Privacy Policy

This policy explains what Steakhouses.nyc ("we", "us", the "Site") collects when you visit https://steakhouses.nyc, why, who else sees it, and what you can ask us to do about it. It covers the public website and the newsletter. It applies to everyone, wherever you are.

The short version: this is a personal review site. There is no advertising and nothing is sold. Google Analytics counts visits, and where the law says you must be asked first, you are asked first — say no, or switch on Global Privacy Control, and it never loads. We record the words typed into the search box with nothing attached that could identify who typed them. The only personal information we deliberately hold is an email address, and only if you typed one in.

1. Who is responsible

Steakhouses.nyc is the controller of the personal information described here. Questions, requests and complaints go through the contact page. There is no data protection officer; the Site is run by one person and that person reads the inbox.

2. What we collect

Information you give us

• Your email address, if you subscribe to the newsletter. Nothing else — the form has one field, and there is no name, no preferences and no profile attached to it.
• What you write to us. If you use the contact page, your message and the address you gave so we can reply. Corrections, complaints and tips all arrive this way.

Information collected automatically

The Site is served by Cloudflare, which keeps the ordinary server logs every web host keeps: IP address, the page requested, the time, the referring page, and your browser's user-agent string. These exist to deliver pages and to stop abuse. We do not build profiles from them, we do not link them to subscribers, and we do not look at them routinely.

Search terms

When you use the search box, the words you searched for and the number of results they returned are recorded, so we can see which questions this Site is failing to answer — a search that finds nothing usually means a steakhouse is missing from the list. Nothing else is recorded with them: no IP address, no identifier, no cookie. There is deliberately nothing stored that could join one search to another or to you, and the words are automatically deleted after about thirteen months. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is recorded at all.

Analytics

This Site uses Google Analytics to count visits — which pages are read, roughly where in the world readers are, and what brought them here. It tells us whether writing this is reaching anyone. Google receives your IP address in order to serve the request and to estimate your country; IP addresses are anonymised and are not stored by us. We do not combine any of it with your email address, and we cannot identify you from it.

Google Analytics only runs where we are permitted to run it without asking, or where you have been asked and said yes. Section 3 sets out exactly when each applies. Google acts as our processor for this and is itself in the United States, so where the data of readers in the UK or EEA is transferred there, it is covered by the EU–US and UK–US Data Privacy Frameworks and Google's Standard Contractual Clauses.

What we do not collect

No advertising or ad measurement, and Google Analytics here is not linked to any advertising product. No tracking pixels, beacons, session recording, heatmaps or fingerprinting. No social media embeds. No accounts, so no passwords. We never ask for payment details, and there is nothing on this Site to buy. We do not knowingly collect information from children, and we do not collect special category data — health, biometrics, race, religion, politics, sexual orientation or trade union membership — from anyone.

3. Cookies and similar technologies

Google Analytics sets cookies (names beginning _ga) to count a returning browser as the same visit rather than two. They hold a random identifier, they are not used for advertising, and nothing on this Site reads them. They typically last up to two years, and clearing your browser's cookies removes them.

Where the law requires it to be asked first, it is. If you are in the UK, the EEA or Switzerland, nothing is loaded and no cookie is set until you press Allow on the banner. Press "No thanks" and Google Analytics is never loaded at all — not loaded and switched off, but never fetched. If your browser sends a Global Privacy Control or Do Not Track signal, the same is true wherever you are, and you will not see a banner because there is nothing to ask.

Cloudflare may set strictly necessary cookies for security and to keep the service working; these are not used for advertising or tracking. Your browser's local storage is used to remember your own settings on this Site — including your answer to the banner above — and never leaves your device.

Changing your mind

Clearing this Site's data in your browser clears the remembered answer, and you will be asked again. Turning on Global Privacy Control in your browser stops it everywhere, permanently, without needing to ask us.

4. Why we use it, and on what legal basis

We do not use personal information to make automated decisions about you, and there is no profiling of any kind.

5. Who else sees it

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not rent, trade or otherwise hand it to anyone for their own purposes. It is disclosed only to the service providers who make the Site work, each acting on our instructions:

• Cloudflare, Inc. — hosting, content delivery, and the storage where subscriber email addresses are kept.
• CARTO — supplies the map tiles on the atlas page only. Opening that page means your browser requests images from them, which necessarily reveals your IP address to them. No other page contacts them.
• A form-handling provider, where one is used to deliver contact messages. Your message and address pass through it for that purpose only.
• Google LLC — Google Analytics, and only where analytics is running for you at all: nowhere consent is required unless you pressed Allow, and nowhere if your browser sends Global Privacy Control or Do Not Track. Google acts as our processor and may not use any of it for its own purposes. It is not linked to Google Ads or any advertising product.

We may also disclose information where the law requires it, or where it is necessary to establish or defend legal claims, or to protect the rights and safety of others. If the Site were ever transferred to someone else, subscriber addresses would only pass with it under this same policy, and you would be told first.

6. Where information goes

The Site is operated from the United States and its providers run globally distributed networks, so information may be processed in countries other than yours, including the United States. Where information is transferred out of the UK or the European Economic Area, our providers rely on the safeguards available to them, such as the European Commission's standard contractual clauses.

7. How long we keep it

• Your email address: until you unsubscribe, then it is deleted outright. There is no suppression list and no archived copy.
• Your messages: kept as long as they are useful — a correction may be worth keeping to explain a change to the Site — and deleted on request.
• Server logs: kept on our provider's ordinary schedule, which is short, and not under our control.
• Search terms: deleted automatically after about thirteen months. There is nothing stored with them to delete on request, because nothing identifies who typed them.
• Google Analytics: retained by Google on the shortest schedule it offers, currently fourteen months, after which it is deleted by them.

8. Your rights

Depending on where you live, you may have some or all of the following rights. We honour them for everyone regardless of where they live, and we do not charge for exercising them or treat you differently for doing so.

• Access — ask what we hold about you, and get a copy.
• Correction — have inaccurate information fixed.
• Deletion — have it erased.
• Portability — receive it in a portable format.
• Restriction and objection — ask us to stop or limit a use, including any use resting on legitimate interests.
• Withdraw consent — unsubscribe at any time. This does not affect anything done before you withdrew it.
• Opt out of sale, sharing, or targeted advertising — there is nothing to opt out of, because none of it happens here.

To exercise any of these, use the contact page. Say what you want and give the address you subscribed with so we can tell it is you; we will not ask for identity documents. We answer within 30 days. You may use an authorised agent.

If you are in the UK or the EEA you may complain to your data protection authority — in the UK, the Information Commissioner's Office. We would rather you told us first, but it is your right either way.

9. Unsubscribing

Every email has an unsubscribe link. One click removes your address immediately and permanently, with no confirmation step and nothing retained afterwards. You can also ask through the contact page, and the same thing happens.

10. Do Not Track and Global Privacy Control

Both signals are honoured, everywhere, whatever the local law requires. If your browser sends either one, Google Analytics is never loaded — not loaded and disabled, never fetched — no cookie is set, and the words you search for are not recorded. You will not see a consent banner either, because there is nothing left to ask about.

This is the whole of what those signals mean here, and it is deliberately more than the law requires in most places. A signal that only counted where it was legally enforceable would not be worth sending.

11. Children

The Site is not directed at children, is not intended for anyone under 16, and we do not knowingly collect anything from them. If you believe a child has given us an email address, write to us and it will be deleted.

12. Security

The Site is served only over HTTPS. Subscriber addresses are held in access-controlled storage, and the page that lists them is restricted to the Site's owner and checked on every request. No system is perfectly secure, and we cannot promise otherwise — but there is very little here to lose, which is itself the point.

13. Other sites

Reviews link to restaurants and to other sites. Once you follow a link you are on someone else's site under someone else's policy, and this one no longer applies.

14. Changes

If what the Site collects changes, this page changes with it and the date at the top moves. Where a change materially affects subscribers, we will say so in the newsletter rather than quietly editing the page.

15. Contact

Steakhouses.nyc
Contact page