Privacy Policy
What the Babcock Ranch Directory collects, why we collect it, how long we keep it, and how to get it changed or deleted.
Who We Are and What This Covers
The Babcock Ranch Directory ("we," "our," or "us") operates babcockranchdirectory.com — a local business directory, events listing and community newsletter for Babcock Ranch, Florida. This policy covers the website and the emails we send. It does not cover the businesses listed in the directory, who handle any information you give them directly under their own policies.
A companion Cookie Policy lists every cookie and browser-storage key the site sets.
Information We Collect
Grouped by how it reaches us.
Account information
You can create an account with an email address and password, or by signing in with Google.
- • Email and password sign-up: your name, email address, and a password that is stored only as a salted scrypt hash — never in readable form.
- • Google sign-in: your name, email address, Google account identifier and Google profile photo URL, as released to us by Google when you approve the sign-in.
- • An account role (visitor, business owner, or administrator) that controls what you can edit.
Business listings and claims
- • Listing details you submit or edit: business name, address, phone, email, website, hours, categories, description, and photos.
- • Claim requests: your role at the business, the reason for the claim, and the business email or phone we use to verify it.
- • Records of who claimed which listing, and when, so ownership can be audited.
Newsletter
Your first name and email address, submitted through the signup form in our footer. Signup is double opt-in: we pass your address to Kit (ConvertKit), which emails you a confirmation link. You are not added to the list until you click it. Newsletters are delivered through Resend.
Messages you send us
Our contact form collects your name, email address, subject, message, and optionally a phone number, and emails them to our inbox. Reviews, comments and community posts you submit are stored with your account.
Usage analytics (first-party)
We run our own analytics rather than selling or syndicating your behaviour. Each event we record can include:
- • The page viewed — URL, page title, and the page you arrived from.
- • Listing interactions — phone, website, directions, email, social, menu and booking clicks on a business listing.
- • Searches you run and how many results came back.
- • Engagement actions — favouriting, sharing, submitting a review, uploading a photo.
- • A random session identifier that expires when you close the tab, and your user ID if you are signed in.
- • Device and browser characteristics — device type, browser name and version, operating system, screen resolution, viewport size.
- • Campaign attribution from utm_ parameters in the link you followed.
- • Your IP address, recorded by our server when the event arrives.
You can switch this off — see Your Choices below.
Payments
Paid placements and subscriptions are processed by Stripe. Card numbers are entered on Stripe's systems and never reach our servers. We store the Stripe customer, subscription and payment identifiers needed to know what a business has paid for and when it expires.
Why We Use It
- • Run your account — sign you in, keep you signed in, and decide what you may edit.
- • Publish and maintain the directory — display listings and events, and verify that a person claiming a business is connected to it.
- • Send the newsletter and service email — the weekly newsletter you confirmed, plus transactional messages such as password resets and claim outcomes.
- • Understand what the directory is used for — which listings and categories get attention, so we know what to improve, and so business owners can see traffic to their own listing.
- • Take payment for featured and sponsored placements.
- • Keep the site working and honest — rate limiting, spam and abuse prevention, moderation, and debugging.
- • Meet legal obligations where they apply to us.
What Is Public, and Who Else Sees Your Data
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
Published publicly
- • Business listing details, including the business address, phone, email and website you supply.
- • Reviews, comments and community posts, with the display name on your account.
Business contact details are published as business contact details. If you list a personal phone number or home address, it becomes public.
Service providers who process data for us
- • Google — OAuth sign-in, and Google Places data (business names, addresses, hours, ratings and photos) shown on listings.
- • Kit (ConvertKit) — newsletter list and double opt-in confirmation.
- • Resend — delivery of newsletters and transactional email.
- • Stripe — payment processing for paid placements.
- • Sanity and Cloudinary — content storage and image hosting for listing photos.
- • MongoDB — the database behind accounts, analytics and the newsletter suppression list.
Each of these has its own privacy policy and handles your data under our instructions.
We may also disclose information where the law requires it, or where it is necessary to investigate abuse of the site.
How Long We Keep It
- • Account information — kept while your account exists. Ask us to close it and we delete the account record; see below.
- • Business listings — kept for as long as the listing is published. Once removed, we may retain a record that the listing existed and who claimed it.
- • Newsletter — your subscription is kept until you unsubscribe. Your address then stays on a suppression list indefinitely, precisely so that we do not email you again.
- • Contact form messages — these arrive as email in our inbox and are kept with our normal correspondence.
- • Analytics events — retained to produce traffic reporting for the site and for individual listings. We do not currently expire them on a fixed schedule; you can ask us to delete events tied to your user ID.
- • Payment records — kept as long as needed for accounting and tax purposes. Stripe retains its own records under its own policy.
Your Choices
Stop the newsletter
Every newsletter carries a one-click unsubscribe link, and supports the unsubscribe button built into mail clients such as Gmail and Apple Mail. Unsubscribing does two things: it removes you from the list at Kit, and it adds your address to our own suppression list, which we check before every send. You do not need an account, and you do not need to contact us.
Turn off analytics
Choose Essential only on the cookie banner and our analytics does not start — no page views, no listing interactions, no events of any kind are sent. Your choice is stored in your browser, so make it again on each browser or device you use, and after clearing site data. The Cookie Policy explains how to change your mind later.
Edit your listing
If you have claimed a business, you can correct its details yourself from your dashboard at any time.
Access, Correction and Deletion Requests
These rights apply to everyone who uses the site, wherever you live.
You can ask us to:
- • Tell you what personal information we hold about you, and give you a copy of it.
- • Correct anything that is wrong.
- • Delete your account and the personal information attached to it.
- • Remove or unpublish a listing associated with you.
- • Stop sending you email.
How to make a request
Email brdirectory@cruxnyc.com with the subject line Privacy request, or use our contact form and choose the same subject. Tell us what you want done and include the email address on your account or listing so we can find your records.
We aim to acknowledge within 5 business days and complete the request within 30 days. If we need more time or need to verify your identity first, we will say so in the acknowledgement.
Some information survives a deletion request: suppression-list entries (kept so we do not email you again), and records we are required to keep for accounting or legal reasons. We will tell you if that applies to your request.
Security
No system is perfectly secure, but these are the measures we take:
- • The site is served over HTTPS.
- • Passwords are stored as salted scrypt hashes and compared in constant time.
- • Session cookies are HTTP-only and marked Secure in production, so scripts cannot read them.
- • Unsubscribe links are cryptographically signed, so nobody can unsubscribe someone else.
- • Signup and submission endpoints are rate-limited.
- • Administrative functions are restricted to accounts with the administrator role.
Children's Privacy
Our services are not directed to children under 13, and we do not knowingly collect personal information from them. If you are a parent or guardian and believe your child has given us personal information, contact us and we will delete it.
Changes to This Privacy Policy
We update this policy when our practices change. Material changes are announced by posting the revised policy here and updating the "Last Updated" date above. Continuing to use the site after a change means you accept the updated policy.
Contact Us About Privacy
Questions about this policy, or about how we handle your information: