Legal
Privacy Policy
Effective October 27, 2026. Last updated October 27, 2026.
Who we are
The San Francisco Bay Area Hispanic Chamber of Commerce ("SFBAYHCC", "the chamber", "we") runs www.sfbayhcc.com. The site offers a directory of Bay Area businesses, an events calendar, articles, membership in the chamber and a government contracting program. Membership is open to all. The San Francisco Bay Area Hispanic Chamber of Commerce is a California corporation.
This policy covers the website and the services we run through it. It does not cover other websites we link to.
Questions about this policy: info@sfbayhcc.com, (415) 572-3568, 415 Mission Street, Floor 37, San Francisco, CA 94105.
The short version
- We hold business information to run the directory, and personal information only when you give it to us or choose to appear.
- We do not sell personal information, and we do not share it for advertising.
- The site sets no advertising or analytics cookies. It counts page views without identifying you.
- You choose which of our three newsletters you get, and you can change or stop them at any time on your email preferences page. The services that send our email record when our emails are opened and which links are clicked.
- Our AI receptionist is an AI. Its chats are kept for 90 days, and it never keeps your voice.
- You can ask us to show you, correct or delete what we hold about you.
What we hold, and where it comes from
Business listings. Most listings describe a business, not a person: its name, address, phone, website, category, hours and map location. A listing comes from one or more of these sources, and the page says which:
- public business records and directories, imported when the directory was built;
- research by the chamber, checked against public sources ("Verified by the chamber");
- the business owner, once the owner claims the listing or joins.
An imported record may include the name of a contact person at the business. We do not publish that name. A person appears on a listing only after they choose to.
Membership and event registration. When you join, claim a listing or register for an event, we hold your name, email address, phone number if you give it, the business you represent, your membership level, and the choices you make about what is public.
Payments. Membership payments are processed by Stripe: through HighLevel's billing, or, for a membership started with the AI receptionist, directly through the chamber's Stripe account, where you can also manage or cancel it (the page /membership/manage emails you a link to Stripe's billing page). Card details go only into Stripe's own fields; we never see or store your full card number. We keep the record that a payment was made, its amount and its date.
Contact form. What you type into the contact form, the topic you choose and the time you sent it go to HighLevel, our customer relationship system. If you tick the form's newsletter box, you are signed up for Chamber Announcements, as described below. If you came to the form from a page on our site, we note which page.
- Chamber Announcements. News from the chamber: programs, membership, the website and member spotlights.
- Newsroom Digest. Our News Desk explainers, Perspectives and Opinion on the laws and issues that touch Bay Area businesses.
- Events Digest. Chamber events and what our community partners across the region have on the calendar.
You can choose them on our sign-up page, with the contact form's newsletter box (Chamber Announcements only), or on your email preferences page. When you sign up on our site, we keep in HighLevel your email address, your first name if you give it, the newsletters you chose, the page you signed up from, and the date and time. Your record also keeps the words you agreed to: the sentence beside the box you ticked, with the names of the newsletters you added. Your email preferences page shows no such sentence, so for choices made there we record that you made them on that page, opened from your own email preferences link. We also tag your record for each newsletter you get and, if you were new to our records, note that your record came from our website. Each sign-up and each change you make on our site is noted on your record, so we keep the history of your choices.
The first time you sign up on our site, we send you one welcome email. If your address is already in our records, the sign-up page only adds newsletters: it never removes one, and it never replaces your name or other details you gave us before. If you unsubscribed from all chamber email before, signing up again does not turn your email back on or add a newsletter; we note the attempt on your record.
People who were on our earlier newsletter list now get Chamber Announcements, which replaced it. We may also email people already in our records once, to ask whether they want our newsletters. If they do not choose one within 14 days, we do not ask again.
Optional questions. After you sign up, and on your email preferences page, we may ask a few optional questions, at most three at a time. They cover:
- your first name and your organization;
- your role (for example, you own a business or work at a nonprofit);
- your county and your industry;
- the issues you follow (such as housing or taxes);
- the language you want our email in;
- how many people work at your business;
- what you would like to hear more about (such as membership or networking events).
You can skip any of them, and skipping changes nothing about your newsletters. These questions never ask for your phone number, your ethnicity, your citizenship or your immigration status. The language question asks only which language you want our email in. We use the answers to choose what to send you and, when you ask to hear more about something, to tell you about it. The answers are kept with your contact record in HighLevel. Answers given right after a sign-up only fill in details we do not already have. The email preferences page asks only questions you have not answered yet, and it never shows your earlier answers. To see, change or delete your answers, write to info@sfbayhcc.com.
Your email preferences page. Our newsletters carry your email preferences link, which opens your own email preferences page. There you can choose which newsletters you get, answer optional questions, unsubscribe from all chamber email, or come back after unsubscribing. The page shows only part of your email address. The link is signed, so it cannot be guessed, but it is personal: it identifies your record with us, it does not expire and it works without a password. If you forward one of our emails, the person you send it to can use the link to change your choices, including unsubscribing you or turning your email back on. We keep the link with your record in HighLevel so our emails can include it.
If you do not have your email preferences link, enter your email address on the email preferences page. If that address is in our records and can still receive our email, we email the link to it. The page gives the same answer whatever address you enter. To prevent misuse, we email at most three links a day to any one email address, and we limit how many requests one IP address can make in an hour.
Email activity. Our newsletters, and the other email we send through HighLevel, are delivered by Mailgun. Like most email services, HighLevel and Mailgun record whether our emails are delivered and opened (through a small image in the email) and which links in them are clicked. HighLevel also keeps your replies. If you turn off images in your email program, opens are not recorded. We use this to see which newsletters are read, and, when we invite people in our records to choose our newsletters, to decide whom we ask first. We also use it to stop sending newsletters to people who no longer read them. If for about 90 days we see no click or reply from you and you add no newsletter, we stop sending you newsletters. They start again when you choose them on your email preferences page.
Messages to members. A member's listing can carry a form for writing to that member. We send your name, email address, phone number if you give it, and your message to the member by email through HighLevel, and keep a record of the message so we can resend it or deal with abuse.
The AI receptionist. The chat and voice receptionist on our site is an AI, not a person.
- Chat. We keep the conversation (what you typed and what the receptionist answered) with a random session number, the language you used and a coded form of your IP address that cannot be turned back into the address on its own. Anything that looks like a card number or a Social Security number is removed before it is stored or sent to the AI. Please do not share sensitive information in the chat.
- Voice. If you start a call, your browser asks to use your microphone. Your speech is turned into text and the replies into speech by Cloudflare and Deepgram. We do not record or keep the audio. The written transcript is kept with the chat.
- Answers. The receptionist's replies are written by Anthropic's Claude, which receives the conversation to answer it.
- When you ask for something. If you ask the receptionist to pass on a message, book a call or send you information, the transcript of that conversation is saved with your contact record in HighLevel so the chamber team can follow up.
- Orders. If you start a membership with the receptionist, we keep the order: the level and price, the name, email and business you confirm on the order card, your agreement to the renewal terms (the words shown, the time and a coded form of your IP address) and what Stripe reports about the payment. When you confirm, your name, email and business go to Stripe for the checkout and to HighLevel so the chamber team can follow up. Anything that looks like a card or Social Security number is refused in the order card's fields.
Chats and call transcripts that are not passed to the team are deleted 90 days after the conversation's last message.
Technical records. To run and protect the site, our host Cloudflare processes each request (IP address, browser, page, time). When you open your email preferences page, the page address in these records includes your email preferences link. Cloudflare Web Analytics, a small script our host adds to our pages, also counts page views for us: the page, the page you came from, your browser, device type and country, and how fast the page loaded. It sets no cookies and leaves out the part of a page address after a "?" (so it never holds your email preferences link), and Cloudflare says it does not use your IP address or browser details to single you out. Some forms use Cloudflare Turnstile, which checks that a person, not a bot, is sending the form. We count each IP address's form submissions for one hour to stop abuse, using a coded form of the address. The email preferences page also counts, for each email address it can send a link to, how many links are asked for in a day, using a coded form of that email address. We delete these counts within about two days. Some links we send in outreach messages pass through a short link on our site that records the time, the link, the browser type and the page it was opened from, but not the IP address.
The site's own copy of what it sends to HighLevel. The site keeps its own record of what its forms send to HighLevel, for 90 days, so that a sign-up or a message is not lost if HighLevel is unavailable and so we can trace errors and abuse. For a newsletter sign-up it holds your email address, your first name if you gave it, the newsletters you chose, the page you signed up from and your answers to the questions that follow. For the email preferences page it holds what you did there and the newsletters you chose, but not your answers to its questions. For the contact form it holds everything you sent with it. Each record can also hold the ID of your record in HighLevel. The site also keeps each request for an email preferences link that passes the security check: the time, whether the address is in our records, and whether a link was sent or why not (for example, because the address unsubscribed from all chamber email). It keeps the address typed only when it is in our records; for any other address it keeps a coded form that cannot be turned back into the address on its own.
Fonts, maps and videos. Our typefaces are served from our own site. The maps on our listing pages, county pages and contact page are drawn by Google Maps and delivered through our own site, so your browser does not contact Google for them; it does if you open a map in Google Maps. Videos on our site come from YouTube in its privacy-enhanced mode. Their cover images are served from our own site, and nothing loads from YouTube until you press play; from then on, YouTube's own privacy policy applies.
Cookies and browser storage
The site does not set advertising or analytics cookies, and its pages carry no tracking pixels or advertising trackers. The page-view count described under Technical records uses no cookies. (Our emails are different: see Email activity above.) Cloudflare may set short-lived cookies to tell people from bots and keep the site secure. The receptionist keeps the session number and the visible chat in your browser's session storage, which is cleared when you close the tab. We do not currently respond to Do Not Track signals: the site does not follow you across other websites, and its page-view count identifies no one.
What we do with it
- Publish and maintain the directory, and let owners correct their own listing.
- Run membership: billing, renewals, member benefits and event registration.
- Send each of our newsletters (Chamber Announcements, the Newsroom Digest and the Events Digest) only to the people who chose it, and event notices to people who asked for them.
- Keep a record of your newsletter choices and consent, and email you your email preferences link when you ask for it.
- Use your answers to the optional questions to choose what we send you and, when you ask to hear more about something, to tell you about it.
- Use email activity to see which newsletters are read, to stop sending newsletters to people who no longer read them, and to decide whom we ask first when we invite people in our records to choose our newsletters.
- Answer your questions, by person or by the AI receptionist, and pass on messages you send to members.
- Keep the site secure and stop spam and abuse.
- Improve the receptionist by reviewing past conversations.
We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not give it to other companies for their own marketing.
Your choices, purpose by purpose
Being listed as a business is separate from being shown as a person. For people, each public use below is its own choice, and each can be withdrawn without affecting the others:
- a public page about you in the directory;
- appearing in the attendee list of an event you registered for;
- being suggested to other attendees as someone to meet;
- sharing your details with an event sponsor.
Nothing in that list is on by default.
Each newsletter is its own choice too, and you can change your mind at any time:
- To stop one newsletter, untick it on your email preferences page and save. You keep the others, and other email from the chamber, such as messages about your membership, payments or an event you registered for.
- To stop all chamber email, use the unsubscribe link in any newsletter or marketing email from us, or press "Unsubscribe from all chamber email" on your email preferences page. This turns off every newsletter and any other email we send you through HighLevel, including messages about your membership or an event you registered for. The page /membership/manage can then no longer email you a link either, so to manage or cancel your membership after that, write to info@sfbayhcc.com. Receipts that Stripe itself sends, for a membership billed directly through the chamber's Stripe account, are not affected.
- To come back after unsubscribing from all chamber email, use the email preferences link or the unsubscribe link in any email you had from us, or write to info@sfbayhcc.com. Signing up again on our site does not turn your email back on.
Changes on your email preferences page, and the unsubscribe link, take effect right away, though an email already on its way may still arrive. If you write to us instead, we act within 10 business days.
Correcting or removing a listing
If you own or represent a listed business you can claim the listing to correct it, or ask us to remove it: use the "Claim this listing" link on the listing, or write to info@sfbayhcc.com. We confirm that the request comes from the business, by email or a short call, and act on it within 30 days. A business that has closed is marked as closed or removed.
Your rights
Anyone, wherever they live, may ask us:
- what personal information we hold about them, where it came from and whom we shared it with;
- to correct it;
- to delete it, unless we must keep it, for example payment records we are required to keep.
Write to info@sfbayhcc.com. We may ask you to confirm your identity first. We answer within 45 days and do not treat anyone differently for asking. You may make a request through someone you authorize to act for you.
You can see and change your newsletter choices yourself, at any time, on your email preferences page. If the address is blocked from our email (by our team, or because a message to it bounced or was reported), the page cannot change it; write to us instead. To see, change or delete your answers to the optional questions, write to info@sfbayhcc.com. Unsubscribing does not delete your record; you can ask us to delete it.
California residents: we do not share personal information with third parties for their own direct marketing (California Civil Code section 1798.83).
Who processes data for us
These companies handle data on our instructions, for the purposes in this policy:
| Company | What it does for us |
|---|---|
| Cloudflare | Hosts the site and its database, protects it from attack and abuse, counts page views (Web Analytics), speech-to-text and text-to-speech for voice calls |
| Deepgram (through Cloudflare) | Speech recognition and voice for receptionist calls |
| Anthropic | Writes the AI receptionist's replies |
| HighLevel | Contacts, forms, newsletters, email preferences, answers to the optional questions, email (including records of deliveries, opens and clicks), member messages, membership billing |
| Mailgun (through HighLevel) | Delivers the email HighLevel sends for us, including the newsletters, and records deliveries, opens and clicks |
| Stripe | Card processing and membership billing, including the billing page where you manage or cancel |
| The chamber's own email (Google Workspace) and the map images on our site |
We may also disclose information when the law requires it, to protect people's safety or the site, or to a successor organization if the chamber merges or transfers its programs.
How long we keep it
| Record | Kept for |
|---|---|
| Business listings | As long as the business operates, or until the owner asks us to remove it |
| Membership and payment records | While the membership is active and 7 years after, for accounting and tax |
| Contact form submissions and member messages | 2 years |
| Newsletter choices, the record of your consent and your unsubscribe | With your contact record in HighLevel, until you ask us to delete it |
| Answers to the optional questions | With your contact record in HighLevel, until you ask us to change or delete them |
| Email activity (deliveries, opens, clicks and replies) | With our email history in HighLevel, until you ask us to delete your record; Mailgun keeps its own delivery records under its own policy |
| The site's own copy of what it sends to HighLevel, and requests for an email preferences link | 90 days |
| Receptionist chats and call transcripts | 90 days, unless passed to the team with a request |
| Receptionist orders not completed | 90 days |
| Completed orders and your agreement to the renewal terms | With the membership and payment records |
| Voice audio | Not kept |
| Form and link-request counters | About 2 days |
| Server request logs | A short period, under Cloudflare's own policy |
| Page-view counts (Cloudflare Web Analytics) | About 6 months, under Cloudflare's own policy |
Security
We limit access to the people who need it, encrypt data in transit, and keep card numbers out of our systems. No system is perfectly secure; if a breach affects your personal information, we will tell you as the law requires.
Children
The site is for businesses and the people who run them. We do not knowingly collect information from children under 13, and the receptionist is not meant for them.
Changes
We will post changes on this page and change the dates above: each version takes effect on the day it is posted. If a change affects what is public about you, we will ask first.
See also our Terms of Use.
