Privacy Policy

Who We Are

BlackKarat is operated by Hillstone Ventures LLC ("BlackKarat," "we," "us," or "our"). This Privacy Policy explains what information we collect when you use the BlackKarat mobile app (the "App") or our website at blackkaratapp.com (the "Site") — together, the "Services" — how we use it, and the choices you have.

Information We Collect

Account information: when you create an account in the App, we collect your email address and a password (stored by our authentication provider in hashed form — we never see or store your plaintext password). The Site does not have accounts.

Location: when you use the map or search features, the App requests your device's location to show nearby businesses. Your precise location is used only to perform that search and is not linked to your account or stored against your identity. We do retain an anonymized, non-identifying cache of recent search coordinates and query terms (not tied to any user or device) for a limited time to speed up repeated searches — this cache cannot be used to identify you. The Site does not request your location.

Content you submit in the App: if you submit a business listing, claim a business, upload photos, report an issue with a listing, or send us feedback, we collect what you provide — for example a business's contact and proof-of-ownership details, photos, or your feedback message — along with your account ID and the time of submission.

Information you send through the Site: the Site has three forms, and each collects only what it needs to act on your request. A listing request collects the business name and location, your name, your email, your relationship to the business, what you're asking for, and your description of the issue. An account deletion request collects your email address and, optionally, your reason. A support message collects your name, email, subject, and message. We email these to our support address, and we additionally record listing requests in our internal review queue so the request has a tracked status and an audit trail rather than living only in an inbox.

Push notification token: if you enable notifications, we store a device push token (provided by Apple/Google via Expo) tied to your account so we can deliver notifications such as submission status updates. You can disable this at any time in Settings.

Payment information: if you purchase promotional placement for a business, payment is handled by Stripe on its own secure checkout page. We do not receive or store your card number. We receive confirmation of the purchase along with the business and plan you selected.

Technical data from the Site: our hosting provider records standard server request logs, including IP address, browser user agent, and the pages requested, to deliver the Site and protect it from abuse. The Site also loads its fonts from Google's font service, which means your browser's IP address is visible to Google when a page loads.

We do not use third-party advertising trackers in the App or on the Site, we do not run analytics on visitors, and we do not collect data for ad-targeting purposes.

How We Use Your Information

We use your information to: operate your account and authenticate you; show you nearby businesses; process business submissions, claims, and reports (which are reviewed by a human moderator before taking effect); respond to requests you send through the Site's forms and track listing requests through to a decision; process and support purchases of promotional placement; send transactional notifications and emails (such as password resets or submission status updates); and maintain and improve the reliability and accuracy of the Services.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

AI-Generated Content

Some business descriptions displayed in the App are generated by an AI language model (Anthropic's Claude), based on information from the business's own public website. AI-generated descriptions are labeled internally as such, but we do not independently verify every detail of AI-generated text for accuracy. If you are a business owner and believe your listing's description is inaccurate, you can claim your business to correct it, or contact us.

How Business Listing Data Is Sourced

Business listings are compiled from publicly available sources, including Google's Places API and other publicly available business data, supplemented by user submissions and owner claims. This data may include business names, addresses, hours, ratings, photos, and reviews as made publicly available by those sources. Businesses named on the Site are drawn from that same directory.

Third-Party Services

We rely on the following third-party services to operate the Services. Each is bound by its own privacy policy, which we encourage you to review:

• Supabase — authentication, database, and backend hosting.
• Cloudflare — hosts the Site and processes its request logs.
• Google Maps Platform / Places API — maps, business location data, and place details.
• Google Fonts — serves the typefaces used on the Site.
• Anthropic (Claude) — generates certain business descriptions from public website content.
• Resend — delivers our transactional and support email.
• Stripe — processes payments for promotional placement.
• Expo — delivers push notifications to your device.

Data Retention

We retain your account information for as long as your account is active. Business submissions, claims, reports, and feedback are retained as part of our moderation records, even after a decision is made, so we can maintain an audit trail and prevent abuse. Requests and messages sent through the Site's forms are retained the same way: listing requests as moderation records, and support and deletion requests in our support email records. Anonymized search cache data is periodically purged and is never tied to your identity.

Account Deletion

You may delete your account at any time from Settings, or by emailing [email protected], or via our account deletion form. Deleting your account permanently removes your profile, favorites, push notification token, and feedback history, and cannot be undone. Business listings you submitted or claimed remain in the directory (since they describe a business, not you), but are no longer associated with your account.

Your Privacy Rights

Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information, and to know what categories of information we collect and why. We do not sell personal information, as that term is defined under state privacy laws such as the California Consumer Privacy Act. To exercise any of these rights, contact us at [email protected] — we will respond within 30 days, or sooner where required by law. We will not discriminate against you for exercising these rights.

Data Security

We use industry-standard safeguards, including encryption in transit and access controls on our backend, to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Children's Privacy

BlackKarat is not directed at, and may not be used by, children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have done so, we will delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will update the "Last updated" date above and, for significant changes, notify you by email or through a notice in the Services. Continued use of the Services after changes take effect constitutes acceptance of the revised policy.

Contact Us

Questions about this Privacy Policy or your data? Contact us at: [email protected]