1. Who we are
The Blk Community (the "Service") is operated by Midas Touch Group LLC. When we say "we", "us", or "our", we mean Midas Touch Group LLC. Contact us anytime at hello@theblkcommunity.com.
2. Information we collect
We collect only what we need to run the Service:
- Account info: name, email, and (if you sign in with Google) the profile photo Google returns. If you sign up with email + password, we store only a one-way bcrypt hash of the password — never the password itself.
- Business info: anything you or your business enters (name, description, category, address, hours, product listings, logo/photos).
- Transaction info: order line items, shipping addresses, and payout status. Card numbers never touch our servers — see §5.
- Analytics: aggregate page views, referral clicks, coarse device type. We use both Google Analytics 4 and a lightweight first-party counter. IPs are truncated before storage.
- Support chat: transcripts of any conversation you have with our AI assistant so we can escalate to a human ticket if needed.
3. How we use it
- To operate the directory, marketplace, and payouts.
- To send transactional email (order confirmations, claim approvals, weekly digests you opted into) via Resend.
- To calculate referral rewards (TBC Points).
- To detect fraud and abuse.
We do not sell your personal information. We do not share your email with third-party marketing lists.
4. Who we share it with
Only the vendors required to run the platform:
- Stripe & PayPal — payment processing. We store an internal order ID; card data lives with them, not us.
- Resend — outgoing transactional email.
- Google (OAuth, Places, Analytics) — social login, business verification, and coarse traffic analytics.
- Emergent — hosting and AI (chat / OCR / image generation) via the Emergent LLM Key.
We disclose information when compelled by valid legal process. We'll always try to notify you first if we're legally allowed to.
5. Payments — we never see your card
All card payments run through Stripe or PayPal. When you check out, your card details go directly to those processors over TLS and we receive only a token + the amount paid. No card number, CVC, or expiry is ever stored on our servers or in our database. Refunds are issued through the same processor.
6. Security
- Passwords are hashed with bcrypt (cost factor 12) — never stored, transmitted, or logged in plaintext.
- Sessions use signed HTTP-only cookies; a fresh token is issued on every login.
- All API endpoints require authentication + role checks; admins can only be assigned by an existing admin.
- MongoDB is our source of truth. Row-level access is enforced by our API — clients never talk to the database directly, so there are no client-side security rules to misconfigure (unlike Supabase or Firebase).
- Automated daily backups; encryption at rest and in transit.
7. Your rights
Regardless of where you live you can email hello@theblkcommunity.com to:
- Access a copy of your data.
- Correct or update anything inaccurate.
- Delete your account and every business profile you own.
- Opt out of any non-transactional email.
We aim to respond within 30 days.
8. Cookies
We use a small number of first-party cookies for login sessions and analytics. Third-party cookies come from Google Analytics 4. You can block cookies in your browser without breaking core functionality (you just won't stay signed in).
9. Children
The Service is not directed at children under 13. If you believe a child has provided personal information to us, contact hello@theblkcommunity.com and we'll delete it.
10. Changes
We'll post any material changes here and update the "Last updated" date. For meaningful changes we'll also email active accounts.
11. Contact
Midas Touch Group LLC
Email: hello@theblkcommunity.com
