Privacy and Use Policy

1. Who this policy is from

This site is operated by Wanderlust Santa Rosa ("we", "us") to schedule vendors for our Thursday market. Questions about this policy, or any request about your information, go to santarosa@wanderlustevents.net, an inbox a person reads.

Our registered operating entity and postal address: [CLIENT TO SUPPLY].

2. What we collect, and why

Everything we hold about you comes from the form you filled in. Nothing is bought, scraped or inferred.

• Business or stall name, to identify your booth and list you publicly once approved.
• Contact name, so we know who we are speaking to.
• Email address, to send you the approval or decline notice, the payment link, and market day logistics.
• Phone number, for time sensitive contact on or near market day.
• Vendor type, booth size, setup type and what you sell, to balance the lineup, allocate space and set the correct booth fee.
• Requested market dates, the reason you are here.
• Approval status and whether the booth fee is paid, added by us, not by you.
• A one way hash of your network address, kept only to stop automated abuse of the form. It is a scrambled fingerprint: we do not store or have your actual IP address, and it cannot be reversed back into one.
• The fact that you accepted this policy, and which version.

We do not collect payment card details anywhere on this site. Booth fees are invoiced by email and paid through a link we send you, handled by that payment provider under their own policy.

What we do not do

• No advertising, no tracking pixels, no third party cookies.
• No selling, renting or sharing your details with anyone for their own purposes.
• No automated decisions. A person reviews every request.
• No marketing email unless you ask us to add you to a list.

3. Where it is stored

Submissions are stored server side in a hosted PostgreSQL database provided by Supabase, on infrastructure located in the United States. Supabase processes this data on our behalf and does not use it for its own purposes. The site itself is served by Vercel, with DNS and network protection from Cloudflare. The anti bot check on the submission form is Cloudflare Turnstile, which confirms you are a person without setting tracking cookies, profiling you, or following you across other websites.

Our fonts, stylesheet and scripts are served from this site rather than from a content delivery network, so loading a page does not tell anyone else that you visited. Those providers may briefly log ordinary request information, such as network addresses, for security and reliability under their own policies.

4. Cookies, analytics and what runs in your browser

A consent panel is shown on your first visit, so nothing optional can run without your say so. Nothing is pre ticked, refusing is one click, exactly like accepting, and your answer is stored in your browser's local storage with a version number rather than in a cookie. You can change it at any time with the Cookie settings link in the footer. If your browser sends a Global Privacy Control signal we treat that as a refusal of everything optional and do not ask.

Audience measurement

We intend to add Google Analytics so we can see how many people visit, which pages they read and roughly where they come from. It is a planned addition rather than something running today, and when it is switched on the consent version changes, which means the panel appears again and asks you afresh.

When it is live it will load only for visitors who turn on Analytics in that panel. Turn it down, or leave it down, and the Google Analytics script is never requested: no measurement cookie is set, and no request is made to Google at all. If you allow it, Google sets cookies to recognise a returning browser, and receives your network address, the pages you view on this site, and general device and browser information; the address is truncated before it is stored. Google acts as our processor for that measurement and we have not enabled any advertising, remarketing or data sharing features. We never send it your name, email, phone number or anything you typed into the vendor form, and we never use it to identify an individual visitor.

Whatever your answer, the vendor application form and the security check work exactly the same. Analytics is never a condition of applying.

What is kept in your own browser

To save you retyping, your vendor details are saved in your browser's local storage on the device you used, along with a random identifier that lets you see the status of your own requests without an account. That copy never leaves your device, is not readable by us or by other sites, and is not a cookie or a tracker. Clearing your browser data, or using Clear saved details on the form, removes it. Doing so does not delete anything already submitted to us; use the contact address above for that.

If you share a computer, be aware that the next person to open the form will see the saved details until they are cleared.

5. Who can see it

Access is restricted in the database itself, not merely hidden in the page. The public site is permitted to read only four fields, being business name, vendor type, market date and a record id, and only for approved vendors. Your email, phone, contact name and notes are unreachable from any browser; they can be read only by a signed in market administrator. Traffic is encrypted in transit and the database is encrypted at rest.

• The market administrator, one password protected account. This is the only login that can see contact details.
• The public, once you are approved: your business name, vendor type and the dates you are attending. Nothing else.
• Our providers, being Supabase, Vercel and Cloudflare, strictly as infrastructure, and Google once audience measurement is switched on and you have allowed it.
• Anyone we are legally required to disclose to, on a valid legal request, and nothing beyond it.

6. How long we keep it

Submissions are retained for 24 months after the market date they relate to, so we can settle fees, answer questions and plan future seasons. After that they are deleted. You can ask us to delete yours sooner.

7. Your choices

Write to our contact address and we will, within 30 days:

• send you a copy of everything we hold about you;
• correct anything that is wrong;
• delete your information and remove you from upcoming market dates;
• tell you who we have shared it with, if anyone.

Depending on where you live you may have these rights by law, for example under the California Consumer Privacy Act or the GDPR. We apply them to everyone regardless. We will not treat you differently for exercising them, though we cannot schedule you for a market date without the contact details needed to run it. We do not sell or share personal information as those terms are used in California law.

8. Security

We take reasonable measures to protect your information, including database enforced access rules, column level restrictions on what the public site can read, encrypted transport and storage, a single administrator account, and rate limiting on the form. No system is perfectly secure; if a breach ever affects your information we will notify you at the email address you gave us, and any authority we are required to notify, without undue delay.

If you believe you have found a security problem with this site, please tell us at the address above rather than disclosing it publicly. We are grateful for the help.

9. Children

This site is for businesses applying to trade at the market and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has submitted information, contact us and we will remove it.

10. Attending the market

The market is free to attend and open to the public during the published hours. No ticket is required and nothing on this site is a contract to attend.

We publish the lineup as vendors are confirmed. Trucks occasionally cancel at short notice, so the published lineup is our best current information rather than a guarantee that a particular truck will be there.

We run in light rain. If weather or a public safety issue forces a cancellation we will say so on this site and on our social channels as early as we can, normally by the day before.

11. Requesting a market space

• A submitted date is a request, not a booking. It becomes a booking when you receive an approval email from the market manager, and your space is held once the booth fee is paid.
• Booth fees are set per vendor type and per date, and are shown on the application form before you submit. They are invoiced by email, not collected on this site.
• Payment for each date is due no later than one week before that market. Unpaid dates may be released to another vendor.
• Before your first trading day we need a current Sonoma County health permit, a City of Santa Rosa business license, and a $1M general liability certificate naming the festival as additional insured.
• Food and drink only, plus your own branded merchandise. Standalone craft, retail and service booths are not a fit for this event.
• Bring your own power. We do not run cords across the square.
• We may decline a request, or remove a vendor from the calendar, at our discretion, for example to keep the menu balanced or where the conditions above are not met.

12. Cancellations

Tell us as early as you can if you cannot make a date you have been approved for, so the space can go to someone else. Refund of a paid booth fee is at our discretion and depends on how much notice we have. If we cancel a market night, paid fees for that night are credited or refunded in full.

13. Acceptable use of this site

• Submit only your own business's information, and keep it accurate.
• One vendor per submission. Do not book dates on someone else's behalf without telling us.
• Do not use automated tools to submit requests. The form is rate limited, and abusive traffic is blocked.
• Do not attempt to access data that is not yours, probe the site for weaknesses, or interfere with its operation.
• The text, photographs, layout and code on this site belong to us or to our suppliers. You may link to any page freely. Please ask before republishing content.
• Vendor names and logos shown in the lineup belong to those businesses.

14. Accuracy and availability

We keep the times, location and lineup on this site as accurate as we can, but we do not promise the site is error free or always available. Parts of it depend on services we do not control, and they occasionally fail.

15. Liability

Attending the market and trading at it are at your own risk. Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited. Otherwise, to the extent the law allows, our liability arising from this website or from a market space is limited to the booth fees you have paid us for the dates concerned.

16. Law

This policy is governed by the law of the State of California, and the courts of Sonoma County have jurisdiction over any dispute.

17. Changes

If we change this policy we will update the version number and date at the top of the page. The version you agreed to is recorded with your submission, and the terms in force when you submitted a request are the ones that apply to that request. Material changes affecting how we use existing information will be emailed to affected vendors, and a new provider, including audience measurement, changes the consent version so the panel asks you again.

18. Accessibility

We want everyone to be able to read the lineup, find the square and apply for a space. We aim to meet WCAG 2.2 level AA, and every page type was checked against that standard before release, by automated tools and by hand, with the findings recorded in the accessibility audit kept with the site's source. This section was last reviewed on September 18, 2026.

What we tested

• Automated checks with axe and Lighthouse on the home page, the about page, the FAQ, the vendor application and this policy, with no critical or serious findings left open.
• A full keyboard pass on each page type: every control reachable and operable in a logical order, no traps, and a focus outline that stays visible over the hero photograph and inside the dark sections.
• A screen reader pass: one first level heading per page, headings in order, page landmarks present, the decorative parts of the hero hidden from the reading order, and the calendar's day buttons named with the full date and their state.
• Colour contrast measured against the actual pixels behind the text rather than an average, including the headline over the darkest and lightest parts of the sky.
• Zoom to 200 percent, and reflow at 320 pixels wide, with no sideways scrolling and nothing cut off.
• Forms: real labels on every field, errors announced and described in words rather than by colour alone.
• Motion: the scroll cue, the drifting hero, the reveal animations and the moving strip all stop when your system is set to reduce motion.

Known limitations

• The vertical links in the left and right page margins are hidden below 1100 pixels wide. Everything they reach is also in the footer of every page.
• The lineup and the Thursday calendar are drawn in the browser from our database. Without JavaScript the rest of each page still reads normally, but those two lists and the application form cannot work. If that affects you, email us and we will take your dates by email.
• The anti bot check on the vendor form is supplied by Cloudflare. It does not usually present a puzzle, but if it blocks you, email us and we will enter your request for you.
• The moving strip of food names on the home page is decorative and hidden from screen readers. It stops if you have reduced motion turned on, but it cannot be paused by hand.

Accessibility at the market

• Old Courthouse Square is flat and paved, with curb cuts on all four corners.
• Accessible restrooms are on the north side of the square and stay open through the event.
• Seating is at ground level with space between tables for a wheelchair or a stroller.
• The music is loud enough to feel and quiet enough to talk over. If it is too much, the north and west edges of the square are the quietest.
• Service animals are welcome, as are leashed pets.

Tell us about a barrier

If something on this site or at the market stops you, email santarosa@wanderlustevents.net and tell us what you were trying to do. We aim to reply within two working days, and we will tell you what we can fix and when. If the fix will take a while, we will offer another way to get the same thing done in the meantime.