BuildBLK — Privacy Policy

Effective Date: [DATE]

Last Updated: [DATE]

---

The short version

• We collect the minimum we need to run a directory.
• We do not sell your personal information, and we never will.
• We do not run third-party advertising trackers.
• You can ask us to delete your data at any time.

The rest of this policy is the detail.

1. Who we are

[LEGAL ENTITY NAME], a California nonprofit corporation, operates BuildBLK. We are the business responsible for the personal information described here. Contact: [PRIVACY EMAIL], [ADDRESS].

2. Information we collect

You give us

Business ownership information

If you claim a business and represent that it is Black-owned, we record that you made that representation, the date, and the account that made it. Depending on the verification tier you request, we may also review supporting documents (see our Verification Policy).

We treat this as sensitive information. We collect it only to operate the directory as described, we do not use it for any other purpose, we do not sell or share it, and we restrict internal access to staff who need it. Where we review a document to confirm a representation, we record only the outcome of that review and do not retain the document itself beyond the review, unless you ask us to keep it on file for renewal.

Providing ownership information is voluntary. You can list a business on BuildBLK without it.

Collected automatically

• Device and usage data: IP address, browser and device type, pages viewed, referring page, timestamps.
• Approximate location: derived from your IP address, to show nearby businesses.
• Precise location: only if you explicitly grant browser location permission. You can revoke this at any time in your browser settings.
• Cookies and similar technologies: see Section 7.

From other sources

• Public business information (name, address, phone, hours, website) from public records, business websites, and partner organizations, used to seed unclaimed listings.
• Mapping and place data from third-party providers, used and stored only as their terms permit.
• Partner organizations such as chambers of commerce, where a business has consented to the sharing.

3. How we use information

• Operate, maintain, and improve the Service
• Create, display, and keep listings current
• Authenticate accounts and process business claims
• Verify business representations and administer the Verified designation
• Display reviews and moderate content
• Respond to support, dispute, and takedown requests
• Send transactional email (account, claim status, verification renewal)
• Send newsletters or updates only if you opt in — unsubscribe any time
• Produce aggregated, de-identified statistics about directory usage, and share those with funders, partners, and the public
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not use your personal information to train machine learning models, and we do not use it for behavioral advertising.

4. How we share information

We share personal information only as follows:

• Publicly, by design. Anything you post — reviews, photos, your display name, listing content — is public. Do not post anything you want kept private.
• With business owners. If you review or contact a business, the owner sees your review and display name. We do not give businesses your email address unless you send it to them.
• With service providers who work on our behalf under contract: hosting, database, email delivery, error monitoring, image storage, analytics. They may use the data only to provide services to us.
• With partner organizations, in aggregated or de-identified form only, unless you have separately consented.
• For legal reasons: to comply with law, a subpoena, or a valid legal request; to enforce our Terms; or to protect the rights, property, or safety of anyone. Where legally permitted, we will notify you before disclosing your information in response to a legal request.
• In a reorganization. If we merge with or transfer assets to another nonprofit, information may transfer, subject to this policy. In a dissolution, we will delete personal information rather than transfer it to a for-profit entity.

We have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months, and we do not intend to.

5. Your rights

Regardless of where you live, you can:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account and personal information
• Export your data in a portable format
• Opt out of marketing email
• Object to certain processing

California residents additionally have rights under the CCPA/CPRA to know the categories and specific pieces of personal information collected, the sources, the business purpose, and the categories of third parties it is disclosed to; to delete; to correct; to limit the use of sensitive personal information; and to not be discriminated against for exercising any of these rights.

To exercise any right, email [PRIVACY EMAIL] or use the controls in your account settings. We will respond within 45 days (extendable once by 45 days, with notice). We may need to verify your identity first. You may use an authorized agent.

Note for the record: we are likely below the CCPA's applicability thresholds ($25M revenue / 100k consumers / 50% revenue from data sales) at launch. We are honoring these rights as a matter of policy regardless, and the technical plumbing is built in from the start.

6. Retention

• Account data: while your account is active, then deleted within 90 days of account deletion.
• Reviews and public content: we may retain them in de-identified form after account deletion, so businesses do not lose their review history. Tell us if you want a review removed entirely and we will remove it.
• Verification records: for the life of the designation plus three (3) years, so we can respond to disputes about badges we issued.
• Support and dispute correspondence: three (3) years.
• Server logs: 30 days, except where retained longer for a security investigation.
• Backups: rolling, purged within 90 days.

7. Cookies

We use:

• Strictly necessary cookies — login sessions, security. These cannot be turned off.
• Preference cookies — remembering your city, language, and display settings.
• Analytics — privacy-respecting, aggregate-only measurement of how the Service is used.

We do not use third-party advertising or cross-site tracking cookies. We honor Global Privacy Control (GPC) signals.

You can control cookies through your browser settings, though disabling necessary cookies will break login.

8. Security

We protect information with encryption in transit (TLS) and at rest, hashed passwords, role-based access controls, least-privilege database access, audit logging of access to sensitive records, and regular dependency and security updates.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the California Attorney General as required by law, without unreasonable delay.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Account creation requires being 18 or older. If we learn we have collected information from a child under 13, we will delete it. Contact [PRIVACY EMAIL] if you believe this has happened.

10. Where we operate

We operate in the United States, and information is stored and processed here. If you use the Service from outside the U.S., you understand that your information will be transferred to and processed in the United States.

11. Changes

We will post updates here with a new "Last Updated" date. For material changes, we will give at least 30 days' notice by email where we have your address, and we will not apply materially different uses to previously collected information without your consent.

12. Contact

Privacy questions or requests: [PRIVACY EMAIL]

Mail: [LEGAL ENTITY NAME], [ADDRESS]

California residents may also contact the California Privacy Protection Agency or the California Attorney General.