Short version. We do not sell your data. We do not build advertising profiles. We collect the least we can get away with, and we tell you every time a third party is involved.
Who we are
Explore Pawleys Island publishes this guide to Pawleys Island and the Waccamaw Neck in Georgetown County, South Carolina. For any question about this policy or about data we hold, contact [email protected].
What we collect when you just read
Browsing the site sets no tracking cookie and requires no account. Our web server writes a standard access log containing your IP address, the page requested, the time, your browser user agent string and the referring page. We use those logs for security, abuse investigation and diagnosing errors. They are retained for a limited operational period and then rotated out.
We store your accessibility and display preferences in your browser's local storage under the key epi.a11y. That never leaves your device and we cannot read it from our servers. Clearing your browser storage removes it.
A session cookie is issued to carry a CSRF token when a page contains a form. It holds no personal information and expires when you close your browser.
What we collect when you give it to us
- Newsletter signup: your email address, and the date and source of the signup so we can prove consent. Every email carries a one click unsubscribe, and unsubscribing removes the address.
- Contact and business claim forms: whatever you type, which is typically a name, an email address and a message.
- Search terms you type are processed to return results. We may keep aggregate counts of popular searches to decide what to write next. Those counts are not tied to you.
We use what you send us to answer you and to run the thing you asked for. We do not sell it, rent it, or hand it to a data broker.
Third parties, named
These are the outside services a page on this site may contact, and what each one receives.
| Service | What it does | What it receives |
|---|---|---|
| Google Places API | Supplies business listings, hours, ratings and photos | Requests come from our server. Your browser is not identified to Google by this call. |
| Google Photos proxy | Serves listing photographs through our own cache | Nothing. Images are fetched by our server and served from our domain. |
| NOAA CO-OPS | Supplies live tide and water temperature data | Requests come from our server on a cache schedule, not from your browser. |
| Google Fonts | Serves the Playfair Display and Montserrat typefaces | Your IP address and user agent, as with any font request. |
| Unsplash | Serves placeholder photography while destination photography is produced | Your IP address and user agent when an image loads. |
| Google Translate | Translates the page, only if you pick a language | Page content and your IP address. Nothing loads until you choose a language. |
| Google Analytics | Aggregate traffic measurement, only if configured | A pseudonymous identifier and page view data, with IP anonymisation enabled. |
Google Translate loads nothing at all until you actively select a language, which is why the language menu says so before you choose. If analytics is enabled it runs with IP anonymisation on.
What we deliberately do not do
- We do not sell or share personal information for money or for cross context behavioural advertising.
- We do not run third party advertising networks or retargeting pixels.
- We do not fingerprint your device.
- We do not buy email lists.
- We do not knowingly collect information from children under 13. If you believe a child has sent us information, email us and we will delete it.
Your rights
Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. Email [email protected] and we will respond within 30 days. We will never charge you for asking and we will never treat you worse for having asked.
If you are in California, the CCPA and CPRA give you rights to know, delete, correct and opt out of sale or sharing. We do not sell or share personal information as those laws define it, so there is no opt out to click, but the access and deletion rights apply and the address above is how you use them.
If you are in the European Economic Area or the United Kingdom, the GDPR gives you rights of access, rectification, erasure, restriction, portability and objection. Our lawful bases are consent for the newsletter, legitimate interest for security logging and aggregate analytics, and contract where you have asked us to do something specific.
Security
The site is served over HTTPS only, with HSTS enabled and no mixed content. API credentials live in server side configuration that is never committed to version control and is not reachable over the web. We keep collected data minimal on purpose, because the data you never collect is the data that cannot leak. No system is perfect, and we will not claim otherwise.
Do Not Track and Global Privacy Control
We honour the Global Privacy Control signal. Because we do not sell or share personal information, and because we set no advertising cookies, there is very little for it to switch off, but we respect it rather than ignoring it.
Changes
If we change how we handle data we will update this page and move the date at the top. Material changes will be announced on the site rather than made quietly.
Questions about this document? [email protected]