Privacy Policy

Who we are

The Water Street District Business Association (“WSDBA”, “we”, “us”) is a business association in Henderson, Nevada, United States. We are the controller of the personal information described here. You can reach us at members@wsdba.org.

The Member Portal is a members-only application. Apart from the public business directory described below, everything in it sits behind a login.

What we collect

Your account

When you join, or when an administrator creates your account, we store:

• Your name, email address and phone number.
• Your password, stored only as a one-way hash — we cannot read it.
• If you turn on two-factor authentication, an encrypted authenticator secret and your recovery codes.
• The date and time of your last sign-in.

Your business listing

Everything you enter on your listing is published publicly on purpose — a listing that search engines and customers can find is the membership benefit you are paying for. That includes your business name, tagline, description, logo, cover image, gallery photographs, video link, business contact email, business phone, website, street address and map location, opening hours, social profiles and the services you list.

Do not put anything on your listing that you would not want a stranger to read. If you would rather your listing were not visible while you decide, you can unpublish it from Dashboard → My listing at any time.

Enquiries from the public

When a visitor uses the contact form on your listing, we store the name, email address, phone number and message they submit, together with the sending IP address for abuse prevention, and we pass it to you. We hold that enquiry on your behalf so you can read it in your inbox in the portal.

Notifications

If you turn on notifications, we store the push token your browser or device issues. On the mobile apps that token comes from Apple or Google; in a browser it is the address of your browser vendor’s push service. It identifies the device, not you, and we use it only to deliver association announcements and new-enquiry alerts. Turning notifications off deletes the token.

Payments

Card numbers never reach our servers. Membership payments are processed by Stripe, and you enter your card details directly with them. What we keep is the record of the transaction: your Stripe customer and subscription identifiers, whether the subscription is active, when the current term ends, the card brand and last four digits so you can tell which card is on file, the amounts charged or refunded, and the receipt link.

Technical and usage information

• A session cookie that keeps you signed in, and a security token that protects forms against cross-site request forgery. Both are strictly necessary for the portal to work. We do not use advertising cookies and we do not run any third-party analytics or tracking scripts.
• An audit log of security-relevant actions on your account — signing in, changing your password, editing your account, exporting your data, deleting your account, and administrative changes — with the IP address and browser user-agent used.
• Aggregate counts for your own listing: how many times it was viewed, how many enquiries it received and how many people tapped call, directions or your website link. These are counts by day. We do not build a profile of the individual visitors who generated them.

Businesses that are not yet members

To keep the district map useful, we also hold records for Water Street businesses that have not joined: business name, address, category and an outreach contact we have gathered from public sources or from speaking to the owner. These outreach contact details are never published — only the business name, category and map pin appear publicly. If you own one of these businesses and would like the record corrected or removed, email members@wsdba.org and we will act on it.

Why we use it

• To run your membership: your account, your listing, your enquiries and your billing.
• To publish the member directory and the district map, which is the service you are buying.
• To send you association announcements, renewal reminders and receipts.
• To keep the portal secure — rate limiting, two-factor authentication and the audit log.
• To meet our tax, accounting and legal obligations.

Who we share it with

We do not sell personal information, and we do not share it for advertising. We use these service providers:

Provider	What it receives	Why
Stripe	Your name, email and payment details, entered directly with them	Processing membership payments
Our email delivery provider	Your name and email address, and the content of the message	Sending portal email — receipts, password resets, announcements, forwarded enquiries
Apple, Google and browser push services	Your device push token and the notification text	Delivering notifications you have turned on
Our email marketing service	Your name, email address and membership status	Keeping the association mailing list current. Every mailing carries an unsubscribe link.
Our hosting provider	Everything above, at rest on servers in the United States	Running the application and its database

We will also disclose information where the law requires it, or where it is necessary to protect the association, our members or the public.

Content embedded on public listing pages

A member’s public listing page can embed a Google map of their address and a YouTube or Vimeo video they have linked. Those embeds are loaded by the visitor’s browser directly from Google, YouTube or Vimeo, which means those companies see the visitor’s IP address and may set their own cookies under their own privacy policies. This happens on public listing pages only — never inside the signed-in member area.

How long we keep it

• Your account, listing and enquiries: for as long as you have an account with us.
• Enquiries from the public: kept with your listing, and deleted with it.
• Financial records: retained after your account is deleted, for as long as tax and accounting law requires. They are kept without your name, email or phone number attached — only the amounts, dates and the payment processor’s reference. That reference is deliberately retained: it is what lets us match a record to a real charge if you or a tax authority ever query one. It is a key in Stripe’s system, so please read it as pseudonymous rather than anonymous — Stripe, and we by asking Stripe, could still match such a record back to you.
• Audit log entries: retained as a security record. When you delete your account we go back through the entries that name you and strip your name, email address, phone number and IP address out of them, so what remains is the action and its date rather than who performed it.
• Mailing-list delivery log: we keep the record that a sync to our email marketing provider happened, because staff read it when a mailing misbehaves. Your name, email address and phone number are stripped out of it when you delete your account.

Deleting your account

You can delete your account yourself, from inside the portal and inside the mobile apps, at Dashboard → Account → Delete account. Full detail of what is erased and what is retained is on the account deletion page.

In short: deletion is immediate and cannot be undone. Your public listing comes down, your photographs and enquiries are erased, any active membership subscription is cancelled so you are not billed again, and your name, email address and phone number are removed from our records. Deleting your account does not refund the remainder of a paid membership term.

Three things are worth knowing before you do it, and each is covered in full on the account deletion page:

• The district map pin is not deleted with your listing. Everything that identifies you — logo, photographs, description, contact details — is erased, and the pin reverts to an unclaimed Water Street business showing only the business name and its category, as it was before you joined, so the address can be claimed again later. Email us if the business has closed and you want it taken off the map entirely.
• The mailing list is a separate company. We ask our email marketing provider to remove you the moment you delete, but we cannot guarantee how fast it acts on that request. Every mailing carries an unsubscribe link that takes effect immediately.
• Association staff accounts are the one exception. An account holding a staff role cannot be self-deleted, because that would take the association’s own administrative access with it. The panel says so on screen; email members@wsdba.org and the owner removes the role, after which the same erasure is carried out for you.

Your rights

• See and export your data. Use Dashboard → Account → Export my data to download, as a JSON file and without asking us, your account details, your listing and its photographs, every enquiry the public has sent you, your listing’s daily view counts, your subscription and payment records, the devices you have notifications turned on for, and the audit entries that name you. For security it excludes your password (kept only as an irreversible hash), your two-factor secret, and the encryption keys belonging to each notification device.
• Correct it. Edit your account and listing directly in the portal.
• Delete it. As described above.
• Opt out of the sale of personal information. Under Nevada law you may direct a business not to sell your covered information. We do not sell it and have no plans to, so there is nothing to opt out of — but you can email us to record the request anyway.
• California residents may request the categories and specific pieces of personal information we hold, request deletion, and not be discriminated against for exercising either right. The export and deletion tools above satisfy the first two immediately; email us for anything further.

To exercise any right we have not automated, email members@wsdba.org.

Security

The portal is served only over HTTPS. Passwords are hashed, two-factor secrets are encrypted at rest, and two-factor authentication is available to every member and required of administrators. Sign-in attempts and other sensitive endpoints are rate limited, and privileged actions are written to an audit log. No system is perfectly secure; if we ever discover a breach affecting your personal information we will notify you as the law requires.

Children

The Member Portal is a tool for business owners and is not directed to children. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, email us and we will delete it.

Changes to this policy

If we change how we handle personal information we will update this page and move the “last updated” date at the top. Material changes will also be announced to members in the portal.

Contact

Water Street District Business Association
Water Street District, Henderson, Nevada, United States
members@wsdba.org