Privacy Policy

1. Who we are and what this covers

CityBeat Magazine publishes citybeatmag.co — bilingual local news for El Paso County and southern New Mexico, a business directory, advertising and sponsorship, a jobs board, and email newsletters. This policy describes what we collect across all of it, who it goes to, and how long we keep it. Where it says "we", that means CityBeat Magazine.

2. Information you give us

• Contact details you type into a form: name, email address, phone number, business name and address.
• Account information when you sign in, including your email address and, if you turn it on, two-factor authentication settings.
• Business listing content you submit or edit: description, hours, photos, links, deals and events.
• Messages you send us — contact forms, lead and quote requests, replies to our emails.
• Payment details are entered on Stripe’s own hosted checkout page. We never receive or store your full card number.

3. Information collected automatically when you visit

• Page views: the page path and the date. We do not store your IP address with a page view, and this measurement does not set a tracking cookie.
• Your IP address is used in the moment — to apply rate limits that keep the site up and to exclude staff and test traffic from our numbers. Rate-limit counters that include an IP are deleted about a day after the window closes.
• A sign-in session cookie (named __session) when you have an account. It is required for the site to know you are logged in.
• Google Analytics 4 and PostHog product analytics, when they are enabled for the site. These are operated by those companies under their own privacy policies and may set their own cookies.

4. What happens to what you type into the chat assistant

The chat assistant on citybeatmag.co is powered by Claude, an AI service operated by Anthropic. What you type is sent to Anthropic to generate a reply. A trimmed copy of the conversation (up to 500 characters of your message and of the reply) is stored so we can follow up on sales enquiries, and a separate audit record of AI prompts and outputs is kept so we can show how an automated decision or an automatically written article was produced. Both are deleted after 180 days. Please do not type anything into the chat that you would not want stored — health details, government identifiers, passwords, or confidential business information do not belong there.

5. AI and translation

CityBeat uses AI beyond the chat assistant: news briefs are drafted by Claude from public local reporting and reviewed by a person before publishing, marketing drafts are generated for listing owners to approve, and English and Spanish versions of content are produced by machine translation (DeepL, with Claude as a fallback). Text submitted for these purposes is processed by those providers, and the same 180-day AI audit record described above applies.

6. Business information we collect from other sources

Many directory listings were not submitted by their owner. We compile business information from public and third-party sources so the directory covers the region, and a business can then claim and correct its own listing.

• Public government records — for example Texas state licence registries for trades and professions. Where a licence is held by an individual in their own name, that individual’s business name and business contact details can appear as a listing.
• Chamber of commerce and association member directories, event listings, and other public business directories.
• The business’s own website: we read publicly posted contact pages and may store a published business email address.
• If you are named in a listing and want it corrected or removed, see section 9. You do not have to claim the listing first, and there is no charge for removal.

7. Email, tracking, and how to stop it

We send two kinds of email. Transactional messages — verification codes, receipts, billing notices, and reports to listing owners — relate to something you or your business bought or signed up for. Marketing messages — the newsletter, outreach about claiming or upgrading a listing, offers, and abandoned-checkout reminders — are advertising.

• Marketing messages contain a 1×1 image and link redirects that record whether the message was opened and which links were clicked, so we can stop contacting people who are not interested.
• Every marketing message carries an unsubscribe link and our postal address.
• Unsubscribing adds your address to a single suppression list that every one of our marketing systems checks before sending. It stops the newsletter, sales outreach, offers, and checkout reminders together.
• Unsubscribing stops email only. It does not remove a public business listing — ask us for that separately (section 9).

8. Who we share information with

We do not sell personal information and we do not share it for anyone else’s advertising. We use these service providers to run the site, and they receive only what their job requires:

• Stripe — payments, subscriptions, invoices, and payouts.
• Google Cloud and Firebase — hosting, sign-in, and the database where this information is stored.
• Anthropic (Claude) — chat replies, drafted content, and fallback translation.
• DeepL — English/Spanish translation.
• Our email providers (an SMTP host, SendGrid, or Resend) and, where enabled, Twilio for text messages.
• Cloudflare — edge delivery and the scheduled jobs that fetch news.
• Google Analytics 4 and PostHog — website analytics, when enabled.
• We also disclose information when the law requires it, and to protect the rights and safety of CityBeat, our customers, and the public.
• When we publish to social platforms (for example Facebook), we post CityBeat content only — not your personal information.

9. Your choices: access, correction, and deletion

Use the contact page at /contact and choose "My data" — that reaches a person directly and starts the clock immediately. You can also write to contact@citybeatmag.co with "Privacy request" in the subject line. Tell us what you want: a copy of what we hold about you, a correction, deletion of your personal information, or removal of a business listing that names you. Requests are handled by a person — there is no automated self-service portal — and we aim to respond within 30 days. We may ask you to confirm that you control the email address, phone number, or listing in question, so that we do not act on someone else’s behalf by mistake. You can also unsubscribe from any marketing email using the link in that email. Some records must be kept even after a deletion request, including the payment and tax records Stripe and the law require us to retain.

10. How long we keep information

• Chat assistant conversations: 180 days.
• AI prompt-and-output audit records: 180 days.
• Page-view analytics: about 13 months.
• Rate-limit records that include an IP address: about one day after the limit window ends.
• Account, listing, subscription, and payment records: for as long as the account or listing is active, and afterwards for as long as tax, accounting, and dispute-resolution obligations require.
• Unsubscribe records are kept permanently — that is what makes an unsubscribe stick.

11. Security

Access to the administrative systems requires a verified account, and staff accounts require two-factor authentication. Payment card data is handled by Stripe and never touches our servers. No system is perfectly secure and we do not claim otherwise; if a breach affects your information we will notify you as the law requires.

12. Children

CityBeat is a general-audience local news service, is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, write to contact@citybeatmag.co and we will delete it.

13. Changes to this policy

When what we collect or share changes, this page changes with it and the date below is updated. Material changes will be announced on the site.

14. Contact us

Questions about this policy, or a privacy request: contact@citybeatmag.co — CityBeat Media Group, El Paso, Texas, USA.