Legal

Privacy policy

This page sets out what Old Bridge Local collects from you, why I collect it, how long I keep it, and what you can make me do about it. I wrote it to be read, not skimmed.

Effective October 28, 2026. This is the current version, and it replaces every earlier one.

Who this applies to

Old Bridge Local is a local business directory for Old Bridge, NJ, published at oldbridgelocal.com. This policy covers everything the site does with personal information: the forms you can fill in, the traffic measurement running quietly in the background, and the business details published on the listing pages.

The site is run from British Columbia, Canada, so I handle personal information under Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). Some US states have privacy laws of their own. Whether or not one of them applies to a site this size, the choices and rights described below are open to everyone, wherever you live.

What I collect

Apart from public material, such as the business details covered further down, personal information reaches me through this site three ways.

Information you type into a form

The site runs three forms: contact, add a listing, and claim a listing. Between them they ask for a name, an email address, a phone number, your role at the business when you claim one, the business details you want published (including an optional logo and photos), and whatever you write in the message box. The IP address and country each submission came from are saved with it. You choose what goes in. Nothing is pre-filled from somewhere else, and I have never bought a contact list. If you write to me by email or by post instead, that message is handled and kept under the same rules as a contact message.

Information your browser sends on its own

The server records the requests it receives, the way every web server does: the page requested, the date and time, the referring page, your browser and device type, and your IP address. The network provider counts visits in aggregate, and search engine reports show me which pages and search terms bring people here. That is how I decide what to write next.

Information PayPal sends when you buy Premium

A Premium upgrade is paid on PayPal's own checkout, so your card or bank details go to PayPal and never to this site. PayPal sends me the subscription's ID, status and billing dates, and the name, email address and payer ID on the PayPal account that paid. I keep the subscription ID, status, dates, email address and payer ID with the listing the upgrade belongs to, and I do not keep the name. What PayPal does with your information is covered by PayPal's own privacy policy.

Outside PayPal's checkout, I do not ask for financial information, government identifiers or health information, and I would have no use for them if you sent them. Please keep them out of the forms.

Why I collect it

To write back to you, and to follow up on a correction.
To review a listing submission or a claim, and to check that the person sending it is actually connected to the business.
To publish the business information you asked me to publish.
To keep the site running, spot abuse, and block automated spam.
To see which pages are useful, so I write more of what people actually need.
To run a Premium upgrade you paid for, and to keep the records that tax rules require.

I do not build advertising profiles. I do not sell personal information, and I do not share it for targeted advertising: not to a marketing list, not to a lead broker, not for any amount of money anyone has offered. Those are the main uses US state privacy laws let you opt out of, and neither happens here, so there is nothing to opt out of.

Sending a form is your consent for me to use what is in it for the purposes listed above. If I ever want to use your information for something outside that list, I will ask you first.

You can withdraw consent whenever you like by writing through the contact form. Tell me what you want deleted and I will delete it, apart from anything I am legally required to hold on to. Withdrawing consent for a published listing takes the listing down with it.

Cookies and analytics

This site sets two cookies on every visit. The session cookie is strictly necessary: the forms need it to work, and it is what protects them against cross-site request forgery. The second cookie holds a copy of the same anti-forgery code, which the site's framework sets by default. Both expire after 2 hours without activity. The security provider in front of the site, and the bot check on the forms, may set short-lived cookies of their own to tell people apart from automated traffic.

The cookies themselves hold only random, encrypted codes. The session cookie links your visit to a short-lived record on the server holding your IP address, your browser type and the address of the last page you opened here. After you send a form, the record can also hold what you typed, until the next page has been shown to you. Expired records are deleted as the site runs.

The analytics measure traffic in aggregate rather than following individuals around. There are no advertising cookies here, no retargeting pixels and no social media tracking widgets, which is also why no consent banner is sitting on top of this page waiting for you to dismiss it.

You can block or delete cookies in your browser settings. Blocking them will not stop you reading anything on the site, though it may stop a form from submitting. Nothing here tracks you across other websites, and nothing here sells or shares your information for advertising, so a Do Not Track or Global Privacy Control signal has nothing to switch off: the site treats you the same either way. If that ever changes, those signals will be honored, and this policy will say so first.

Business listing information

Most of what gets published here is business contact information: a company name, an address, a phone number, opening hours, a website. It is the information a business puts out so customers can reach it, and it is published here for that same reason.

Listings are put together from publicly available sources, including the open map data published by OpenStreetMap and Overture Maps, and from submissions by business owners. I do not publish an owner's or an employee's home address, personal phone number or personal email. If a listing has picked up something personal by mistake, tell me and it comes off the same day I read the message.

If you would rather your business was not listed at all, ask and I will remove it. I do not need a reason and I will not argue with you about it.

Personal information goes to service providers only where they need it to keep the site working, and only for that:

the company that hosts the server this site runs on;
the network and security provider that sits in front of it, filters malicious traffic, runs the bot check on the forms and counts page views;
the email service that carries my replies and the form notifications;
PayPal, which processes a Premium payment if you buy an upgrade;
an IP-location service, ip-api.com, which my review tools ask which country a form submission's IP address comes from;
the map service, OpenStreetMap, whose map tiles your browser loads on any page that shows a map, such as a listing page, so it sees your IP address and the part of the map you are looking at.

The host, the network provider and the email service may use the information only to provide their service. PayPal, ip-api.com and OpenStreetMap handle what they receive under their own privacy policies. Past these, I disclose personal information only where the law leaves me no choice: a court order, a warrant, or a legal obligation I cannot decline.

Where it is stored

Form submissions sit in a database on a server I control. The site is run from Canada, and the server and the providers above may be in Canada, the United States or elsewhere, so information you send may be stored in or accessed from those countries and may be subject to their laws. If that concerns you, send less. The forms only need enough to write back to you.

How long I keep it

Contact messages: kept while I am dealing with the matter and for up to two years afterwards, so I can see the history of a listing that has been corrected before.
Listing submissions and claims: kept for as long as the listing is published, plus two years, so I can show why an entry says what it says.
Premium subscription records (the subscription ID, the PayPal email address and payer ID, status and dates): kept while the subscription runs, and afterwards for as long as tax rules require. PayPal keeps its own record of each payment.
Server logs: rotated and deleted within 90 days.
Analytics: aggregate figures only. They identify no one, so I set no time limit on them; the network provider and the search engine keep their own reports for as long as their services do.

Anything past its retention period is deleted rather than quietly archived somewhere.

How it is protected

The whole site is served over an encrypted connection. Access to the database and to form submissions is limited to the people who run the site, and the software gets patched.

No system is perfect and I am not going to pretend otherwise. If a breach ever puts your information at real risk, I will tell you promptly and notify every authority the law requires me to notify.

Your rights

You can ask me to:

tell you what personal information I hold about you and what I have done with it;
correct anything that is wrong or out of date;
delete what I hold, or take a listing down;
stop contacting you.

Send the request through the contact form. I will respond within 30 days. Before I hand over a record I may ask a question or two to confirm you are who you say you are, and that check exists to protect you rather than me. Asking costs nothing, and it never changes how your business is treated in the directory.

If you are not satisfied with how I handled it, you can complain to the Office of the Privacy Commissioner of Canada, which handles complaints about Canadian-run organizations, including from people outside Canada, or to the consumer protection office of your state attorney general. Neither charges a fee.

Children

This site exists for adults looking up local businesses. I do not knowingly collect personal information from anyone under 13. If you think a child has sent something through a form, tell me and I will delete it.

Links to other sites

Listings link out to business websites, social profiles and mapping services. Follow one of those links and you are on somebody else's site, under somebody else's privacy policy. I have no control over what they collect, and this policy stops at the edge of mine.

Changes to this policy

When this policy changes, the effective date at the top changes with it. If a change materially affects how information already collected is handled, I will say so on the page instead of quietly editing a sentence and hoping nobody notices.

How to reach me

Privacy questions, access requests, corrections and removals all go to the same place. Use the contact form and say what you need. It reaches a person, not a ticket queue.

Old Bridge Local does not publish a postal address or a telephone number, because there is no public office and no phone line to publish. Everything here is handled in writing.