Privacy Policy

Who this covers

This policy applies to coloradovenuefinder.com (the "site"), which is owned and operated by Earth Coast Productions ("we," "us"), a Colorado event and media production company at 1750 30th St #310, Boulder, CO 80301-1029. Colorado Venue Finder is a project of that company, not a separate legal entity.

It does not cover other websites. When you follow a link from here to earthcoast.com, to a venue's own website, or anywhere else, that destination's privacy practices apply — including Earth Coast Productions' own privacy policy, which governs anything you submit there.

Under privacy laws that use these terms, Earth Coast Productions is the controller (or "business") for information collected through this site.

Information we collect

Information you choose to give us

The venue listing and correction form is the site's only input. When you submit it, we receive the fields you filled in:

• the venue name, and whether this is a new listing or a correction;
• your name and, optionally, your role or title;
• your email address, and optionally your phone number;
• optionally, the venue's website; and
• the message you wrote.

That submission is sent to our team's inbox at [email protected], with your email address set as the reply-to so a person can answer you directly. It is not added to a marketing list, and we do not send newsletters from this site. If you email or call us using the details on this page, we obviously hold that correspondence too.

Information collected automatically

• Server and edge logs. Like every website, our servers and our content delivery network record technical request data: IP address, user agent, the URL requested, response status, timestamp, and referring page. These exist for security, abuse prevention, and debugging. They rotate automatically and are not used to build profiles of individuals.
• Anonymous usage analytics. We measure the site with two cookieless tools, and only these two. Cloudflare Web Analytics is a small script our CDN adds to each page; it reports page views and page-load timings, sets no cookies, and uses no identifier that follows you to other sites. Umami is privacy-first analytics software we run on our own infrastructure, which counts page views and which filters, regions, and venues people use; it also sets no cookies, and its data never leaves servers we control. Both exist to tell us which venues to research next — not to identify you.
• Bot and abuse signals on the form. The listing form is protected by Cloudflare Turnstile, which examines browser and device signals to judge whether a submission is automated, plus a hidden honeypot field and a minimum fill time. Your IP address is passed to Cloudflare as part of that check. Turnstile is designed as a privacy-preserving alternative to CAPTCHAs and is not used to track you across sites.

What we never collect

• No user accounts — there is nothing to register for, so there are no passwords or profiles.
• No advertising or social trackers. No ad pixels, no remarketing tags, no Meta or LinkedIn pixels, no Google Analytics, no data shared with an advertising network. The only third-party script on any page is Cloudflare's cookieless Web Analytics beacon described above.
• No session recording or heatmaps. We do not replay your mouse movements, scrolls, or keystrokes.
• No device fingerprinting for tracking or profiling.
• No payment information. The site sells nothing and never asks for card details.
• No sensitive data. We do not ask for, want, or knowingly process health, biometric, precise geolocation, immigration status, or other sensitive categories. Please don't put any in the form's message field.
• No purchased data. We do not buy contact lists or enrich visitors against data brokers.

Cookies and local storage

This site sets no analytics, advertising, or tracking cookies. That is why you do not see a cookie consent banner here — there is nothing to consent to.

• Your theme choice is saved in your browser's local storage under the key cvf-theme so the site opens in light or dark the way you left it. It stays on your device, is never transmitted to us, and clearing your browser data removes it.
• Neither analytics script sets a cookie. Cloudflare Web Analytics and Umami both measure without cookies and without a persistent visitor identifier, which is exactly why they are the two we use.
• Cloudflare security cookies. Our CDN and bot-protection layer may set strictly-necessary cookies (such as __cf_bm or cf_clearance) when it needs to distinguish a human from automated traffic — most often around the listing form. They exist for security, carry no advertising function, and are short-lived.
• Map tiles. Maps are lazy — nothing loads until a map scrolls into view. When one does, your browser requests map images directly from CARTO and OpenStreetMap, which necessarily sees your IP address as part of serving them. Their terms apply to that request.
• Fonts are self-hosted. Typefaces are served from our own domain, so loading a page here makes no request to Google Fonts or any other font network.

How we use information

We use what we collect only for these purposes:

• To answer you and to act on a listing submission or correction.
• To verify and publish venue information, including confirming a submitted detail with the venue before it goes live.
• To keep the site up, fast, and un-abused — security, rate limiting, spam prevention, and debugging.
• To understand what the directory is missing, in aggregate, so we know which venues and fields to research next.
• To meet legal obligations and to establish or defend legal claims where that becomes necessary.

For visitors in the EEA or UK, our lawful bases are: legitimate interests (running, securing, and improving a free informational site, and responding to business correspondence), consent where you voluntarily submit the form, and legal obligation where a law requires retention or disclosure.

Services that process data for us

We keep this list short on purpose. Each of these acts as our processor (or "service provider"), under contract, and may use the data only to provide the service to us:

Sharing, selling, and advertising

We do not sell personal information, and we do not share it for cross-context behavioural (targeted) advertising. We have never done either, and the site is built so we have nothing worth selling. We also do not use personal information for profiling that produces legal or similarly significant effects.

We disclose personal information only in these situations:

• to the processors listed above, so they can do the job we hired them for;
• to a venue, when you submit or correct that venue's listing and confirming it with them is the obvious next step — we tell you if we need to do this;
• when a law, subpoena, or valid legal process requires it, or to protect someone's safety or our legal rights; and
• to a successor if the business is sold or merged — in which case this policy travels with the data until it is replaced by one no less protective.

How long we keep things

• Form submissions and correspondence live in our email system for as long as the conversation is useful and as our ordinary business records require — generally up to three years — after which they are deleted. You can ask us to delete yours sooner.
• Server and CDN logs are short-lived and rotate automatically, typically within 30 days.
• Analytics data is aggregate and contains no identifier that can be traced back to you, so there is nothing to delete on request; we retain it indefinitely as counts.
• Published venue information stays until it changes or a venue asks us to change it — see below.

Your privacy rights

Wherever you live, you can ask us to access, correct, delete, or send you a copy of personal information we hold about you, and to opt out of any sale, sharing, targeted advertising, or profiling (we do none of those, so that request is already satisfied). We will not treat you differently for exercising a right — there is no service to degrade.

Colorado residents have these rights under the Colorado Privacy Act, and residents of California, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comparable laws have equivalent rights under theirs. Visitors in the EEA or UK additionally have the rights to restrict or object to processing and to lodge a complaint with a supervisory authority.

How to exercise a right

Email [email protected] with the subject line "Privacy request," or write to us at the postal address below. Tell us what you want and enough detail to find your data — usually the email address you used. We may need to verify that the request is really yours before acting on it, and we will not use verification details for anything else. An authorised agent may act for you with written permission.

We respond within 45 days, and will tell you if we need one 45-day extension. There is no charge unless a request is manifestly unfounded or repetitive.

If we say no

You may appeal any refusal by replying to our decision with the word "Appeal." A different person reviews it and we answer within 45 days, in writing, with our reasoning. If the appeal is denied, Colorado residents may contact the Colorado Attorney General; residents elsewhere may contact their own state Attorney General or supervisory authority.

Global Privacy Control

We honour Global Privacy Control and other universal opt-out signals. In practice there is nothing for the signal to switch off: we never sell personal information, never share it for targeted advertising, and run no advertising trackers, so every visitor is already in the state a GPC signal would request.

Venue listings and the people in them

Venue listings describe businesses, not private individuals. Our editorial rules require that published contacts are role titles and main business lines — "Director of Sales," a venue's public events inbox — never a scraped personal address, and never a private individual's details. The full rules are on the about page.

If a listing shows something about your venue that is wrong, out of date, or that you want removed — including a contact detail — use the venue form or email us. We act on venue corrections quickly and at no cost; nobody pays to be listed, corrected, or removed.

Children

This is a business tool for people booking event space. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, email us and we will delete it.

Security

The site is served over HTTPS only — plain HTTP requests are redirected, and the domain is HSTS-preloaded, so browsers refuse to connect insecurely. Credentials for the systems behind the site live in a managed secrets store rather than in code, access is limited to the people who need it, and the site holds no database of visitors to breach: the only personal information the site handles is the form submission it forwards straight to our inbox.

No system is perfectly secure. If you find a vulnerability, please tell us at [email protected] before disclosing it publicly — we will work with you and we will not pursue good-faith security research.

Where the data lives

We operate in the United States, and the servers and services described above process data in the United States. If you use the site from outside the US, you are sending your information to the US, where privacy laws differ from your own. Where a transfer of EEA or UK data is involved, we rely on the standard contractual clauses our providers offer.

Changes to this policy

When the site changes what it collects, this page changes in the same release, and the "last updated" date above moves with it — that date is also what our sitemap publishes to search engines, so the two can never disagree. Material changes will be summarised at the top of this page for at least 30 days. Continuing to use the site after a change means you accept the updated policy.