LaPai Management Solutions & Consulting LLC

LaPai Management Solutions & Consulting LLC (“LaPai,” “we,” “our,” or “us”) operates a small-business directory serving businesses and customers across the United States (the “Platform”). This Privacy Policy explains exactly what information we collect, what we do not collect, who processes it on our behalf, and the choices and rights you have over it. We have written it to describe what our software actually does rather than what a privacy policy usually says.

1. Who This Policy Covers

This policy applies to everyone who uses the Platform, and different information is collected depending on which of these you are:

Visitors — anyone browsing the directory, whether or not they have an account
Business owners — people who register a business and hold a paid listing
Document buyers — people who purchase a document from our store
Customers of a listed business — people who request a booking, consultation or estimate, or who submit a “get connected” application

LaPai is a United States business and the Platform is operated from and for the United States. Our hosting, database and authentication infrastructure are US-based, and information you give us is stored and processed in the United States.

2. Information We Collect

From every visitor — analytics

A visitor identifier. A randomly generated ID stored in your browser’s local storage under the key lapai_visitor_id. It persists across sessions so we can tell whether a visit is from a returning browser or a new one. It is generated by your browser, contains nothing about you, and is not linked to your name or email.
A session identifier. A second randomly generated ID stored in your browser’s session storage under the key lapai_session_id. It is cleared when you close the tab, so it groups the pages you viewed in a single sitting.
Page views and listing interactions. On each page you open, we record those two identifiers, the page path and the referring URL your browser reports. For public Elite listings, we also record the listing ID, the time, and whether you viewed it or clicked a phone, email, website, social or booking link. We do not record the contents of calls, messages or forms in analytics. Listing owners can see aggregate counts and daily trends for their own listing, never visitor identifiers. Their own visits and administrator visits are excluded from listing analytics.

What is not in that record

We do not store your IP address, your device fingerprint, your precise location, or your name or email in our analytics. Pages under /admin are excluded from analytics entirely. Your IP address is necessarily visible to our hosting and database providers as a technical requirement of delivering any web page to you; how they handle it is governed by their own privacy policies, linked in Section 6.

From business owners

Account details — your name and email address. Your password is handled by our authentication provider and stored only as a cryptographic hash; we never see or store it in plain text. Sign-in is by email and password only — there is no social login, so we never receive information from Google, Facebook or any other identity provider about you.
Listing details — your business name, category, state, description, business email address, phone number, website URL and social media links.
Images — a business logo and up to three gallery photographs, which you upload and which are published on your listing.
Subscription details — your plan tier and the customer and subscription identifiers issued to us by our payment processor. These identifiers let us tell whether your plan is active; they are references to records held by the processor, not payment details.
Google Calendar connection (Elite plan only, and only if you choose it) — if you connect your calendar so clients can book you directly, we store the authorisation token Google issues, the calendar you selected, and the email address of the Google account you connected. That token is held in a table that only our server can read; it is not reachable from any browser, including your own. You can disconnect at any time from your dashboard, which deletes the stored connection.

From document buyers

To sell you a document we collect your email address, and nothing else. You enter it before checkout so we know where to send your download link, and it is recorded against the purchase along with which document you bought. You do not need an account to buy a document.

From customers contacting a listed business

Booking, consultation and estimate requests — the service you are asking about, your name, email address, phone number, your own company name if you give one, your preferred date and time, and any notes you add.
“Get connected” applications — your name, email address, phone number, state, the service you need, your budget range, your timeline, and any details you add.
Where a booking goes. A request for a Standard or Premium listing is stored for us to pass on to the business. If the business holds an Elite plan and has connected their calendar, your request is also written into that business’s own Google Calendar as an event containing your name, email address, phone number, company name and notes, and you are added to the event as an attendee so the confirmation reaches you.

Reviews

If you are signed in you may leave one review per business. We store your star rating, your review text, and the account that wrote it. Reviews are published on the business’s public listing page, so treat anything you write there as public.

3. What We Do Not Collect

These are commitments about how the Platform is built, and each one is verifiable by inspecting the site in your own browser:

Your card details never touch this site. Every payment is entered on our payment processor’s own hosted checkout pages, on their domain. Card numbers, expiry dates, security codes and bank details are never transmitted through the Platform and are never written to our database.
No third-party analytics. There is no Google Analytics, no Mixpanel, no Amplitude, no heatmap or session-replay tool. The analytics described above are collected by our own code into our own database and are seen by no one else.
No advertising pixels. There is no Meta pixel, no TikTok pixel, no LinkedIn Insight tag, no ad network code of any kind.
No cross-site tracking. Our identifiers are readable only on this domain and tell us nothing about anywhere else you go on the internet. We do not build advertising profiles and we do not participate in any cross-context behavioural advertising.
We do not sell, rent, trade or share your personal information. Not to advertisers, not to data brokers, not to anyone. We have never done so and we have no mechanism that would do so.
No marketing email and no newsletter. There is no mailing list on the Platform. Email we send you is transactional only, as described in Section 4.

4. How We Use Your Information

To create your account, sign you in, and let you reset your password
To publish your business listing in the directory for as long as your subscription is active, and to take it back out of the directory if the subscription ends
To process subscription payments and document purchases through our payment processor, and to keep your plan in the state you have paid for
To send transactional email only — account verification, password reset, and delivery of a document you purchased
To pass booking, consultation and estimate requests to the business you asked for, and to place confirmed bookings on an Elite business’s connected calendar
To moderate business listings and customer reviews, and to suspend or remove a listing that breaks our rules
To understand how the Platform is used in aggregate — which pages are visited, how many distinct browsers arrive — and to improve it
To respond to questions and support requests you send us
To comply with our legal, tax and accounting obligations, and to detect and prevent fraud and abuse

We do not use your information to make automated decisions that produce legal or similarly significant effects about you, and we do not use it for advertising.

5. Analytics and the Choices You Have

We ask before we record anything. The first time you visit, a notice asks whether you are willing to allow analytics. Until you choose, nothing is stored and no page view is recorded — the two identifiers described in Section 2 are not created at all. Accepting and rejecting are equally easy, and rejecting is not treated as a reason to ask again on every page.

If you accept, the identifiers are created and a page-view record is written on each page you open, everywhere except the administrator area. If you decline, none of that happens, and any identifiers stored in your browser before you declined are deleted.

You can change your mind at any time, in either direction, from the control on our Cookie Policy page. Because the choice is stored in your browser, it applies to that browser only — deciding again on another device, or after clearing this site’s data, is a separate decision.

Your browser’s own controls work too, and are worth knowing about:

Block site data for this domain in your browser settings. Our analytics code is written so that if it cannot read or write browser storage it records nothing at all and the site continues to work normally.
Browse privately. In a private or incognito window the identifiers are discarded when you close it.
Clear the identifiers at any time by clearing site data for this domain. A new visitor identifier is generated on your next visit and cannot be connected to the old one.
Close the tab to end a session. The session identifier is deleted automatically.

We do not currently detect or respond to browser “Do Not Track” headers or Global Privacy Control signals. Because we do not sell or share personal information and run no advertising or cross-site tracking, there is no sale or sharing for such a signal to opt you out of. If you want the page-view records already associated with your visitor identifier deleted, email us and we will do it — see Section 10.

Full detail on each cookie and storage key is in our Cookie Policy.

6. Who Processes Your Information

We do not sell or share your personal information. We do rely on a small number of service providers who process it strictly on our behalf and on our instructions, so that the Platform can function. Each has its own privacy policy:

Supabase — our database, user authentication, and file storage for business images and purchased documents. Your account record, listing, bookings and analytics records live here. supabase.com/privacy
Stripe, Inc. — payment processing for subscriptions and document purchases. You enter your card details directly on Stripe’s hosted checkout; Stripe is the controller of that payment data and returns only a customer and subscription reference to us. stripe.com/privacy
Vercel, Inc. — hosting and delivery of the website itself. Vercel handles the network requests your browser makes to us. vercel.com/legal/privacy-policy
Google LLC — two separate, limited roles. Transactional email is delivered through Google’s Gmail mail servers, so an email we send you passes through Google. Separately, and only for businesses on the Elite plan that choose to connect a calendar, we use the Google Calendar API to create booking events on that business’s own calendar. If you are not an Elite business owner who connected a calendar, and you are not booking with one, no calendar data about you goes to Google. policies.google.com/privacy

Beyond these providers, we disclose information only where the law requires it — in response to a valid subpoena, court order or other lawful request — or where disclosure is necessary to establish or defend a legal claim, to enforce our Terms of Service, or to protect the rights, property or safety of LaPai, our users, or the public. If LaPai is ever involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction, and we will post notice here before your information becomes subject to a different privacy policy.

Some information you provide is published deliberately: a live business listing, including its name, category, state, description, contact details, links and images, is public by design, as are the reviews written about it. That is the purpose of a directory, and it is not a disclosure to a third party in the sense above.

7. Data Retention

We keep information for as long as we need it for the purpose it was collected for, and then for as long as we are legally required to keep it. In practice:

Account and listing information is kept while your account is open and your listing is active, and is deleted when you ask us to delete your account.
Booking, consultation and application records are kept so the business you contacted and we ourselves have a record of the request.
Analytics records are kept in aggregate to measure how the Platform is used over time.
Transaction records are kept for as long as tax, accounting and financial-record obligations require, which is generally longer than the account itself.
Your Google Calendar connection is deleted immediately when you disconnect it or when your account is deleted.

Placeholder — do not publish as-is

[[NEEDS: specific retention periods for account, listing, booking, application, analytics and transaction records. No automatic deletion schedule exists in the codebase today, so no number can be stated truthfully here until one is decided and implemented.]]

8. Security

We take reasonable and appropriate measures to protect your information. All traffic to the Platform is encrypted in transit over HTTPS. Passwords are never stored in plain text — our authentication provider stores only a cryptographic hash. Access to data in our database is restricted by row-level security policies, and the most sensitive tables — the Google Calendar authorisation tokens, incoming applications, and booking records — carry no browser-accessible access policies at all, so they can be reached only by our server and never directly by a browser. Purchased documents are held in a private storage bucket and are delivered through short-lived signed links rather than public URLs. Payment data is handled exclusively on our payment processor’s PCI-compliant infrastructure.

No system is impenetrable, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by applicable law.

9. Children’s Privacy

The Platform is intended for business owners and customers aged 18 or over. It is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal information, contact us at the address in Section 12 and we will delete it promptly.

10. Your Rights and How to Exercise Them

Wherever you live in the United States, you may ask us to:

Know and access the personal information we hold about you, the categories we collected, and who we disclosed it to
Correct anything inaccurate in your account, your listing, or a request you submitted
Delete your account, your listing, and the personal information associated with them, including the analytics records tied to your visitor identifier
Obtain a copy of the information you gave us in a portable form
Object or withdraw consent for any processing that is not necessary to run your account or fulfil a purchase

You can correct most listing information yourself from your dashboard, and an Elite calendar connection can be disconnected there at any time. For anything else, email Lapaisolutions@gmail.com and tell us what you want to do. We will verify your request by corresponding with the email address on the account or the address you used to submit a request or purchase, and we will respond within 45 days, extending once by a further 45 days if the request is complex and telling you if we do. We will not charge you for a request or treat you differently for making one.

Some information must survive a deletion request: records of completed transactions are kept where tax and accounting law requires them, and a published review may be retained in anonymised form so a business’s rating history stays intact. We will tell you if any part of your request is refused, and why.

11. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you specific rights, all of which we honour:

The right to know what personal information we collect, the purposes we collect it for, the categories of sources it comes from, and the categories of third parties we disclose it to. Sections 2, 4 and 6 set all of this out; you may also request the specific pieces of information we hold about you.
The right to delete the personal information we have collected from you, subject to the legal exceptions noted in Section 10.
The right to correct inaccurate personal information we hold about you.
The right to opt out of the sale or sharing of your personal information, and to limit the use of sensitive personal information.
The right to non-discrimination for exercising any of these rights. We do not deny service, change prices, or reduce service quality because you made a request.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. We have not done so in the preceding twelve months, including for consumers we knew to be under 16. Because there is no sale or sharing, we do not offer a “Do Not Sell or Share My Personal Information” link — there would be nothing for it to switch off. We also do not collect sensitive personal information as the CCPA defines it, and we use the information we do collect only for the purposes listed in Section 4.

The categories of personal information we have collected in the past twelve months are identifiers (name, email address, phone number, account identifier, and the randomly generated visitor and session identifiers), commercial information (subscriptions and documents purchased), internet activity (pages viewed on our Platform and the referring page), and, for business owners, professional and business information. We collect these from you directly and, for payment status, from our payment processor.

To exercise any California right, email Lapaisolutions@gmail.com. You may use an authorised agent to submit a request on your behalf; we will ask for proof that you authorised them.

12. Contact Us

For any question about this policy, or to exercise any right described in it, contact us:

LaPai Management Solutions & Consulting LLC

Email: Lapaisolutions@gmail.com

[[NEEDS: mailing address]]

13. Changes to This Policy

We may update this Privacy Policy as the Platform changes or as the law does. When we do, we will post the revised policy on this page and update the “Last updated” date at the top. If a change materially affects how we handle information we have already collected from you — a new category of information, a new purpose, or a new recipient — we will give account holders notice by email before it takes effect. Your continued use of the Platform after a change is posted means you accept the updated policy. We encourage you to check this page periodically.