Privacy Policy

This Privacy Policy explains how Lanai Group LLC dba Hot Sauce Headquarters ("Hot Sauce HQ," "we," "us") collects, uses, shares and protects personal information when you use HotSauceHeadquarters.com, the Hot Sauce HQ apps and related services (the "Service"), and the choices you have.

The short version

• We collect what you give us (profile, ratings, shelf, lists) and usage data, as explained in our Cookie Policy.
• We do not sell your personal information for money. Where the law treats some advertising cookies as a "sale" or "sharing," you can opt out.
• Everyone sees a cookie banner, and rejecting is as easy as accepting. In the EU and UK, analytics and advertising stay off until you agree. Elsewhere they are on until you choose Reject all, turn off Personalized ads, turn on Do not sell or share, or your browser sends Global Privacy Control.
• You can download your data or delete your account at any time in Settings → Privacy & data.

1. Who we are

Lanai Group LLC dba Hot Sauce Headquarters, Attn: Mike Smith, 732 S 6th St, Ste R, Las Vegas, NV 89101, USA. Contact for all privacy matters: stayspicy@hotsauceheadquarters.com. We are the controller of the personal information described here.

2. Information we collect

2.1 You give us

Category	Examples	Required?
Account	Name or display name, email, password (stored hashed), country, postal code, confirmation that you are 18+	Yes
Sign-in	Google, Apple or Facebook account identifier and the email they share (including Apple private-relay addresses)	If you use them
Profile	Photo, bio, city display choice, birthday month and day	Optional
Content	Ratings, reviews, comments, replies, Community posts, tasting-party scores and notes, shelf and purchase entries (store, price, currency, date), lists, tags, homemade recipes, photos, sauce and barcode submissions	Optional
Messages	Messages with friends and brands	Optional
Brand accounts	Business email, phone, physical and mailing address, website and social links, your name, role, login email and phone, verification records	Yes for brand accounts
Support and reports	What you send us, reports you file, DMCA notices	When you contact us

2.2 Collected automatically

• Device and log data: IP address, device and browser type, app version, operating system, crash data, pages viewed, times and referring pages.
• Approximate location: derived from your postal code and IP address. We do not collect precise GPS location.
• Cookies and SDKs: see the Cookie Policy. Analytics and advertising technologies run only after you consent where the law requires consent.

2.3 From others

• Payment providers (Stripe, Apple, Google): confirmation of purchases, subscription status, renewal and cancellation. We never receive or store your full card number.
• Sign-in providers (Google, Apple, Facebook): the basic profile details you allow them to share.
• Other members: for example, when a friend invites you to a tasting party or tags a sauce you rated.

We do not knowingly collect sensitive personal information such as health, financial account, government ID, racial or ethnic origin, or precise geolocation data.

3. How we use information

1. Provide the Service: accounts, ratings, shelves, lists, recipes, messages, tasting parties, Community, awards and Hall of Flame.
2. Process payments and manage subscriptions, including renewal notices and price-change notices.
3. Show averages, rankings and statistics, including private ratings in anonymous averages.
4. Give brands aggregated, de-identified insights (see Section 5).
5. Send the notifications and emails you choose, and required account, security and billing emails.
6. Keep the Service safe: prevent spam, fraud and abuse, verify brand representatives, moderate content and enforce our Terms.
7. Understand and improve the Service using analytics, where you consent.
8. Show ads to Free members, personalized as described in Section 5.
9. Comply with law and protect our rights and those of others.

4. Legal bases (EEA, UK and Switzerland)

Where EU or UK data protection law applies, we rely on: contract (to provide the Service you ask for); legitimate interests (safety, fraud prevention, improving the Service, aggregated brand insights), balanced against your rights; consent (analytics, personalized advertising, optional emails), which you can withdraw at any time; and legal obligation (tax, accounting, responding to lawful requests).

5. How we share information

We do not sell your personal information for money. We share it only as follows:

• Publicly, by your choice. Your display name, photo, public ratings and reviews, public lists, and other content you make public. Private and selected-people items are shown only as you choose.
• With brands, in aggregate only. Brands see rolled-up statistics such as average scores, trends and approximate locations. A location is shown only when at least 3 members are in that area; otherwise it is combined into the next larger area. Brands never receive your name or contact details from us. Tasting-party notes are shared with a brand only if you tick "share anonymously with the brand." Brands can see and reply to public reviews.
• Service providers that process data for us under contract, including: Supabase (database, authentication, file functions), Cloudflare (hosting, storage, security and bot protection, including Turnstile), Google (Firebase Analytics, Android push delivery, Google Analytics, AdMob and AdSense), Expo (push notification delivery), Meta (Facebook Login), Sentry (error and crash reporting), Stripe (web payments), Apple and Google (app store purchases), and Resend (email delivery).
• Advertising partners. On pages and in apps showing Google ads, Google may collect information through cookies and SDKs. In the EU and UK, ads are personalized only with your consent. Elsewhere, ads may be personalized unless you choose Reject all, turn off Personalized ads, turn on Do not sell or share, decline tracking in Apple's prompt, or your browser sends Global Privacy Control. Otherwise ads are non-personalized.
• Legal and safety. When required by law, subpoena or court order, or when we believe disclosure is needed to protect anyone's safety, prevent fraud, or enforce our Terms, including reporting fraud or illegal activity to authorities.
• Business transfers. In a merger, acquisition, financing or sale of assets, with the new owner bound by this policy.
• With your consent in any other case.

6. Your choices

• Privacy settings: public profile, city display, who can message you, whether your name appears in shared tasting-party results, and private ratings.
• Cookies and ads: Cookie settings on the web and the ad-consent form in the apps; "Do not sell or share my personal information" in Settings.
• Global Privacy Control: we treat a GPC signal from your browser as a request to opt out of sale and sharing for that browser.
• Notifications: push, email, weekly digest, hidden message text and quiet hours (default 10 PM to 6 AM, your time).
• Marketing emails: unsubscribe using the link in any marketing email.

7. Your rights

Depending on where you live (for example California and other U.S. states with privacy laws, Nevada, the EEA, the UK, Switzerland or Canada), you may have the right to:

1. Know and access the personal information we hold and receive a copy.
2. Download (portability): Settings → Privacy & data → Download my data. We email a ZIP file (JSON and CSV) within 48 hours; the link works for 7 days. You can request one export every 7 days.
3. Correct inaccurate information, in your settings or by contacting us.
4. Delete: Settings → Privacy & data → Delete account (see Section 9).
5. Opt out of sale, sharing and targeted advertising.
6. Object to or restrict certain processing, and withdraw consent at any time.
7. Appeal a decision we make about your request by replying to our response with "Appeal" in the subject. If you are not satisfied, you may contact your state attorney general or data protection authority.
8. Complain to your local data protection authority (EEA, UK, Switzerland).

We respond within the time the law requires (generally 30 to 45 days). We may need to verify your identity, usually by confirming your account email. You can use an authorized agent where the law allows; we may ask for proof of their authority. We will not discriminate against you for exercising your rights. Nevada residents may submit a request not to sell covered information to stayspicy@hotsauceheadquarters.com.

8. How long we keep information

Information	How long
Account and profile	Until you delete your account
Content you submit	Kept after deletion in anonymized form (Section 9)
Messages, lists, tags, homemade recipes	Until you delete them or your account
Purchase history on Free plan	Hidden after 1 year of history is exceeded and deleted as described in the Subscription & Payment Policy
Billing and tax records	As long as tax and accounting law requires (typically 7 years)
Brand verification records	Until 90 days after a decision, unless needed for a dispute
Security logs	Up to 2 years
Backups	Rotated out on a fixed schedule; the oldest backup copy is about 5 months old

9. Deleting your account (anonymization)

When you choose Delete account, we remove the information that identifies you: name, photo, bio, email, birthday, sign-in methods, messages, friends, lists, tags, homemade recipes and Hall of Flame progress. Ratings, reviews, comments, replies, Community posts, tasting scores and notes and shelf entries you submitted stay on the Service with your name replaced by "Deleted account," because you granted us rights to that content under the Terms. We keep your postal code only in a form not linked to you, for area statistics. Records we must keep by law (such as billing records) are kept separately and only for the required period. Deleted information may remain in backups until those backups rotate out. If you wrote personal information about yourself inside a review or comment, contact us and we will remove it.

10. Security

We use encryption in transit, hashed passwords, access controls, two-step verification for staff administrative access, bot protection and regular backups stored separately from our main database. No system is perfectly secure; please use a strong, unique password.

11. Children

Accounts are only for people 18 and older, and the Service is not directed to children. We do not knowingly collect personal information from anyone under 18 for an account. If you believe a minor has created an account, contact us and we will delete it.

12. International transfers

We are based in the United States, and your information is processed in the United States and other countries where our service providers operate. Where required, we rely on appropriate safeguards such as the European Commission's standard contractual clauses offered by our providers.

13. Changes

We will post any update here with a new effective date, and notify you by email or in the app before material changes take effect.

14. Contact

stayspicy@hotsauceheadquarters.com · Lanai Group LLC dba Hot Sauce Headquarters, Attn: Mike Smith, 732 S 6th St, Ste R, Las Vegas, NV 89101