1. Scope
SubsTX is an independently maintained directory project at substx.com. This Privacy Policy applies to the directory, accounts at app.substx.com, forms and email services at api.substx.com, and communications sent directly to the project. Listed businesses and third-party websites, including linked Google Maps profiles, have their own privacy practices. Our use of hosting, security, analytics, and email providers is described below.
2. Information we may receive
- Messages and submissions: your name, email address, phone number, company details, service areas, and anything else you choose to send.
- Suggested corrections: the company page you report, your message, an optional contact email, and the review record. These suggestions are available to SubsTX administrators; the contact email is not displayed on the company page.
- Accounts: your email address, sign-in and session records, company-management requests, drafts, submitted versions and moderation decisions. Account email addresses are not included on public directory cards. A business phone or description you submit may be published after review.
- Technical records: hosting and security systems may record an IP address, browser and device details, requested pages, timestamps, and referring pages.
- Usage and performance metrics: Cloudflare Web Analytics measures page visits and loading performance. Its reports can include page paths, referring sites, country, browser, operating system, and device type.
- Preference storage: an earlier analytics choice may remain in browser local storage. The site no longer asks for or saves a new choice, and that old value does not control Cloudflare Web Analytics. You can remove it on the Cookies and Analytics page.
- Public business information: directory records may include company names, public phone numbers, service descriptions, and geographic coverage gathered from public sources or supplied by a business.
3. How information is used
We may use information to operate and secure the site, answer messages, review listing submissions, correct directory records, understand site performance, prevent misuse, and comply with legal obligations.
We use Cloudflare to deliver and protect the site and Cloudflare Web Analytics to understand visits and page performance. According to Cloudflare's description of Web Analytics, that analytics service does not use cookies, local storage, or fingerprinting to measure visits. It can load when you visit a page, independently of any earlier saved analytics choice.
See Cookies and Analytics for browser-storage controls and information about cookies that Cloudflare security features may use. We will update these notices and any necessary controls if our analytics practices change.
The account service uses Cloudflare Workers and D1 to store account and submission records, Cloudflare Turnstile to check sign-in and contact-form requests, and Cloudflare Email Sending to deliver sign-in codes and submission updates. We keep a protected check value for each sign-in code. Session cookies allow you to remain signed in.
Turnstile can run in the background without displaying a verification box. Cloudflare describes its handling of information for these security checks in the Turnstile Privacy Addendum.
4. Disclosure and sale
Information may be disclosed to vendors that provide hosting, security, email, or other operational services; when required by law; or when reasonably necessary to protect the site and its users. SubsTX does not currently sell personal information or share it for cross-context behavioral advertising.
5. Retention and security
Information is retained only as long as reasonably needed for the purpose for which it was received, to maintain business records, resolve disputes, or meet legal requirements. Reasonable safeguards are used, but no internet transmission or storage system can be guaranteed completely secure.
Sign-in codes expire after 10 minutes; expired challenge records are cleared after one day by scheduled cleanup. Account sessions expire after 30 days and signing out revokes the current session. Successfully sent application notification records are cleared from the sending queue after 30 days. Drafts, business records and review history remain available for account management and editorial follow-up; contact us to request access, correction or deletion.
6. Your choices and privacy requests
Depending on where you live and whether a particular law applies, you may have rights to request access, correction, deletion, a copy of certain data, or an appeal of a privacy decision. You may also remove an earlier saved choice on the Cookies and Analytics page. Removing browser storage does not delete messages or directory records held by SubsTX.
Send requests to contact@
If we decline a request, you can ask us to reconsider by replying to the decision email or writing to the same address. Include the original request and why you are appealing. Where applicable law provides an appeal right, we will handle the appeal under that law.
7. Children
SubsTX is a business directory and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has submitted personal information through the site.
8. Changes and contact
We may revise this policy when the site or its data practices change. The date above identifies the latest published revision. Questions, correction requests, and privacy requests can be sent to contact@