Privacy

What we collect

• Account details you give us when you sign up (email, and a password handled by our authentication provider).
• Business listing details you submit (name, category, location, contact info, description, hours).
• Activity needed to run the service: leads you send to a business, reviews, claim requests, and upgrade requests.
• Anonymous search activity (search term, filters, city/province, result count, timestamp) to understand demand. We do not attach your name, email, IP, or device ID to search logs.

How we use it

• To show search results and run the directory.
• To deliver leads to the business you contacted, and to help that business get back to you.
• To moderate listings, verify claims, and prevent abuse (e.g. phone-reveal rate limits).
• To produce aggregate insights about demand. These insights never include personal identifiers.

Who can see what

• Public listings: business name, category, location, website, hours, description, and rating are public.
• Phone & WhatsApp numbers are not exposed in bulk. They are revealed one business at a time through a rate-limited endpoint when a user taps "Show phone".
• Lead contact details (your name, phone, message) are visible only to the business you contacted (paid tier) and to PanoTuli admins for moderation.
• Upgrade payment details (payer phone) are visible only to the requesting user and PanoTuli admins.

Security controls

• Row-level security on every table — each request is checked against the signed-in user.
• Sensitive contact data is gated behind authenticated, rate-limited server functions, never exposed via direct table reads.
• Admin actions are recorded in an internal audit log.
• Passwords and sessions are managed by our authentication provider; PanoTuli never sees your password.

Your choices

You can edit or delete your business listing from your dashboard, or email us to delete your account and associated data. See Trust for how to report a security issue.