Reading time: A few minutes. Plain summary: Privacy Policy for the Flathead Valley Directory, including Montana-specific consumer rights.
1. Scope
This Privacy Policy describes how Granite Ridge Realty ("we," "our," or "us") collects, uses, and shares information when you use the Flathead Valley Directory (the "Service"). It applies to visitors who browse the directory, business owners who submit listings, and people who use the contact or report features.
2. Information We Collect
Information you provide directly:
Account information. Email address, password (stored as a hash), and name.
Listing information. Business name, descriptions, address, phone, email, website, social media links, services, year founded, ownership trust signals (locally owned, family owned, veteran owned), and address privacy preference.
Photos. Logos, hero images, and gallery images you upload, along with optional captions.
Messages and reports. Content of contact form messages and inaccuracy reports, including your name, email, and phone number if provided.
Information collected automatically:
Geolocation. When you submit a listing and choose to display your full address, we use the OpenStreetMap Nominatim service to convert the address into coordinates so a map pin can be placed on your listing. We send the address text to OpenStreetMap once at submission; subsequent map renders use the saved coordinates. If you choose not to display your address, no geocoding is performed.
Browser-provided information. Standard server logs at our hosting provider, including IP address, user agent, and referrer URL. These logs are retained briefly for security and operations.
What we do not collect. We do not collect Social Security numbers, financial account numbers, government IDs, biometric identifiers, or precise real-time location data.
3. How We Use Information
We use the information we collect to:
Operate the directory: review and publish business listings, render profile pages, deliver search results, run the contact and reporting features.
Authenticate account holders and protect against unauthorized access.
Communicate with you about your listings, account, or report submissions.
Detect and prevent abuse, spam, fraud, and other harmful activity.
Email notifications about your listings, claim status, and contact form submissions are sent from a Granite Ridge Realty email address (currently directory@skyvaultmedia.co). When a consumer contacts you through the directory, the notification email lists their email address as the reply-to so you can respond directly. Your account email is not exposed to the consumer.
4. When We Share Information
We do not sell personal information. We share information only in these limited cases:
Listed businesses receive contact form submissions. When you use the contact form on a business profile, we transmit your name, email, optional phone, optional subject, and message to the listing owner.
Service providers (sub-processors). We use a small number of third-party service providers to deliver the Service. Each processes information solely to provide its specific function:
Supabase (United States): database, authentication, file storage. Hosts the full data model of the Service.
Netlify (United States): web hosting and static asset delivery. Sees standard HTTP server logs.
Resend (United States): transactional email delivery for contact form messages, claim notifications, and account-related notifications. When a notification email is sent, Resend receives the recipient's email address, the sender's name and contact information (when applicable), and the content of the message being delivered.
OpenStreetMap Foundation (United Kingdom): one-time geocoding at listing submission via the Nominatim service, and ongoing map tile rendering on profile pages with location enabled. Tile requests include the standard HTTP information (IP address, user agent) of the visitor viewing the page.
External services accessed by you. Listings with a public address include a "Get Directions" link that opens Google Maps in a new tab. Once you leave the directory, Google's own privacy practices apply, not ours.
Legal compliance. We may disclose information when required by valid legal process or to protect the safety, rights, or property of Granite Ridge Realty, our users, or the public.
Business transfers. If Granite Ridge Realty is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.
Public listing pages display the business contact details you submitted. They do not display your account email.
5. How We Store and Secure Information
Information is stored on Supabase infrastructure in the United States. Authentication uses industry-standard hashed passwords. Database access is restricted by row-level security policies that limit each account to its own data. Photos are served over HTTPS and stored in a private folder structure keyed to your account.
No security measure is perfect. We cannot guarantee that information will never be intercepted or accessed without authorization.
6. Retention
We retain information for as long as your account is active or as needed to operate the Service. When you delete your account, we delete your business listings, uploaded photos, and account profile within a reasonable period. Backups containing already-deleted data may persist for up to 30 days.
Records of your acceptance of these Terms and Privacy Policy are retained for legal record-keeping purposes after account deletion, but stripped of identifying user references.
Server logs are retained briefly (typically 30 days or less) and may persist longer in security-related cases.
7. Cookies and Tracking
The Service does not use marketing or advertising cookies. We do use limited browser storage for sign-in functionality. Map tiles are served from OpenStreetMap, which has its own privacy practices. See our Cookie Notice for details.
8. Your Rights
Subject to applicable law, you may:
Access the personal information we hold about you. Most of it is visible in your account dashboard.
Correct inaccurate information. You can edit your listing directly. For other corrections, contact us.
Delete your information. The account dashboard provides a self-service deletion tool that removes your account, listings, photos, and associated data.
9. Montana Consumer Data Privacy Act
Montana residents have additional rights under the Montana Consumer Data Privacy Act (MCDPA), including the right to access, correct, delete, and obtain a portable copy of personal data, and the right to opt out of certain processing. To exercise these rights, contact us using the details in Section 13. We will respond within 45 days, and we will not retaliate against you for exercising your rights. If we deny a request, you may appeal by replying to our response.
We do not engage in targeted advertising, sale of personal data, or profiling for decisions that produce legal or similarly significant effects, as those terms are defined in the MCDPA.
10. Minors
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, contact us and we will delete it.
11. International Visitors
The Service is operated from the United States. If you visit from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The effective date at the top of this page reflects the latest revision. Material changes will be highlighted in the directory and communicated by email to account holders where reasonably possible.
13. Contact
Privacy questions and requests can be sent to Granite Ridge Realty: