Privacy Policy

Most visitors do not need an account, login, or other registration to browse the public directory.

For ordinary public visitors, we may have the following information:

• IP address;
• browser type;
• device type;
• operating system;
• referring page;
• request timestamps; and
• similar standard network and technical log information recorded through Cloudflare.

Cloudflare provides hosting, content delivery, network security, and tunnel services for the website. Technical log information is used for purposes such as security, abuse prevention, troubleshooting, and service performance.

The website also allows a visitor to choose a light or dark theme. That preference is stored in the visitor’s own browser using local storage. The theme preference is not transmitted to us and is not used to identify the visitor.

If a visitor emails us, we receive:

• the visitor’s email address;
• the contents of the message; and
• any information the visitor voluntarily includes.

We do not currently use analytics, advertising systems, cross-site tracking, retargeting pixels, or behavioral advertising technologies on the website.

When someone applies or signs up to become a listed vendor, we collect information submitted through the signup process, including:

• business name;
• city;
• state;
• website, if provided;
• phone number, if provided;
• business contact email address;
• owner’s name;
• owner’s email address;
• password, if the applicant chooses to create one;
• selected subscription plan;
• selected event, where applicable to a single-show plan; and
• IP address used during signup.

Passwords are not stored in readable form. They are stored only as cryptographic hashes.

IP addresses associated with signup may be used for rate limiting, security, and abuse prevention.

Payment information is handled as described separately in Section 3.

For vendors with an account, we may maintain all of the information described in Section 2.2, together with additional account information.

This may include:

• hashed session tokens;
• hashed single-use sign-in link tokens;
• token expiration times;
• an essential HTTP-only session cookie stored in the vendor’s browser;
• last sign-in time;
• email verification time;
• vendor listing content;
• uploaded logos, banners, gallery photographs, menu images, and other listing images;
• an append-only account audit log;
• rate-limiting records associated with email addresses and IP addresses; and
• subscription and payment records described in Section 3.

Single-use sign-in links expire after 15 minutes.

The account audit log records information such as:

• who performed an action;
• what was changed; and
• before-and-after values associated with the change.

The audit log is append-only. Existing audit records are not updated or deleted.

Vendor-uploaded images are stored and served using Cloudflare Images.

Public listing information should not be confused with private account information.

Information such as the following is not intentionally published as part of a vendor’s public listing:

• owner’s private account email information;
• authentication credentials and tokens;
• session information;
• internal account activity records; and
• internal payment and subscription records.

Technical information may be used to:

• deliver the website;
• protect the website and infrastructure;
• detect or limit abuse;
• enforce rate limits;
• troubleshoot errors;
• maintain network security; and
• support website performance.

Vendor application information may be used to:

• create a vendor record;
• establish an account;
• associate a vendor with the selected subscription plan or event;
• prevent automated or abusive signup activity;
• communicate in connection with account access; and
• prepare the vendor’s directory listing.

Account information may be used to:

• authenticate vendors;
• send single-use sign-in links;
• maintain account sessions;
• verify email addresses;
• permit vendors to manage their listings;
• record account changes;
• provide security and fraud-prevention controls; and
• maintain records associated with vendor accounts.

The service currently sends account sign-in links. This Policy does not represent that we send newsletters or marketing emails.

Stripe-related information may be used to:

• associate payments with vendor accounts;
• identify subscription status;
• administer vendor plans;
• maintain financial records; and
• satisfy legal, accounting, and tax obligations.

If someone contacts us by email, we may use the information in that communication to review and respond to the request and maintain records associated with the communication.

When a vendor signs in, the service uses an essential HTTP-only session cookie.

This cookie is necessary to maintain an authenticated vendor session. It is not used for advertising or cross-site behavioral tracking.

Vendor sessions expire 14 days after sign-in.

Sessions do not automatically renew. A vendor must sign in again after the session expires.

The website may store a light or dark theme preference using browser local storage.

That preference remains in the visitor’s browser. It is not transmitted to us and is not used to identify the visitor.

Cloudflare may use cookies or similar technologies that are necessary to provide network security, protect the website from abuse, and operate its infrastructure.

We do not currently use analytics cookies, advertising cookies, retargeting cookies, or cross-site behavioral tracking cookies.

Cloudflare analytics capabilities and Google Tag Manager are not currently used for website analytics or tracking.

If we introduce analytics, advertising technology, or a new category of tracking in the future, this Privacy Policy must be updated before that technology is enabled as described in Section 14.

Stripe provides:

• hosted checkout;
• payment processing;
• subscription processing; and
• the hosted billing portal used to manage or cancel subscriptions.

Stripe receives payment information directly and handles that information under its own privacy policy and practices.

Cloudflare provides services including:

• hosting and infrastructure support;
• content delivery;
• network security;
• the tunnel used to serve the website;
• Cloudflare Images for storage and delivery of vendor-uploaded images; and
• Cloudflare Email Routing for the contact email address.

Cloudflare may process technical network information as necessary to provide those services.

Google services are used for email delivery.

Outbound account-related emails, including sign-in links, are sent using Gmail’s SMTP service.

Inbound messages sent to our contact address are routed to and stored in a Google mailbox.

Public vendor listings may contain links to vendor websites, social media accounts, or other external services.

Those websites and services are operated independently. Their collection and use of information are governed by their own privacy policies and practices, not this Privacy Policy.

Single-use sign-in link tokens expire after 15 minutes.

They are designed for one-time use.

Authenticated vendor sessions expire 14 days after sign-in.

Sessions do not automatically renew.

Rate-limiting information is short-lived and maintained in hourly windows.

Technical logs maintained by Cloudflare or other infrastructure providers are retained according to those providers’ standard practices and any applicable account configuration.

Vendor account and listing information is generally retained while the account exists.

Some information may continue to be retained after an account is closed or deleted when necessary for legal, tax, accounting, fraud-prevention, security, or similar legitimate recordkeeping purposes.

The vendor account audit log is append-only and is not deleted.

A request to delete a vendor account may remove or de-identify applicable profile information and account details, but a tamper-evident record of account activity may remain for security, fraud-prevention, record integrity, and legal-compliance purposes.

We therefore do not promise complete erasure of every historical record associated with an account.

Deleting an uploaded image does not necessarily result in immediate removal of every copy.

An image is removed from underlying storage only when no other part of the listing continues to reference the same file.

Cloudflare or other content-delivery infrastructure may also temporarily retain cached copies after the underlying image has been removed.

Copies previously saved or cached by search engines or unrelated third parties are outside our control.

Vendors can access their accounts using single-use links delivered to their email address.

This means that a person who gains unauthorized access to a vendor’s email inbox may also be able to gain access to the vendor’s Florida First Premium Vendors account.

Vendors are responsible for taking reasonable steps to secure their email accounts, including the credentials and security controls provided by their email provider.

You may ask us to provide information about personal information associated with you or your account.

You may ask us to correct inaccurate personal information.

Vendors can also view and correct most of their own account and listing information directly through their vendor account at any time.

This self-service ability is generally the fastest way to update vendor information.

You may request deletion of applicable personal information.

Deletion is subject to the limitations described in this Policy.

In particular:

• the append-only audit log is retained;
• payment, subscription, tax, accounting, security, fraud-prevention, and legally required records may be retained;
• cached copies of images may temporarily remain;
• public information previously copied or indexed by unrelated third parties may remain outside our control; and
• an image may remain if another part of the vendor listing still references the same underlying file.

We will not discriminate against a person because they submitted a privacy request or exercised a privacy right described in this Policy.

We may take reasonable steps to verify that a person making a privacy request is the person to whom the requested information relates or is otherwise authorized to act on that person’s behalf.

Privacy requests may be sent using the contact information in Section 15.