Privacy Policy

We collect only what we need to run our services:

• Contact & business details you give us: name, business name, email, industry, ZIP code, and, where you provide them, your website and phone number, and, only if you use the optional street-address check when claiming a slot, the street address you type (used once, never stored).
• Waitlist signups: your email, the market you asked about, and, if you came from the ZIP checker, the ZIP code you typed. We use them to tell you when a market opens.
• Account credentials. If you create an advertiser account, we store your email and a salted one-way hash of your password. We cannot see your password. When you ask to reset or change your password, we keep a record of the request: a one-way hash of the link we email you (never the link itself), when it was requested and used, and a scrambled form of the internet address that requested it and of the one that used it.
• Business details you hand us in person. If you give us a business card or your details at your business, we store them (name, business, contact details, and our notes from the visit) so we can follow up about advertising. If you hand us a card, we photograph it, use OpenAI to read the contact details off the photo, and keep the photo with your record. Email us anytime and we will delete all of it.
• Order & payment information. Payments are processed by Stripe. We receive confirmation and order details; we do not see or store your full card number.
• Ad content you create or upload: logos, images, text, and the messages you exchange with the AI Ad Builder while designing your ad.
• Messages and forms you send us: the contact form, the advertise and sponsor inquiry forms, the waitlist form, and the Own Your AI application. Formspree delivers them to our email inbox and sees your internet address when you submit.
• Site analytics. We use Vercel Web Analytics and Vercel Speed Insights to see which pages are visited and how fast they load. They do not use cookies. For each page view they record the page, the site you came from, your browser and device type, your general location (country and city, not your address), and page speed measurements. Vercel marks a visit with a temporary code that it discards after 24 hours. We cannot identify you from this data.
• Technical and security records. Our servers keep error logs and request counters so we can fix problems and block abuse. These can include your internet address, the time and type of a request, and, when an order email fails to send, a scrambled form of the email address it was going to. We use them only for troubleshooting and security.
• Program sessions. If you join Own Your AI, our working sessions, including the kickoff call, may be recorded and transcribed with an AI note-taking tool for our notes only. We tell you at the start of each recorded call. Recording and transcription run on our own computer and no outside service receives the audio. Recordings and transcripts are kept privately for the program and our records afterward, and are never published or shared outside the program.

• To proof, print, and mail your advertising placement.
• To print your business name, your approved ad, and a QR code that sends scanners to the website you gave us, on a card mailed to households in your market. Once printed, that information is public and cannot be recalled.
• To communicate about your order and respond to your messages.
• To send you service and marketing emails (you can opt out of marketing at any time).
• To operate, secure, and improve our services.

We share information only with the providers that make the service work, and only as needed:

• Stripe: payment processing.
• Supabase: secure database and file storage for orders and artwork.
• Our print vendor and USPS: your approved ad and business name go to the printer with the rest of the card, and the finished cards are mailed by USPS.
• U.S. Census Bureau geocoding service: if you use the optional street-address check when claiming a slot, we send the address you type to the Census Bureau's public geocoder, and we match the result to a USPS carrier route. We do not store the address, log it, or attach it to your order. The answer (on this edition's route list, the next edition's, or neither) is shown to you on the spot and is not saved either. The ZIP checker on the front door works differently: it matches the ZIP you type in your browser against our public card list, and the ZIP itself is not sent to us unless you then join a waitlist from it (Section 1).
• OpenAI: powers the AI Ad Builder and our content checks. When you design an ad, we send OpenAI the messages you type and any reference images you attach. If you give us your website address, we also read your public website and send OpenAI its text, colors, and logo so the Builder can match your brand. Every image the Builder generates, and any finished artwork you upload instead, is checked by OpenAI's moderation service before we accept it. OpenAI does not use this data to train its models and keeps it for up to 30 days for abuse monitoring.
• Vercel: website hosting, server logs, and the site analytics described above.
• Klaviyo: order, account, and marketing email. When you order, join a waitlist, approve a proof, ask to reset or change your password, or a password on your advertiser account changes, we create or update a profile at Klaviyo with your email, first name, business name, industry, market, and order details, including your order number and Design link, and Klaviyo keeps a history of those events so it can send the right emails. A password reset email carries a one-time link, and Klaviyo's history keeps a copy of it; the link stops working once it is used or one hour after you asked for it. Unsubscribing stops marketing email; emails about an order you placed or about your account still send.
• Formspree and Google Workspace: delivery of the forms above to our inbox, and our own internal notices. When you reserve a slot, place an order, approve a proof, or join a waitlist, we send ourselves a short notice with your business, email, and order details through the same service.

Our providers store and process your information on servers in the United States.

We do not sell your personal information, and we do not share it with anyone for their own advertising. The only people outside our providers who see anything about you are the households that receive the card, which shows your ad and business name as you approved it.

Growing Savino Marketing in public is part of what we do, so we may share finished ads and anonymized or aggregated examples as portfolio and promotional material. We will ask for your permission before publishing anything that personally identifies you or your private conversation with the AI Ad Builder. Tell us at any time if you'd prefer your work not be featured.

We keep order records, contact details, account details, your Ad Builder conversation, draft renders, and finished artwork for as long as needed to provide the service and to meet business, tax, and legal obligations. We do not currently delete this information on a fixed schedule. If you start a reservation and do not check out, the details you typed stay with that slot until it is reserved again or we clear them. You can ask us to delete information we are not required to keep (see section 6). A card that has been printed and mailed cannot be recalled, and Stripe keeps its own payment records under its policy.

You can ask us to see, correct, or delete the personal information we hold about you, and you can unsubscribe from marketing email using the link in any message or by emailing us. Send requests to joseph@savinomarketing.com from the email address on your account or order so we can confirm it is you. We answer within 10 business days. Some information we cannot delete: payment records we must keep for tax and accounting, an ad that has already been printed and mailed, and QR scan records, because we cannot tell which scan was yours.

We use reasonable safeguards to protect your information, including encrypted connections and access controls. No method of transmission or storage is perfectly secure, so we can't guarantee absolute security. If we learn of a security incident that affects your personal information, we will investigate it, contain it, and notify you and any authorities as the law requires.

Your Design link. After you order, we email you a private Design link for your ad. The link contains your order number, and anyone who has the link can open your ad, your Builder conversation, and your uploads until you set a password on your advertiser account (from then on, your password is required as well) or until your card's print deadline. Treat it like a password and do not forward it. The same order number is shared with Stripe, with Klaviyo so we can send your order emails, and with our own internal notifications.

Password reset links. When you ask to reset or change your password, we email you a link that lets whoever has it choose a new password for your account. The link works once and stops working one hour after you ask; using it signs out every other device signed in to your account. Treat it like a password and do not forward the email. If you did not ask for it, you can ignore it, and your password stays the same.

Cookies and browser storage. We use only strictly necessary cookies: a session cookie that keeps you signed in to your advertiser account, and an equivalent for our own admin tools. When you reserve a slot, your browser also stores a random reservation ID (not linked to your name) so you keep your hold if you refresh the page; it expires after 30 days, and you can remove it by clearing this site's data. We do not use advertising or cross-site tracking cookies.

Each QR code on The Local Vibe card goes through a short link on localvibepostcard.com before it sends you to the advertiser's website. When you scan, we record the time, the destination, your phone's browser type, and a short one-way code made from the date and your internet address. We use the code to tell repeat scans on the same day from new ones and to block automated abuse. We do not store your address itself, we do not know who you are, and we do not try to link a scan to a person. Advertisers see only totals for their own ad, such as how many scans and when the last one happened, never individual scans. We keep scan records with the edition's records. Once you arrive at the advertiser's website, that site's own privacy policy applies.

Our services are for businesses and adults. You must be 18 or older, and authorized to act for a business, to place an order or open an advertiser account. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, email us and we will delete it.

We may update this policy; the “last updated” date above reflects the current version. See our Terms of Service for the terms that govern our services.