Privacy Policy

Who’s responsible for your information

Creatures of the Forest, LLC, a North Carolina company doing business as Painted Circle®, 102 College Station Drive, Suite 3 #250, Brevard, NC, USA. Write to us at info@paintedcircle.com about anything in this policy. Your email comes straight to our founder, who handles privacy questions personally.

What we don’t do

• No trackers. Nothing about what you do on Painted Circle is sent to Facebook, Google or anyone else. Our pages are locked so that a visitor’s browser can’t load anything from outside companies except our own database and storage.
• No selling of your information. We never sell or rent anyone’s information, to advertisers or anyone else. We don’t build profiles of our members, so there’s nothing to sell. If we ever show ads, they won’t use your information or track you.
• No guessing. We never work out your interests from what you look at. You pick them yourself.
• No profiles of visitors. We don’t follow people around the site. The only counts we keep are simple totals, like how many times a page was opened or a business’s QR code was scanned, never who opened or scanned it.

What we collect, depending on who you are

Everyone who visits. Like every website, our hosting company (Vercel) and our database company (Supabase) see your internet (IP) address and keep short request logs. Our forms use a scrambled version of your address, which changes every day, to stop spam. When a public page opens, your browser tells us which page it was, and we add one to that page’s total for the day; we don’t record who opened it, and nothing is saved in your browser for it. If you tap “Open in maps” on a listing, your own map app opens; what it collects is up to that app.

Travelers with an account.

• Your email address (to sign you in and write to you).
• The public display name you choose for reviews, and, if you give one, a private “call me” name for our emails.
• The interests and places you pick, and your settings (like how you hear about offers).
• The businesses you save and the lists you make. Only you can see them. We use them to show you your lists and to offer you a saved business’s offer first.
• The offers shared with you, and whether you saved them.
• If you turn on two-factor sign-in: the link to your authenticator app, and scrambled backup codes.
• Short security records: sign-in codes, wrong tries, how many offers you opened each day (only the number), and any request to change or recover your email address (how long each is kept is under “How long we keep your information”).

Reviewers. Your review, scores, photos and any edits; our check’s result; the language it’s written in; translations made for other readers.

Supporters. Your plan, payment dates and amounts, any promotion code, refunds, and Stripe’s reference numbers. Stripe handles your card and billing details; we never see your card number. Stripe’s messages to us are cleared after 30 days.

People who run a business. Your sign-in email, and the business emails you give us for reviews, listing news and customer help (the customer-help email is shown to travelers who can use your offer); your listing (name, text, photo, places, spots and addresses, offer, tags); your answers to our setup questions (so the listing text can be rewritten); your signed pledge; your QR code numbers (simple totals of scans and reviews, never who scanned); and a record of who changed what on the listing (by role, not name); your replies to reviews and any disputes you raise; past names and web addresses (so old links keep working); and requests to hand over access to the business. If you add team members, their names, photos and the words you add for them.

People who apply, recommend a business, or ask us to remind them. An application: the business, your name, email and what you tell us. A recommendation: the business and what you tell us (linked to your account if you’re signed in). “Remind me later”: your email address, which we delete right after sending the one reminder.

People who report one of our pictures. What you tell us about the picture. To stop spam we keep a scrambled, daily-changing version of your internet address for one day.

People who email us. Your message and email address, in our inbox (Google Workspace). We may use Claude to help draft our reply, so your email may be sent to Anthropic for that (see “AI on Painted Circle” below). A person always reads and sends the reply.

Why we use your information

Here’s why we use the information described above. The law asks us to name a reason for each use, so each one is in brackets:

• To provide what you asked for (our agreement with you): your account, your listing, your reviews, offers, Supporter plan, and the emails that go with them, including notices when our Terms or this policy change.
• To keep Painted Circle safe and fair (our legitimate interest, balanced against yours): checking what’s shared, stopping spam and misuse, keeping short security records, and keeping a small record of businesses we’ve blocked so they can’t simply sign up again.
• To tell people about Painted Circle (our legitimate interest): sharing listings and lines from published reviews when we tell people about Painted Circle, and anonymous totals (like how many travelers are interested in a place) to understand how the guide is used.
• Because the law requires it: payment and tax records.
• Because you chose it (consent): optional emails, such as offer emails, reminders, replies to your reviews, and our occasional news (only if you ticked the box for it). You can switch each one off in My circle → Settings or your dashboard, and every news email has its own unsubscribe link. We keep the date you said yes to news, as a record of it.

AI on Painted Circle

We use AI to help a very small team look after a lot of content. Here’s exactly where:

Anthropic deletes what we send within 30 days. It keeps something longer only if its own safety systems flag it, and then for up to 2 years. OpenAI keeps its records for up to 30 days. Neither company uses what we send to train its AI.

The AI can approve something or ask for a change, and it can take a disputed review down while a person decides. It can’t block a business, close an account or stop anyone from reviewing: a person makes those decisions, and you can always ask a person to look again.

Your photos

What’s public, and who else sees your information

Public: business listings (including the spots and addresses a business adds, and its team members); reviews, review photos and business replies, with the reviewer’s display name. Never a traveler’s email address. A business’s customer-help email is shown only to travelers who can use its offer. We may also share listings and lines from published reviews when we tell people about Painted Circle (for example in our newsletter, or in an article or podcast about us), with the reviewer’s display name.

Businesses see the reviews of their own business, the same as everyone else. They never see who reported them, who saved their offer or who scanned their QR code.

Companies that help us run Painted Circle also handle some of your information, such as storing it, sending our emails or taking payments. Each one may use it only to do that job for us, and a contract with each of them protects it. Here’s who they are and what they do for us:

We also share information if the law requires it, or to protect someone’s safety.

Where your information is stored

Your information is stored in the United States: our database is in Oregon, and the companies that help us run Painted Circle are based in the US. If you live in the EU or UK, this means your information is sent to the US. To protect it to EU and UK standards, we rely on the standard data protection contracts these companies offer and, where they’ve signed up to it, the EU–US Data Privacy Framework (and its UK extension).

How long we keep your information

We keep each kind of information only as long as we need it, and then delete it. Here’s how long that is for each:

Copies kept by the companies that help us. Some of these companies keep their own short-term copies or records. Here’s how long:

What’s stored in your browser

Websites can save small pieces of information in your browser (cookies and similar storage). Painted Circle saves only these three:

• The sign-in cookie, which keeps you signed in. It goes when you sign out or it expires.
• A review draft. If you write a review before confirming your email, your words wait in your own browser until you’ve confirmed, so nothing is lost.
• A business’s language choice for “See it in my language” on its dashboard, so it doesn’t have to pick it again.

None of these are used for tracking, and none are sent to anyone else. Because we only save what the site needs to work, there’s no cookie banner to click through.

Your rights and choices

Wherever you live, you have these rights over your information. You can:

• See what we hold about you, and get a copy of it: download it yourself in My circle → Settings → Your account (a business’s copy is on its Settings page).
• Fix anything that’s wrong (most of it directly in My circle or your dashboard).
• Delete your account, or a business, from your settings.
• Object to how we use your information, or ask us to limit it.
• Switch off any optional email.
• Change your mind about anything you agreed to, at any time.

Email info@paintedcircle.com for anything you can’t do yourself, like a copy of what we hold if you don’t have an account. We’ll reply within a month and won’t ask for ID unless we really need it. If you’re not happy with our answer, you can complain to a data protection authority: in the EU, the one in your country; in the UK, the Information Commissioner’s Office (ICO).

How we keep your information safe

Here’s what we do to protect your information:

• Everything travels between your browser and us encrypted, and our database is encrypted where it’s stored.
• No passwords to steal: sign-in is by email link or code, with optional two-factor sign-in.
• Codes and backup codes are stored scrambled.
• Our database lets each person reach only their own private information, and we test those rules automatically.
• Only our small team can reach private records, and our own admin accounts must use two-factor sign-in.
• Photos stay private until they’ve passed our check.

Age

Accounts on Painted Circle are for people 18 and over. Anyone can browse the guide, but if we learn that someone under 18 has an account, we’ll delete it.

Changes to this policy

If we change this policy in a way that matters, we’ll email you at least 30 days before the change applies (sooner only if the law requires it), just as with our Terms. The date at the top shows when it was last updated.