Secret Boston Privacy Policy

Effective date: September 3, 2026

Secret Boston, LLC ("Secret Boston," "we," "us," or "our") operates secretboston.co and the accounts, memberships, newsletters, forms, transactions, and features available through the website (collectively, the "Services"). Secret Boston, LLC is a Delaware limited liability company with its principal place of business in New York.

This Privacy Policy explains what personal information we collect, how we use and disclose it, how long we retain it, and the choices and rights available to you. It applies to information collected through the Services. It does not govern third-party websites, services, or platforms that maintain their own privacy practices.

1. Personal information we collect

The information we collect depends on how you use the Services.

Information you provide

• Accounts and membership. We collect your email address, password credentials, user ID, display name, account status, and related account metadata. Passwords are processed and stored in hashed form through WordPress authentication systems. Membership services may process membership status, access permissions, subscription information, and account activity.
• Saved items. We associate the identifiers of items you save with your account.
• Newsletter subscriptions. We collect your email address, signup source, signup date, and, when requested, your first and last name. We may export this information to TailoredMail to operate our email list. You can unsubscribe through any marketing email.
• Contact requests. We may collect your name, email address, selected topic, relevant URL, and message. Submissions are sent to us by email and are not intentionally stored in WordPress.
• Place reports. We collect the place identifier, title and URL, issue type, your message, and your email address if you provide it. Reports are sent to us by email and are not intentionally stored in WordPress.
• Ambassador applications. We collect your name, email address, Instagram handle, ZIP code, acceptance of applicable terms, and submission date. Applications are stored privately in WordPress and may also be sent to us by email.
• Ambassador booking inquiries. We collect your name, company or venue, email address, optional phone number, inquiry details, and submission date. Inquiries are stored privately in WordPress and may also be sent to us by email.
• Member opportunity claims. We collect the member's user ID, name, email address, opportunity identifier, and claim date. Claims are stored privately in WordPress, and we send confirmation and administrative emails.
• Community event submissions. We may collect account information and the event, organizer, venue, contact, website, image, and other information you provide. Some information may be published after review. Do not submit personal information that you do not want displayed publicly.
• Purchases and subscriptions. SureCart, SureMembers, and Stripe may process your name, email address, billing information, payment information, transaction details, subscription status, tax information, and related customer-service information. Secret Boston does not intentionally receive or store complete payment-card numbers.
• Historical comments. We may retain comments and moderation data collected through earlier versions of the website, including names, email addresses, IP addresses, browser user-agent strings, comments, and avatar information. Secret Boston does not currently accept new public comments. Historical comments are not displayed unless we deliberately republish them.
• Correspondence and requests. We collect information you include in emails, privacy requests, customer-service communications, and other correspondence.

Information collected automatically

We and our service providers may automatically collect:

• IP address and approximate location derived from it;
• browser type, operating system, device type, language, and device identifiers;
• referring and exit pages, pages viewed, links clicked, searches, dates and times of access, and site interactions;
• login, authentication, session, and security events;
• transaction, membership, and form-submission events; and
• cookie, local-storage, and similar technology data.

2. Cookies and similar technologies

We use cookies, local storage, tags, and similar technologies for:

• Strictly necessary functions: authentication, session management, checkout, membership access, security, fraud prevention, and privacy choices;
• Preferences and functionality: saving settings and remembering that a newsletter popup was dismissed. The current popup dismissal setting is stored locally for approximately 30 days; and
• Analytics: measuring traffic, feature use, and site performance through Google Tag Manager and Google Analytics 4.

We do not use advertising or remarketing technologies at launch. We do not use Meta Pixel, Google Ads, TikTok Pixel, affiliate tracking, or cross-context behavioral advertising at launch.

You can control cookies through your browser. Blocking strictly necessary cookies may prevent account, checkout, membership, and saved-item features from working. Google also provides a Google Analytics opt-out browser add-on.

3. How we use personal information

We use personal information to:

• provide, maintain, personalize, and improve the Services;
• create and authenticate accounts;
• provide saved-item and membership features;
• process purchases, subscriptions, claims, applications, bookings, reports, and event submissions;
• send transactional, account, membership, customer-service, and permitted marketing communications;
• review, moderate, and publish community event submissions;
• measure traffic and site performance;
• prevent spam, abuse, fraud, security threats, and unlawful activity;
• enforce our terms and protect legal rights;
• comply with legal, tax, accounting, and regulatory obligations; and
• create aggregated or deidentified information.

4. How we disclose personal information

We may disclose personal information to:

• hosting, website, and infrastructure providers;
• account and membership providers, including SureMembers;
• commerce and payment providers, including SureCart and Stripe;
• email providers, including TailoredMail and providers that transmit or host our email;
• analytics providers, including Google Tag Manager and Google Analytics 4;
• mapping and content providers, including Mapbox and Google Fonts;
• security and spam-prevention providers, including Wordfence and Akismet;
• event, form, search, and other website-service providers;
• accountants, insurers, auditors, consultants, and legal service providers;
• authorities or other parties when required by law or reasonably necessary to protect rights, safety, property, users, or the Services; and
• a buyer, successor, or transaction participant in a merger, financing, reorganization, bankruptcy, sale of assets, or similar transaction.

We may disclose aggregated or deidentified information that does not reasonably identify you.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

5. Analytics

We use Google Tag Manager to manage tags and Google Analytics 4 to measure use of the Services. These services may process identifiers, IP-derived location, device and browser information, referring pages, pages viewed, interactions, and cookie or similar identifiers. Google may process this information under its own privacy terms.

6. Maps, fonts, embedded content, and external links

Pages with maps may load Mapbox resources. The Services also load Google Fonts. These providers may receive your IP address, browser and device information, the requesting page, and related technical information.

Pages may include embedded videos, images, social posts, or other third-party content. Embedded content may allow the third party to collect information, set cookies, or monitor your interaction as though you visited its service directly.

The Services link to third-party websites and services. We do not control those parties or their privacy practices.

7. Security and spam prevention

We use measures intended to protect personal information, including access controls, encryption in transit, authentication controls, firewalls, backups, monitoring, and services such as Akismet and Wordfence. These services may process IP addresses, browser and device information, submitted content, URLs, and security-event data.

No system is completely secure. If a security incident involving personal information occurs, we will investigate and provide legally required notices.

8. Data retention

We retain personal information for as long as reasonably necessary to provide the Services, fulfill the collection purpose, maintain security, resolve disputes, enforce agreements, and satisfy legal, tax, accounting, and regulatory obligations. The period varies according to the information, its sensitivity, the collection purpose, retention risk, and applicable requirements.

Account information generally remains until the account is deleted. Saved items generally remain until removed or the account is deleted. Newsletter information generally remains until unsubscribe or deletion, although we may retain a minimal suppression record to prevent further marketing. Published events and historical comments may remain while related content remains part of the Services. Transaction, membership, claim, tax, accounting, security, consent, and privacy-request records may remain as needed for operational or legal purposes.

Service providers may retain information according to their own schedules and legal obligations. Backups may retain deleted information until overwritten through the ordinary backup cycle. We may retain information longer when required by law, subject to a legal hold, needed for legal claims, or reasonably necessary for fraud or security investigations. We may retain aggregated or deidentified information.

9. Your choices and privacy rights

Depending on where you live, you may have rights to:

• access or obtain a copy of personal information;
• correct inaccurate information;
• request deletion;
• restrict or object to certain processing;
• receive certain information in a portable format;
• withdraw consent;
• opt out of marketing; and
• appeal a privacy-request decision where applicable.

Email crew@secretboston.net with the subject line "Privacy Request." Describe your request and provide the email address associated with your account or submission. We may request information needed to verify your identity and authority. Authorized agents may submit requests where permitted. We will not discriminate against you for exercising a privacy right.

Some rights are subject to exceptions. We may retain information needed to complete a transaction, protect security, maintain a legal claim, comply with law, or preserve a marketing-suppression record.

California residents may request information about disclosures of certain personal information to third parties for their own direct-marketing purposes under California's "Shine the Light" law, if applicable.

10. Browser privacy signals

Browsers may transmit Do Not Track, Global Privacy Control, or other privacy preferences. Because there is no uniform legal standard for Do Not Track, the Services do not respond to Do Not Track signals unless applicable law requires otherwise.

Secret Boston does not sell personal information or share it for cross-context behavioral advertising. If our practices change, we will update this Policy and honor recognized browser-based opt-out signals where required.

11. International users

Secret Boston is based in the United States and does not intentionally target users in the United Kingdom or European Economic Area. If you access the Services from outside the United States, we and our providers may process your information in the United States and other countries with different data-protection laws.

Where applicable law requires a safeguard for an international transfer, we will use a legally recognized transfer mechanism.

12. Children's privacy

The Services are intended for a general audience and are not directed to children under 13. You must be at least 13 to create an account. We do not knowingly collect personal information online from children under 13. Contact us if you believe a child under 13 provided personal information.

Community event submitters must be at least 18. Users must also be at least 18 to make purchases, join a paid membership, apply as an ambassador, book an ambassador, or claim member opportunities.

13. Changes to this policy

We may update this Policy to reflect changes in our practices, Services, or legal obligations. We will post the revised Policy and update the effective date. We will provide any additional notice or choice required by law for material changes affecting previously collected information.

14. Contact us

Secret Boston, LLC
crew@secretboston.net