Privacy Policy

1. Who is responsible

Hitesh Wagle operates Apna Local at www.apnalocal.co as an individual in Australia. In this policy, "we", "us" and "our" mean that operator. We decide how personal information collected through our directory is used and are your contact for that information. OpenAI, hosting providers and other services have their own responsibilities for the services they supply.

This policy covers browsing, signing in, creating and managing a listing, reporting content, contacting us and following our support links. It describes our handling practices and the choices we offer. We comply with privacy obligations that apply to our activities. Statutory privacy rights depend on the law and the circumstances; this policy does not claim an exemption or waive those rights.

Send a privacy enquiry or complaint to Hitesh Wagle through the contact form, with "Privacy request" in the subject. You do not need an account or a public business listing to contact us. If the form is unavailable, our linked Instagram account can be used to request a contact method; do not send sensitive records through social media.

2. Information we collect

Business information can be personal information, particularly for a sole trader or home-based business. Supply business registration identifiers only in the optional tax field, never a personal tax identifier. We do not ask you to disclose your ethnicity or religion to use the directory. Language and business-category fields are optional or business-related; they should not be used to reveal sensitive information about an individual. Do not submit patient or customer records, identity documents, passwords, full card details or other unnecessary sensitive information.

3. How collection happens and your choices

We collect information directly from your forms, uploads, searches and interactions; from the sign-in identity supplied by OpenAI; and from listing reports, support correspondence or lawful public sources where reasonably necessary to check a listing or investigate a concern. Where practicable, we will tell you about material collection from another source. We do not require you to connect your email inbox, contacts or other ChatGPT apps to browse or list a business.

You can browse the public directory without signing in. Signing in is needed for owner functions and signed-in reports. If you do not provide required listing details, we cannot process the listing. Optional fields can be left blank. Providing only a business address you are willing to publish is important; contact us before listing if publication could create a safety risk.

Our current site does not request your device's live GPS location. Address lookup uses the business-address text you enter, and you can instead enter the address and position a map pin manually. Your choice to publish a pin makes that business location public.

4. Why we use information

• Authenticate users, recognise listing ownership and operate the directory, search, categories, catalogues, images, hours and maps.
• Review submissions, investigate duplicates, impersonation, inaccurate information, rights complaints and other misuse, and maintain moderation and acceptance records.
• Manage accounts and business contacts, including synchronising account and business fields to Systeme.io and sending a personalised signup welcome through Pabbly Connect and Gmail.
• Answer enquiries, provide relevant service or security communications, and handle contributions or payment questions.
• Diagnose errors, apply rate limits, maintain security, improve the service, comply with lawful requests and establish, exercise or defend legal rights.

We do not sell or rent personal information or supply directory contact lists for unrelated third-party marketing. Information published in a public listing is nevertheless visible to others. This policy is notice of our practices, not blanket consent to an unrelated new use. We will seek further consent or provide further notice where required.

5. What becomes public

Approved listings publish the business details, address and selected coordinates, phone, website, country, social profile links, description, categories, languages, hours, catalogue and images you submit, together with listing identifiers, review status and dates. These can be viewed without an account, indexed by search engines, copied or shared by other people and accessed from outside Australia.

Your sign-in email, site-specific owner ID, business duplicate-check key, moderation notes, reports, contact messages and tax information are not exposed by the public directory response. They remain available to you or the administrator as appropriate, and some account and business fields are shared with Systeme.io as explained below. Tax information is excluded from new contact-sync updates; an ABN previously synced under an earlier version may remain in existing provider records until removed. "Not public" does not mean data is never processed by our service providers.

Pending, rejected and suspended listings and their hosted photos are restricted to the owner and administrator in the app. An administrator can review submitted material. Publication permissions do not extend to private information about customers, staff, children or other people without the authority required by law.

6. Service providers and other disclosures

We use the providers below for the stated functions. We share information reasonably necessary for those functions; we do not send every provider your complete account or listing.

We may also disclose necessary information to professional advisers, authorities or courts for a legal obligation, a lawful investigation, safety, or a legal claim, or to another person with your authority. Where a complaint concerns a listing, we may disclose its substance to the owner to obtain a response, minimising unnecessary identity disclosure and considering safety risks. A significant change of operator or a new use of information would require an appropriate notice and any consent required by law; this policy is not an unrestricted permission to sell account data.

7. Overseas handling

This service is not restricted to Australian data centres. Personal information may be processed, stored or accessed overseas through the providers above and their subprocessors. Known overseas locations relevant to our providers include the United States and Ireland (OpenAI and other cloud/payment services), Ireland (Systeme.io, whose published policy identifies AWS storage there), Germany (Komoot), Hungary (OpenFreeMap's operator), the United Kingdom (the OpenStreetMap Foundation), and India (also identified by Stripe for international processing). A provider's location does not mean all of its servers or processing are confined to that country.

Cloudflare, Google, Stripe, OpenAI, Pabbly Connect and map delivery networks operate internationally; particular routing and support locations may change. Their linked policies provide further details. We cannot currently specify every network or subprocessor country, and do not promise Australia-only storage. Contact us if the countries or safeguards matter to your decision to use the service.

Users may have additional rights under applicable laws in their country, including access, correction, deletion or objection rights. Contact us to exercise these rights; we will assess the request under the law that applies. Where Australian cross-border disclosure obligations apply, we must take the reasonable steps and meet the responsibilities required by those laws. We do not rely on you reading this policy as a waiver of those responsibilities or an agreement to give up legal protections.

8. Cookies, external resources and searches

Sign-in and hosting services may use cookies or similar technologies for sessions, security and service operation. You can manage cookies through your browser, although blocking them may prevent sign-in or other functions. The app currently does not include advertising pixels or an optional analytics tracker, and it does not save a personal search-history profile in its application database. Search terms may still appear in operational requests or provider logs.

External fonts load when a page is displayed. Map services load when a map is displayed, and address suggestions start after the configured input threshold and pause. External links, including business websites, Instagram, directions and Stripe, have their own privacy practices. We do not control their collection after you choose to visit them.

9. Service messages and marketing choices

A new account can receive a personalised welcome email through Pabbly Connect and Gmail. This introduces the directory and explains how to get started. It does not enrol you in an ongoing email campaign. Creating a Systeme.io contact or assigning the Apna Local user tag is for contact administration; it is not, by itself, consent to unrelated advertising. The app does not automatically enrol you in a marketing campaign. Any commercial electronic messages we authorise must have the consent, sender identification and unsubscribe facility required by applicable law.

You can use an unsubscribe option in a marketing message or contact us to withdraw marketing consent. We will honour a marketing unsubscribe request within five working days where the Spam Act applies. No payment or sign-in is required to unsubscribe. Necessary non-promotional security, account or enquiry responses may still be sent. An unsubscribe preference is different from a request to delete an account or contact record.

10. Security and data breaches

Our application uses server-side ownership and administrator checks, restricted access to unpublished images and reports, HTTPS on the public site, and server-held integration credentials. Images are cropped and recompressed before upload; the app stores the processed image rather than the original upload. These measures reduce risk but do not guarantee that information or systems can never be compromised.

Protect your OpenAI account and devices, and report suspected unauthorised access promptly. We do not ask for your ChatGPT password. If a security incident occurs, we will assess and respond to it and make any notifications to affected people or authorities required by applicable law, including the Notifiable Data Breaches scheme where it applies.

11. Retention and deletion

Listing records are retained while needed to provide the listing. Deleting your listing removes it from the public directory and triggers removal of its hosted photos. Account/contact and welcome-email delivery records, consent and moderation history, reports and support messages are separate and may remain for account administration, resolving complaints, preventing abuse, legal requirements or a legal claim. They do not all disappear when you sign out or remove a business.

The current app does not automatically expire account, contact-message, audit or CRM records after a fixed number of days. You may request a retention or deletion review at any time. We will delete or de-identify information when it is no longer reasonably needed, subject to lawful retention requirements and proportionate evidence or security needs.

Address-lookup cache entries are reused for up to 30 days and older entries are eligible for cleanup during later lookups; this is not a promise that every copy is erased on day 30. Provider logs and backups have separate retention arrangements. Backup copies may remain until their normal expiry and should not be restored to routine use after an effective deletion except where necessary and lawful.

Deleting a listing updates its mapped business fields in Systeme.io through the sync process; it does not automatically delete the Systeme.io contact. Signing out does not delete your OpenAI account. We can review deletion of records under our control and communicate requests to our providers where appropriate; independent search engines, people who copied a public listing and providers acting for their own purposes may require separate requests.

12. Access, correction and removal requests

Use our contact form to ask what personal information we hold about you, request access or a correction, seek deletion or de-identification, or discuss a restriction on use or disclosure. Include enough information to locate the record and explain your request. We may make proportionate identity checks to protect you and others; do not send identity documents unless we arrange a suitable method and they are necessary.

You can correct or delete your own listing through the owner tools. Edits go back to moderation. For an impersonated listing, a safety concern or information posted without authority, contact us even if you are not the signed-in owner; we can assess moderation or privacy action without giving you another person's account access.

We aim to respond to access and correction requests within 30 days, and will comply with any different legal deadline that applies. If we cannot fulfil a request, we will explain the lawful reason and complaint options where required. We do not charge you to make a request or correct information. Any lawful reasonable access-processing charge would be explained in advance. Other rights under applicable privacy law are not limited by this process.

13. Children and sensitive information

Our business-listing functions are intended for adults aged 18 or older. We do not ask for a date of birth and do not claim that sign-in independently verifies age. A person submitting a listing must confirm they are an adult. Minors should use a parent or guardian's guidance when browsing.

Do not publish a child's contact details, private home information or identifiable images without the authority required by law. Do not upload protected health information, patient records or sensitive customer information. If you believe a child or another person's private information has been submitted inappropriately, contact us so we can assess removal and any further action.

14. Privacy complaints and changes

Address a privacy complaint to Hitesh Wagle using the contact form and explain what happened, the relevant records and the outcome you want. We aim to acknowledge it within two business days and respond substantively within 30 days, with an update if more time is reasonably needed. Urgent safety concerns will be considered promptly.

If you are not satisfied with our response, or we have not responded within a reasonable period, you can contact the Office of the Australian Information Commissioner where it has jurisdiction, or another appropriate regulator or court. OAIC ordinarily expects you to complain to the organisation first and allow about 30 days for a response. These options do not prevent urgent action or other legal rights.

We will update this page and its date when our practices change. For a material new collection, use or disclosure, we will provide appropriate notice and seek any consent required by law. A policy update does not retrospectively authorise a different use of information or remove an existing right.