Right to data portability
• Right to opt-out of targeted advertising and sale of personal data
• Right to opt-out of profiling in furtherance of solely automated decisions with legal or significant effects

Utah (UCPA)

Utah residents may exercise the following rights:

• Right to access personal data
• Right to delete personal data
• Right to data portability
• Right to opt-out of targeted advertising and sale of personal data

Exercising State-Specific Rights: To exercise any state-specific privacy rights, contact us at privacy@nepcircle.com with your state of residence. Include "Privacy Rights Request" in the subject line. We will respond within the timeframes required by your state law (typically 30-45 days).

Exercising Your Rights: To exercise any of these rights, please contact us at privacy@nepcircle.com. We will respond to your request within 30 days (or as required by applicable law).

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

Security Measures Include:

• Encryption: Data encrypted in transit using TLS/SSL and at rest
• Access Controls: Restricted access to personal information on a need-to-know basis
• Authentication: Strong password requirements and optional two-factor authentication
• Monitoring: Regular security audits and monitoring for suspicious activity
• Infrastructure: Secure cloud infrastructure with redundancy and backups
• Employee Training: Regular security and privacy training for staff

Important: While we implement strong security measures, no method of transmission over the internet or electronic storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you and relevant authorities as required by applicable law, typically within 72 hours of becoming aware of the breach.

We use cookies and similar tracking technologies to collect and track information about your use of our Service.

8.1 Types of Cookies We Use

• Essential Cookies: Necessary for the Service to function (authentication, security, preferences)
• Analytics Cookies: Help us understand how users interact with our Service
• Functional Cookies: Enable enhanced functionality and personalization
• Advertising Cookies: Used to deliver relevant advertisements (if applicable)

8.2 Third-Party Tracking

We use third-party analytics services including:

• Google Analytics (with IP anonymization)
• Vercel Analytics
• Social media pixels (Facebook, Twitter, LinkedIn)

8.3 Your Cookie Choices

You can control cookies through:

• Browser settings (most browsers allow you to refuse or delete cookies)
• Opt-out tools provided by advertising networks
• Our cookie consent banner (where applicable)

Note: Disabling essential cookies may prevent you from using certain features of our Service.

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child under 18 without parental consent, we will take steps to delete that information.

Users must be at least 18 years old to create an account and use our Service. By using our Service, you represent that you are at least 18 years of age.

NepCircle is based in the United States, and your information will be collected, processed, and stored in the United States and potentially other countries where our service providers operate.

10.1 Cross-Border Data Transfers

If you are located outside the United States, please be aware that:

• Your personal information will be transferred to and processed in the United States
• U.S. data protection laws may differ from those in your country
• By using our Service, you consent to the transfer of your information to the U.S. and other countries

10.2 European Economic Area (EEA) & UK Users

For users in the EEA, United Kingdom, or Switzerland, we take additional measures to ensure your data is protected:

• Legal Basis: We transfer data based on your consent, contract performance, or legitimate interests
• Standard Contractual Clauses: We use EU-approved Standard Contractual Clauses (SCCs) with service providers
• Adequacy Decisions: Where applicable, we rely on adequacy decisions by the European Commission
• Safeguards: We implement appropriate technical and organizational safeguards for international transfers

10.3 Data Processing Locations

Your data may be processed in the following locations:

• United States: Primary data processing and storage
• Cloud Infrastructure: AWS, GCP, or similar cloud providers with global data centers
• CDN Networks: Content delivery networks for performance optimization

10.4 Your Rights for International Transfers

If you are located in the EEA, UK, or Switzerland, you have the right to:

• Request information about the safeguards we use for international transfers
• Obtain a copy of Standard Contractual Clauses (where applicable)
• Lodge a complaint with your local data protection authority

GDPR Representative: If you are in the EEA and have questions about data transfers or your GDPR rights, contact us at legal@nepcircle.com with "GDPR Inquiry" in the subject line.

Our Service may contain links to third-party websites, applications, or services that are not operated by us. We are not responsible for the privacy practices of these third parties.

We encourage you to review the privacy policies of any third-party services before providing your information. This Privacy Policy applies only to information collected by NepCircle.

Third-Party Services We Use:

• Supabase: Database and authentication (see Supabase Privacy Policy)
• Cloudinary: Media storage and delivery (see Cloudinary Privacy Policy)
• Stripe: Payment processing (see Stripe Privacy Policy)
• Google: Analytics and authentication (see Google Privacy Policy)
• Geoapify & Photon (OpenStreetMap): Map and business-location data for the homepage location picker and "Our neighborhood" nearby-places section

California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes.

We do not share personal information with third parties for their direct marketing purposes. However, if you are a California resident and would like to make such a request, please contact us at privacy@nepcircle.com.

Some web browsers have a "Do Not Track" (DNT) feature that lets you tell websites you do not want to have your online activities tracked.

Our Service does not currently respond to DNT signals. However, you can control tracking through cookie settings and opt-out mechanisms described in Section 8.

We may use automated decision-making and profiling technologies to improve your experience and personalize content on our platform.

14.1 What We Do

• Content Recommendations: We use algorithms to suggest relevant listings, events, and content based on your activity and preferences
• Search Results: We personalize search results based on your location, interests, and past behavior
• User Experience: We adapt interface elements and features based on usage patterns
• Fraud Detection: We use automated systems to detect and prevent fraudulent activity, spam, and abuse
• Analytics: We analyze user behavior to understand trends and improve our Service

14.2 No Significant Automated Decisions

Important: We do NOT use automated decision-making that produces legal effects or similarly significant effects on you without human involvement. This means we do NOT:

• Automatically approve or deny account applications (human review is involved)
• Automatically make credit, financial, or employment decisions
• Automatically determine your eligibility for services based solely on automated processing
• Use automated systems to make decisions that significantly affect your rights or legal status

14.3 Your Profiling Rights

If you are located in a jurisdiction that grants rights regarding automated decision-making (such as the EEA under GDPR, or certain U.S. states), you have the right to:

• Receive information about the logic involved in automated decision-making
• Object to profiling in certain circumstances
• Request human review of automated decisions
• Opt-out of profiling for decisions with legal or significant effects (where applicable under state law)

14.4 Data Used for Profiling

When we engage in profiling or automated processing, we may use:

• Your profile information (location, preferences, interests)
• Your activity on the platform (views, searches, clicks, posts)
• Device and browser information
• Inferred interests and preferences based on your behavior

To exercise your rights or ask questions about our use of automated decision-making and profiling, contact us at privacy@nepcircle.com.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email (if you have provided an email address)
• Display a prominent notice on our Service
• Provide at least 30 days' notice for material changes

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy. If you do not agree to the changes, you must stop using the Service and delete your account.