Privacy policy
This policy explains what Local Chinese Foods (“we”, “us”) collects when you use the site, why, how long we keep it and what you can ask us to do with it. It applies to every visitor, in the United States or elsewhere. Short version: we collect very little, we never sell personal data, and most pages work without any account or cookie at all.
Effective 16 September 2026.
1. Information we collect
1.1 Information you give us
You can read the whole directory without telling us who you are. We collect personal data only when you:
- Create an account: e-mail address, display name and a salted password hash (never the password itself), plus a two-factor secret if you enable it;
- Add or claim a business: your name, work e-mail, phone number, your message and any documents you send us for verification;
- Contact us or report content: whatever you put in the message.
1.2 Information collected automatically
- Server logs: IP address, user agent, requested page and time, kept for security and for a short period (section 3);
- Outbound clicks: we count clicks on business website links per listing; the count is not linked to you;
- Quick-search questions: what people type into the search box or the assistant is stored as text with a counter, without any IP or identifier, to improve the parser;
- Approximate location: when the assistant suggests places near you, it uses the country and city hint our CDN attaches to the request, or coordinates you explicitly share by tapping “Use my location”. Neither is stored.
1.3 Business listings
Listings contain business contact details that are already public: name, address, phone, website, opening hours, Google rating and the latest public reviews as shown on Google Maps. Where a sole trader’s name is the business name, that name is part of the listing. To correct or remove a listing, use the notice and takedown process.
2. How we use information
- To run the site and keep it secure (logs, rate limiting, abuse prevention);
- To operate your account, claims and listings and to e-mail you about them;
- To verify that a claimant represents a business (claim verification policy);
- To answer messages and reports;
- To improve search and the assistant, using aggregated queries;
- To show advertising (section 7) and to meet legal obligations.
We do not send marketing e-mail. Transactional e-mails (claim decisions, password resets) are the only messages you receive.
Legal bases. Where the law asks for one, we rely on: performance of a contract or of steps you asked for (accounts, claims); our legitimate interest in running a secure, accurate directory; your consent, where you gave it (location sharing, personalised advertising); and compliance with legal obligations. For US users this policy also serves as our notice under the California Consumer Privacy Act (CCPA/CPRA) and the comparable laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states, which give you the rights listed in section 6; we do not sell or share personal data for cross-context behavioural advertising, and we honour Global Privacy Control signals. For users in the EEA, the UK and Switzerland it reflects the GDPR and its UK equivalent.
3. Retention
- Server logs: 30 days;
- Verification documents: deleted within 30 days of the claim decision;
- Account data: until you delete the account, then removed within 30 days except records we must keep by law;
- Listing edits and claim records: for as long as the listing exists, so we can show who changed what;
- Aggregated statistics and query counters: indefinitely, because they identify nobody.
4. Sharing and disclosure
We do not sell personal data and we do not share it with third parties for their own marketing. We share only with:
- Infrastructure providers: our hosting provider and our CDN and security provider (Cloudflare), which see the traffic needed to deliver the site;
- Advertising partners such as Google AdSense, which set their own cookies as described in section 7;
- Google, whose image servers deliver listing photos directly to your browser (we send no referrer, and we do not send them who you are);
- Authorities, when required by law or a valid legal process, or to protect the safety of a person;
- A successor, if the site changes hands, under this same policy.
5. International transfers
The site is hosted in a data centre in the United States and served through a global CDN, so data may be processed outside the country you live in, including in countries whose laws differ from yours. We choose providers that commit to appropriate contractual and technical safeguards, and we limit what leaves our servers to what is needed to run the site.
6. Your rights and choices
Whatever your country, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct it;
- delete it, or delete your account (you can also do this from your account page);
- restrict or object to a particular use, including to any processing based on legitimate interest;
- withdraw consent you gave earlier;
- receive the data you provided in a portable format;
- appeal a decision we made on a privacy request;
To exercise a right, email us from the e-mail address on the account, or with enough detail for us to find your data. We reply within 30 days, sooner where the law requires. We may ask you to confirm your identity and may decline requests that are manifestly unfounded or repetitive. California residents may also contact the California Privacy Protection Agency; residents of the EEA and UK may complain to their supervisory authority.
Children. The site is not directed at children under 16 and we do not knowingly collect their data. If you believe a child gave us personal data, tell us and we will delete it.
7. Cookies and similar technologies
We set very few cookies of our own and no cookie banner is needed for them because they are strictly necessary or store a choice you made:
| lcf_session | Keeps you logged in. Set only when you sign in; deleted when you log out or after 30 days. |
|---|---|
| Browser storage | The quick-search assistant keeps its open/closed state in your browser only. Nothing is sent to us. |
Advertising cookies. Where advertising is shown, Google AdSense and its partners may set cookies to show and measure ads, including personalised ads where you have consented in your Google settings. We do not control those cookies. You can opt out of personalised advertising at adssettings.google.com, and browsers let you block or delete cookies; the directory keeps working without them, you may simply see non-personalised ads.
No analytics trackers. We do not use third-party analytics scripts. Our traffic figures come from our own server logs, aggregated.
8. Security
Passwords are stored as salted hashes, accounts can be protected with two-factor authentication, admin sessions require it, the site is served over HTTPS only, and requests are rate-limited. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and, where required, the authorities.
9. Changes to this policy
We may update this policy as the site changes. The effective date at the top tells you when. Material changes are announced on the site, and by e-mail to account holders where the law requires it.
10. Contact
Privacy questions or requests: email us. Some links on this site are affiliate or sponsored links. If you book or buy through them we may earn a commission at no extra cost to you.