Privacy Policy

This Privacy Policy explains how Nomsta LLC, a Washington limited liability company ("Nomsta", "we", "us"), collects, uses, and shares your personal information when you use the Nomsta platform for discovering pop-up restaurants and food events (the "Service").

1. Information we collect

Information you give us

• Account and profile details - your name, email, username, and avatar, managed through our authentication provider, Clerk.
• Location preferences you set, such as your city and postal code.
• Vendor details - your brand, listings, and the pop-ups and events you publish.
• Messages you send us, including submissions through our contact form.

Information we collect automatically

• Approximate location derived from your IP address, used to show relevant nearby events.
• Usage and device information generated as you interact with the Service.

Information from third parties

• Authentication data from Clerk when you sign in, including through Google or Apple.
• Payment and subscription status from Stripe when you are a paying vendor. We do not store full card numbers; Stripe processes payments directly.

2. How we use your information

• To operate, maintain, and improve the Service.
• To create and manage your account and authenticate you.
• To show you relevant brands, events, and locations.
• To process vendor subscriptions and payments.
• To respond to your messages and provide support.
• To send service-related communications and, where you have a choice, notifications you opt into. You can change your email preferences or unsubscribe at any time from your notification settings or the link in the email, and we honor opt-outs promptly.
• To keep the Service secure and to comply with our legal obligations.

3. Who we share it with

We do not sell your personal information. We share it with service providers who help us run the Service, under contracts that limit how they may use it:

• Clerk - authentication and account management.
• Stripe - payment processing and subscription billing.
• Resend - sending transactional and support email.
• Cloudinary - hosting images you upload.
• Google Maps and related providers - maps, geocoding, and place lookups. Google collects certain data (including your IP address) when you use these features, as described in the Google Privacy Policy.
• Our cloud hosting provider, which runs our application and database.

We may also disclose information where required by law, to enforce our terms, or to protect the rights, safety, and security of Nomsta and our users.

4. Cookies and similar technologies

We and our providers use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. You can control cookies through your browser settings, though some features may not work without them.

5. How long we keep it

We keep your personal information for as long as your account is active and as needed to provide the Service, then for any additional period required to meet legal, accounting, or reporting obligations. When you delete your account we remove or anonymise your information, though copies may remain in backups for a limited time.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us using the details below - we handle these requests ourselves and will respond as required by applicable law, including Canada's PIPEDA, the GDPR, and US state privacy laws where they apply to you. You also have the right to complain to your local data-protection authority; if you are in Canada, that is the Office of the Privacy Commissioner of Canada.

7. Security

We take reasonable technical and organisational measures to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Children

The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with information, contact us and we will delete it.

9. International data transfers

We are based in the United States, and your personal information is processed and stored there and in other countries where our providers operate. If you use the Service from Canada or elsewhere, this means your information may be subject to the laws of those countries and may be accessible to their courts, law enforcement, and national security authorities. We remain responsible for personal information we transfer to our providers and use contractual safeguards to require a comparable level of protection.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes we will take reasonable steps to let you know, and we will update the date at the top of this page.

11. Contact

Questions about your privacy, or want to exercise your rights? Reach us through our contact page or at [email protected].