Your data, your choices.

We Are Black America ("WABA," "we," "us," or "our") operates a digital platform connecting Black-owned businesses, consumers, and communities throughout the United States.

We collect information to operate, improve, and secure our platform.

Personal information

Name, email address, profile information, account credentials, and other information you provide during account creation or profile updates.

Business information

Business name, location, contact information, business category, and other business-related details.

Usage data

Log files, device identifiers, IP addresses, pages visited, actions performed, and interactions with the platform.

Content you provide

Reviews, posts, comments, messages, uploaded media, AI assistant conversations (when you are signed in), support tickets, and other user-generated content.

Analytics data

Data about how you use our services, collected via cookies and analytics providers.

Location data

General location (such as city/state) based on your device or IP address. Saved places and room locations, when you use those features, are limited to WABA businesses, events, and organizations — not home, work, or arbitrary addresses.

Payment information

When you subscribe to a paid plan or buy a ticket, our payment processor (Stripe) collects and processes your payment details. We do not store your full card number — we retain only a payment-processor customer and subscription identifier, your plan and subscription status, and billing amounts.

We use your information to:

• Provide and improve our services and user experience.
• Communicate with you about your account, updates, or support requests.
• Send marketing or newsletters only if you have opted in.
• Display business listings and enable community engagement features.
• Analyze usage and trends to improve our platform.
• Protect the security and integrity of our platform.
• Comply with legal obligations and enforce our terms.

We may share your information as follows:

Service providers

Trusted third parties who help us operate, host, or analyze our platform — including cloud infrastructure, analytics providers, and email delivery services.

Legal authorities

If required by law, subpoena, or to protect rights, property, or safety of users or others.

Payment processors

We share billing information with Stripe to process subscription and ticket payments. Stripe handles your card details under its own privacy policy; we never receive your full card number.

Other users

If you submit reviews, comments, or other content, it may be visible to other users on the platform.

We rely on trusted third parties to operate WABA. Each processes only the information needed for its function and is bound by contractual privacy obligations. Our principal providers include:

We may add or change providers as our services evolve; this list reflects our current principal providers.

Infrastructure & hosting

Convex (database and backend) and Vercel (web hosting).

Payments

Stripe (subscription and ticket payment processing).

Analytics

Google Analytics and Vercel Analytics (usage analytics, loaded only after you consent).

Email

Resend (transactional and notification email delivery).

Maps & location

Mapbox and Google Maps (map rendering and place data).

AI features

Anthropic, OpenAI, and OpenRouter process prompts and replies so the assistant can respond. See “AI assistant” below. We have not finished independent confirmation of each provider’s training and retention terms, and we will update this notice when that confirmation is complete.

Authentication

Google and Apple (sign-in).

Content & media

Contentful (editorial content) and LiveKit (live audio rooms). See “Live audio rooms” below.

When you are signed in, we store your AI assistant conversations against your account so you can continue them. We keep a conversation for 365 days from its last activity, with a cap of 100 unpinned conversations plus up to 25 pins. Pins do not extend the 365-day limit. Guests are not persisted to an account.

WABA does not use your conversations to train WABA-owned models, and we do not silently copy production conversations into evaluation datasets. Named providers (Anthropic, OpenAI, OpenRouter) receive the prompt and generate the reply. We apply the contractual and technical no-training controls those paths support. Independent confirmation of each provider’s training and retention terms is not finished. Until that confirmation is published here, we will not expand how long we keep conversations by default beyond the lifecycle in this section.

Live audio is carried by LiveKit. We do not store the audio recording. Transcription is off by default and only runs when a host turns it on for a session. When it is on, we transcribe the speech of consenting participants — a speaker must explicitly agree before their microphone is live in a transcribed session; declining keeps you in the conversation as a listener.

Who can read a transcript: the host of that conversation and the people who were participants in it. Nobody else — not other members of the Room, not the public, and it is never indexed or shown to search engines. After the conversation, the host may share its written recap (not the transcript) with members of this room.

Retention: a transcript follows the same 365-day lifecycle as other conversation content in this policy, then it is deleted.

Processing: transcription is performed by our speech-to-text provider, Deepgram, under Deepgram's data processing terms. We opt every transcription stream out of Deepgram's model improvement program, so your conversation audio and text are not used to train its models.

Deletion and export: leaving a conversation does not change its transcript. If you withdraw your consent during a transcribed conversation, or delete your account, we remove your name and account link from the lines you spoke — the words remain attributed to "Former participant" so the conversation still reads correctly for the people who were in it, but they are no longer tied to you. Other participants' words remain unaffected. Your own data export includes the utterances you spoke while transcription was on. If applicable law requires deletion of the words themselves, we will update this notice and the product to match.

We send marketing and newsletters only if you have given an affirmative opt-in, which we record with a timestamp. You can withdraw that opt-in from account settings or the unsubscribe link. A withdrawal blocks marketing and newsletter sends to that address. Approving a business listing does not enroll its contact address. We do not send SMS.

Security and transactional mail (account verification, billing, entitlement-loss notices) is sent because of the account or paid plan and is not suppressible as marketing.

Support and contact-form correspondence is kept under the same 365-day ceiling, account-deletion rule, and export path as conversations. When you submit a form, the first email you receive is an automated acknowledgment. It is not written by our AI assistant.

We use analytics services (such as Google Analytics and Convex) to understand how users interact with our platform. These services may use cookies or similar technologies to collect data about your device and usage patterns.

You have the following rights regarding your personal information:

Access and correction

You may view and update your profile information by logging into your account.

Data deletion

You may request deletion of your account and personal data by contacting us or using the "Delete My Account" feature in your profile. You may also delete individual AI assistant conversations.

Data portability

You may request a copy of the personal information we have collected about you, including AI assistant conversations when export is available in your account.

Opt in and withdraw marketing

We send marketing and newsletters only if you opt in. You can withdraw that opt-in at any time from Account Settings or the unsubscribe link in the email.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights regarding your personal information. We do not sell your personal information, and we have not sold it in the preceding 12 months.

To exercise any of these rights, email support@weareblackamerica.com or use the tools in your Account Settings. We will verify your request and respond within 45 days.

Right to know

Request the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we share it.

Right to delete

Request deletion of the personal information we have collected from you, subject to certain legal exceptions — also available through the "Delete My Account" feature.

Right to correct

Request correction of inaccurate personal information we maintain about you.

Right to opt out of sharing

Opt out of the sharing of your personal information for analytics and cross-context advertising. We load analytics only after you grant consent; you can withhold or withdraw it at any time through the cookie banner or by disabling Analytics Tracking in Account Settings, and we automatically honor Global Privacy Control (GPC) browser signals.

Right to non-discrimination

We will not deny you services, charge you a different price, or provide a different level of service because you exercised any of these rights.

Authorized agents

You may use an authorized agent to submit a request on your behalf. We may require verification of your identity and of the agent's authority to act for you.

We use industry-standard security measures to protect your data, including:

• Encryption of data in transit and at rest.
• Limiting data access to authorized personnel.
• Regular security reviews and monitoring for unauthorized access.
• Policies and procedures for prompt response to data breaches or security incidents.

Account profile data is kept while your account is active. AI assistant conversations, audio-room transcripts, and support correspondence are kept for 365 days from last activity, then deleted from our active systems, unless you delete them sooner. You can export that data from your account.

When you delete an account or a conversation, we remove the content from active systems immediately. Encrypted backups held by our infrastructure provider (Convex Cloud) may persist for that provider’s then-current backup window. We will publish that period here once Convex confirms it in writing.

We may retain a limited record of a deletion (for example, an erasure receipt) without the conversation content, where we need it for security or legal record-keeping.

We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

We may update this policy from time to time.

We will notify you of material changes via email or in-app notice.

The effective date at the top of this policy will always show the latest version.