Privacy Policy

1. Who we are

This policy covers ncartsdirectory.com (the "Site"), operated by Arts Directories LLC, a Delaware limited liability company doing business as NC Arts Directory ("we," "us"). We decide how your personal information is used on the Site.

The Ray Arts Foundation (rayartsfoundation.org) is a separate nonprofit with its own privacy policy. We share with the Foundation only what is described in section 6.

2. Information we collect

You give us:

• Account: username, name, email, password (stored hashed), birth date, and the 18+ confirmation.
• Two-step sign-in: if you use it, your authenticator app key (stored encrypted), backup codes (stored hashed), and a cookie for any device you choose to remember.
• Profile: anything you add, such as a photo, bio, town or links. Private by default.
• Listings, events and claims: details of venues, organizations, artists and events; contact details you choose to publish; and claim proof (for example, an organization email, a website code, or documents like an IRS letter or business registration).
• Uploads: photos, video links and files, including in Spaces.
• Spaces activity: posts, replies, likes, files, follows and memberships.
• Email subscriptions: your email, the feeds you pick, and a record of your consent.
• Messages: what you send through contact forms, corrections and reports.
• "Use AI": the website address you give us and what we read from it.

Collected automatically:

• Technical and security data: IP address, browser type, pages requested, dates and times, and security events (such as failed sign-ins or blocked requests).
• Cookies: see section 8.
• Staff activity logs: records of what our staff change on the Site.

From public sources: listings and events may include business information from public websites, public calendars, OpenStreetMap, government records (such as IRS nonprofit data), MusicBrainz and Wikipedia. This is mostly about organizations and places. It can include the names of public contacts, artists or performers as published by the source.

3. How we use it

• To run your account and the Site's features.
• To review, verify and publish listings, claims, events and edits.
• To check that account holders are 18 or older.
• To send service emails (sign-in, verification, claim and review notices) and the feeds you choose.
• To draft listing text when you choose "Use AI."
• To keep the Site safe: two-step sign-in; stopping spam, fraud, bots and abuse (including a Cloudflare Turnstile check on sign-up and public forms); rate limiting; investigating problems.
• To improve the Site and fix errors.
• To meet legal duties and enforce our Terms of Use.

We don't sell personal information and don't share it for cross-context behavioral advertising.

4. What is public

• Published listings and events, including any contact details you choose to show.
• Your public profile, if you turn it on.
• Your name or username next to content you publish publicly, where shown.

Space posts and files are not public web pages. They are visible to the Space's members (and, where the owner allows, its followers).

5. Service providers

We use companies that process data for us under contract:

• Hosting — our web hosting provider, which stores the Site and its database.
• Cloudflare — content delivery, firewall, bot protection (Turnstile) and email routing for our inbox.
• Emailit — sending our emails.
• Firecrawl — reading website pages, only when you choose "Use AI."
• OpenRouter and the AI model providers it routes to — drafting listing text, only when you choose "Use AI." We send only website text, never your account details.
• Video services such as YouTube or Vimeo, when you add a video link (they may set their own cookies when you play a video).
• Payments: we do not take payments on the Site yet. If we add paid plans, we will name the payment processor here first.

6. Other sharing

• Ray Arts Foundation: published listing and event data is public, and the Foundation may use it like anyone else. We do not give the Foundation your account, email or private data.
• Legal reasons: to comply with law, valid legal requests, or to protect rights and safety.
• Business transfers: if we merge, sell or reorganize, data may move to the new owner under this policy.
• With your consent.

7. Emails

Feed emails are sent only after you confirm your email (double opt-in). We keep a record of your consent: when you asked, when you confirmed, the wording you agreed to, and when you unsubscribed. Every feed email has an unsubscribe link and a one-click unsubscribe header. You can also turn feeds off in your account. Service emails about your account are still sent while you have an account.

8. Cookies and similar technology

We use cookies to make the Site work, not to track you for ads.

We do not currently use Google Analytics, advertising pixels or similar trackers. Most browsers let you block cookies, but the sign-in and security cookies are needed for accounts to work.

9. How long we keep data

• Account data: while your account is open. When you delete your account, we erase it after a 14-day waiting period, except as below.
• Age check: after your account is deleted, we keep one line in our consent records saying that the 18+ check was met at sign-up. We do not keep your birth date.
• Listings and events: published listings are part of a public directory and may stay after you leave, without your personal account details.
• Consent and unsubscribe records: kept for 3 years to show we had permission. After you delete your account they are kept only in anonymized form (no name, and your email replaced by a one-way code).
• Do-not-email list: if you unsubscribe or delete your account, we keep a one-way code of your email address, not the address itself, so we never email you again by mistake.
• Security and rate-limit logs: 12 months, longer if needed for an investigation.
• Staff activity logs: 2 years.
• Claim evidence (what you send to prove you run a listing): uploaded proof files are stored outside the public web folder, seen only by our review team, and deleted 90 days after we decide the claim. We keep a decision record: the type of proof, the reason, who reviewed it, the date, and a SHA-256 fingerprint of the file (not the file). Decision records are deleted 3 years after the decision.
• "Use AI" website reads: cached for up to 7 days.
• Data download files: deleted 3 days after they are ready.
• Backups: overwritten on a rolling basis within 90 days.

10. Security

We use HTTPS, a web application firewall, bot checks (including Cloudflare Turnstile), rate limiting, staff activity logs, and limited staff access. Two-step sign-in is required for staff (an authenticator app with backup codes) and optional for members (an authenticator app or an emailed code, with the option to remember a device for 30 days). Authenticator keys are stored encrypted. No system is perfectly secure. If a breach affects you, we will notify you as the law requires (including the North Carolina Identity Theft Protection Act).

11. Your choices and rights

You can:

• See and update your account and profile at any time.
• Make your profile private or public.
• Unsubscribe from feeds.
• Download a copy of your personal data.
• Ask us to correct or delete your data.
• Delete your account.

Email [email protected]. We may need to confirm your identity. We'll answer within 45 days. We won't treat you differently for using these rights.

Download my data. Go to Account → Privacy and ask for your data. We email you a link to confirm it is you. After you confirm, we prepare one file with what we keep about your account and email you a link to it. Only you can download it, while signed in to your account. The file is deleted after 3 days.

Delete my account. Go to Account → Privacy, choose "Delete my account," enter your current password and type DELETE. Here is what happens:

• Your name and profile are hidden from the public site right away.
• There is a 14-day waiting period. During it you can sign in only to choose "Keep my account" or "Delete now." The email we send you also has a link to keep your account.
• We send one reminder 3 days before the deletion date.
• On day 14 (or when you choose "Delete now"), we erase your account and personal data.
• Listings you own are not deleted: they go back to the directory and can be claimed again, without your personal details.
• Content you posted in other people's Spaces may stay, without your name.
• We keep only limited records, with your email replaced by a one-way code: consent records (including one line saying the 18+ check was met, never your birth date), claim decisions without your name, and a do-not-email list so we never email you again.

If you own a Space, you can't delete your account until you hand the Space to another member or delete it. The same applies if you are the only admin of a team: make someone else an admin first.

You can also email [email protected] from the address on your account to ask for a copy of your data or to delete your account. We confirm the request with you and complete it within 30 days.

Questions about a listing claim: [email protected].

California and other states. Some states give residents extra privacy rights, such as the right to know, delete, correct and opt out of sale or targeted advertising. We don't sell personal information or use it for targeted advertising. You can make any request at the email above, and you may use an authorized agent. If we deny a request, you can appeal by replying to our answer.

12. Children

The Site is for adults. You must be 18 or older to create an account or submit content. We don't knowingly collect personal information from anyone under 18. If we learn we have, we will delete it. Contact us if you believe a minor has given us information.

13. International visitors

We are based in the United States, and the Site is meant for people interested in North Carolina. Your information is stored and processed in the United States.

14. Changes

We may update this policy. We'll post the new version with a new "Last updated" date and, for important changes, tell you on the Site or by email.

15. Contact

Arts Directories LLC, doing business as NC Arts Directory
Email: [email protected]