Privacy policy

This policy says what information CBOs of America holds, who can see it, how long we keep it and what you can ask us to do with it. It covers the website, the waitlist, the demo and the workspace. It applies in every state.

The short version: we do not sell personal information, we show no ads, and we run no advertising trackers. The signed in workspace has no analytics trackers at all; our public pages count visits with Google Analytics only if you allow it. A university cannot see who a student is unless the student's organization and the family both say yes.

1. Who we are

CBOs of America is a program of the William H. Douglas Foundation, a California 501(c)(3) nonprofit. When this policy says “we”, it means the foundation.

We hold information in two different roles.

• Student records belong to the organization.A community-based organization (CBO) or school decides which students it adds and what it records about them. We hold those records for the organization and use them only to provide the workspace. When the organization is a school, we act as a school official under the school's direct control, and the school's records stay the school's records.
• Account, waitlist, payment and website information is ours to look after. We decide how it is used, and this policy is our promise about it.

2. What we collect

About students

• Name, email, phone number if given, date of birth and preferred language.
• When a student takes part in a fly-in or another college visit program, the details the visit needs, recorded by the student's own organization: travel plans, an emergency contact, food and allergy needs, the overnight housing group, and whether the CSS Profile has been submitted (a status only, never the form). The university running the program sees these only after the organization tells it the student registered and the family has agreed to share the student's profile with that university. We never store passport or other ID numbers.
• School, grade, graduation year, home state, college goal and interests, and whether the student would be the first in their family to go to college.
• Student types an organization may mark: first generation, low income, rural, English learner, transfer, opportunity youth, adult learner and military connected.
• Academic records an organization may keep: a GPA band, a GPA, courses and grades, attendance, a graduation checklist and scholarships. A student can also enter their GPA and its scale (4.0 or 5.0), whether it is weighted, class rank, class size and up to ten awards. Staff can mark that record as checked. Awards are short text, and they are never part of the limited profile a university can search (section 8).
• Colleges a student saves to their list, and how far along each one is. College applications a student or staff member tracks: the entry term and year, the application plan (such as early decision or regular), deadlines, the date submitted, and the decision the student reports. Staff notes about an application are seen by staff only.
• Colleges a counselor recommends to a student, with the counselor's note. The student can keep or remove each one.
• Documents a student or staff member attaches to an application, such as a transcript, an essay or a resume.
• College cost estimates. These can include figures such as an expected family contribution or a grant amount, typed in as numbers.
• Work in the workspace: tasks, appointments, event sign ups, milestones, messages, notes written by staff, forms and typed signatures.
• Documents an organization or student uploads, such as a transcript or a resume.
• Activity logs an organization keeps, such as tours, school visits, events, partner contacts and programs. These can name students.
• Sharing choices, consent records and every release of a profile to a university.

Student information comes from the student, from a parent or guardian, and from the student's organization. Staff can type it in, import a spreadsheet, or connect a system the organization already uses. This means an organization can create a student's account and record before the student signs in for the first time.

About parents and guardians

• Name, email and relationship to the student.
• Consent choices, when each was made and how it was given: online, or on paper and recorded by the organization.
• The internet address and browser used to answer a consent link, kept as proof of who answered.

About staff and university recruiters

• Name, work email, phone number if given, role and organization.
• Messages in team channels, and the reason written on each request for student details.

About people in an organization's Contacts

• Donors, funders, board members, volunteers, mentors, sponsors, employers and partners that an organization records: name, email, phone, organization, role, region, notes, tags and tasks.
• Gifts, recurring gifts and grants, with amounts and dates, the status of each thank you, and what a grant has spent. For volunteers: sign ups, hours and shifts, and whether a background check was completed. We keep only the date and a yes or no, never the report.
• Emails an organization copies to its Contacts address. We keep the sender, the recipients, the subject and up to 1,500 characters of the message, on the timeline of each contact named in them. Only people already in Contacts are matched, so an email from anyone else is not kept.
• A link between a contact and one of the organization's own students, with a role such as mentor. Contacts are adults outside the student record. Staff should not add a student or a parent as a contact.

About organizations on the waitlist

• Organization name, website, state and the number of students served; the contact person's name, title and email.
• For a deposit: the amount, the date, a reference from Stripe, the sentence the payer agreed to and the time they agreed. Payment is taken on a page hosted by Stripe. We never see or store card numbers.

About organizations that publish a profile or visit times

• A school or CBO can publish a profile: its CEEB code (the code colleges use to identify a high school) and a one-page PDF. This describes the organization, never a student.
• Visit and fair times a school publishes, with the place and an optional note. When a college books a time, we keep its name, the time and the note it wrote. The school sees who booked. No student is named.

About people who try the demo

• Work email, organization name, a phone number, which demo roles you opened and when. From the email address we work out what kind of organization you are, so the emails we send fit you. We may call the number you give to follow up on your demo.
• We email you about what you tried and how to join, for a few weeks and then a few times over the following months. If you start to join and do not finish, we send a few reminders. Once you pay, you get only emails that help you get started. Every email has an unsubscribe link, and one click stops all of them.
• Which emails we sent and whether a button in one was used. We do not track when you open an email.

About everyone who uses the site

• An audit log of sensitive actions, such as signing in, changing a password, giving consent or reading a released profile. It records the time, the account and, for some actions, the internet address and browser.
• Short-lived records that stop abuse of forms. They hold an internet address or an email address and are deleted after 24 hours.
• What you send us through a public form: a claim for a directory profile, or a request made on our request form.
• Which version of our terms and this policy you agreed to, and when.
• What you send our team from the help button: a question, a bug report or a suggestion, with the page you sent it from and your browser type. If you are signed in we attach your name, email, role and organization. If you are not, we keep the name and email you type.
• Counts of how the help button is used: how often it is opened and which answers are read. These hold no name, account or internet address. When a question from a visitor or a staff member finds no answer, we keep its words so we can write one. We never keep the words of a question typed by a student or a parent. The help button uses a fixed set of written answers and matches your question inside your browser. It does not use artificial intelligence, and your question is not sent to anyone to be answered.

3. What we do not collect

• Protected traits. There is no field or filter for race, ethnicity, nationality, ancestry, immigration status, disability or justice involvement. Imports drop columns with those names. Notes and messages are free text, so our terms tell staff never to write these details there.
• Financial aid documents. We do not ask for FAFSA forms, tax returns or aid letters, and our terms forbid uploading them.
• Background check reports. For a volunteer we record only whether a check was completed and when. We never keep the report.
• Children under 13. No one under 13 may have an account. See section 6.
• Card numbers, precise location, fingerprints or face scans. None of these is collected by the website or the workspace.

4. How we use information

• To run the workspace for the organization that manages the record.
• To carry out a sharing decision a student or guardian has made.
• To keep accounts secure, find misuse and fix faults.
• To send messages about your account, and newsletters you can stop at any time.
• To send product update emails about new features for your role, which you can stop at any time.
• To follow up on a demo, by email or by phone.
• To suggest colleges that fit a student. We compare the student's own interests, home state and GPA band with public college data inside the workspace. Nothing about the student is sent to a college.
• To take payment for a membership or deposit and keep the records the law requires.
• To meet a legal duty, or to protect someone's safety.

We do not use student information for advertising. We do not build a profile of a student for any purpose other than the service their organization provides. No decision about a student is made by software alone: a university search is a filter a person runs, and every release is decided by people.

5. Students aged 13 to 17

• A student under 18 names a parent or guardian when they set up their account. We email that person a private link. Until the guardian says yes, the student's account stays limited and staff cannot open the full record. An organization can also record consent a guardian gave on paper.
• We use a teenager's information only as far as the service needs it. Anything beyond that, such as being listed for universities, needs a separate yes.
• Only a parent or guardian with their own account can agree to a minor being listed for universities, or to a release of the minor's identity. Where an organization has not set up guardian accounts, a minor is not listed. Staff cannot give this consent for a family.
• If we do not know a student's date of birth, sharing with universities is treated as a guardian's decision.
• Messages between students are off unless the organization turns them on and both students opt in. A minor needs a guardian to opt in.
• Newsletters go to a minor only through a guardian who has agreed to receive them.
• Sharing an application with a college, for a student under 18, needs a guardian's yes. Staff cannot give it.
• From age 18 the student makes these decisions. Consent a guardian gave earlier stays in place until the student or the guardian changes it.

6. Children under 13

The service is not for children under 13, and we do not knowingly collect their information. A date of birth under 13 is refused wherever one is entered. A row for a child under 13 in an import is skipped. If a person enters a date of birth under 13 when setting up an account, we close the account, remove it and tell the organization that invited them. If you believe a child under 13 has an account, write to privacy@cbosofamerica.org and we will remove it.

7. Who can see a student record

• Staff of the CBO or school that manages the record. Staff of other CBOs and schools cannot.
• The student, and a parent or guardian linked to that student.
• Our support team, only while an admin of the organization has approved support access. The admin chooses 24 hours, 3 days or 7 days, and can end it at any moment. Without that approval, our support team cannot open the organization's conversations or the records of its students and families. Each approval, and each time access ends, is written to the audit log.
• A very small number of engineers who run the database and its backups. They can technically reach stored data, and may do so only to keep the service running and secure, to investigate a security incident, or where the law requires it.

Contacts, gifts, grants and volunteer records are visible to the organization's admins, counselors and recruiters, and to our platform administrators. Students and families cannot open them, and no other organization can.

Without any approval, our team still sees what it needs to run the service: each organization's name, kind and membership, the names and work emails of staff accounts, billing records, the audit log, and counts such as how many accounts exist and how many messages were sent. A count never includes the text of a message.

When someone reports a message, our team sees that a report exists and the reason given. It sees the reported message and the two messages either side of it only while that organization has approved support access. An admin of the organization can always review a report made in their own organization.

These limits are rules in the database on every table. They do not depend on what a screen chooses to show.

A note for staff. Team channels are a workplace tool. An admin of your organization can read every channel in it, private ones included. When a channel message is removed, readers see that it was removed, and the original text stays in a history that admins can read.

8. How a profile reaches a university

A university cannot read a student record. There is one path, and each step is recorded.

1. Listing. A student is listed only after a share consent is recorded. An adult student gives it. For a minor, a parent or guardian gives it.
2. What a university sees first. A limited profile with no name and no contact details: a handle, graduation year, grade, state, student types, interests, GPA band and the name of the organization. A search that matches fewer than 10 students returns nothing.
3. Request. A university may ask for a name, email, phone number or high school. Each request names the details asked for, the reason and the university. The organization decides first. Then the adult student, or the guardian of a minor, decides.
4. Release. Only after both say yes can the university read those details. Every read is written to the audit log.
5. Ending it. A release can be revoked at any time and access here ends at once. Every release expires after 12 months.

Two things to know. First, the limited profile is built to keep students from being picked out, and universities agree not to try. In a very small program a mix of details could still point to one person, which is why small groups are withheld. Second, a university may copy a released profile into its own records. When a release ends we tell the university's system to delete it and our terms require that, but we cannot delete a copy held outside our service.

Two things a university can see that are not a student record. First, counts. A university sees how many students on this platform have it on their college list, by stage (saved, applied, accepted or attending). A count under 10 is not shown. It also sees how many of the applications shared with it fall in each round. No name appears in either. Second, visit bookings. A university that books a school visit or fair gives its name, the time and an optional note. The school sees them. No student is named.

Sharing an application with a college is not switched on yet. Families cannot send an application file to a college at present. Before that changes, we will update this section, say what a college may see and keep, and ask for agreement again.

9. Who else receives information

We do not sell or rent personal information, and we do not share it for advertising. We pass information to others only as follows.

Companies that work for us

• Vercel hosts the website and the workspace.
• Supabase runs the database, sign in and file storage.
• Stripetakes payments. It receives the payer's email, the amount and a description of the purchase.
• Resenddelivers email. It receives the address, the name and the message. It also receives email sent to an organization's Contacts address, and passes it to us.
• Google, in five places: reCAPTCHA on public and sign in forms where it is turned on, to stop automated abuse; Google sign in, if you choose it; Google Sheets, when an organization connects a sheet for us to read; Google Meet and Google Calendar, when a staff member connects their own account (see below); and Google Analytics on our public pages, only for visitors who allow it (see section 10). Google's own privacy policy applies to reCAPTCHA and to Google Analytics.
• Google Meet, Zoom and Microsoft Teams, only when a staff member connects their own account to create video meeting links. We ask the tool for a link and send it a general title and the time. We never send it who is invited, a student's name or the meeting note: invitations are sent by us. For Google and Microsoft we also read when that staff member is busy, as start and end times only, so a booking page does not offer a time they cannot make. We do not read what their calendar entries are about, and we do not store the busy times. When you join a meeting, the tool's own privacy policy applies.
• Salesforce, only when an organization connects its own Salesforce account for us to read.
• Anthropic reads the text of newsletters that a university forwards or pastes in, to pick out events and deadlines. It can also read a transcript, but only when a student who is 18 or older, or the parent or guardian of a younger student, presses the button that asks for it. Only the file is sent, with no name, email or date of birth beside it. Nothing else about a student is sent to it.
• Public data services of the United States government(College Scorecard, CareerOneStop and the Nation's Report Card). They receive search words or a state code, never who is searching.

These companies may use information only to provide their service to us. We store information in the United States.

Other cases

• Your organization's own systems.An organization can connect its records system to the workspace. What moves is under that organization's control.
• The law. We give information to a court or agency when the law requires it. Where we are allowed to, we tell the organization or the person first.
• Safety. We may share what is needed to prevent serious harm to a person.
• A change in who runs the program. If another organization takes over the program, records move only on terms at least as protective as these, and we will post a notice first.

10. Cookies and similar storage

We use what the site needs to work, plus one thing you can refuse: visit counts on our public pages. There are no advertising cookies anywhere.

• Google Analytics, only if you allow it. On our public pages (the home page, the pages that describe the program, pricing, the directory and the waitlist) we ask whether we may count visits. If you say yes, Google Analytics sets cookies and receives the page address, your device and browser type and your approximate location. If you say no, or your browser sends a Global Privacy Control signal, nothing from Google Analytics loads. It never runs in the signed in workspace, on sign in pages, on consent links or forms, or for anyone who is signed in. We do not use it for advertising.
• Sign in cookies keep you signed in.
• A preview cookiefor staff who use the “view as” switch. It lasts up to 8 hours.
• A setup cookie for staff while they connect Salesforce, Google Meet, Zoom or Microsoft Teams. It lasts 10 minutes.
• reCAPTCHA, where it is turned on, sets Google's own cookies to tell people from bots.
• Browser storage remembers which announcements and tours you have already seen. It stays on your device.

Do Not Track and Global Privacy Control. We do not track you across other websites, and we do not sell or share personal information for advertising. Because there is nothing of that kind to switch off, the site works the same way whether or not your browser sends one of these signals.

11. How long we keep information

• Student records: for as long as the organization keeps the student in its workspace. The organization can remove a record or a document at any time, and can ask us to delete all of its records.
• When an organization leaves: we delete its workspace records. Sign in details of its members are deleted on request.
• Releases to universities: access ends when a release is revoked or after 12 months. The record that a release happened is kept.
• University requests that were declined or ran out with nothing released: deleted 12 months after they closed.
• Guardian consent links that were never answered, or were declined: deleted 90 days after they expire.
• Waitlist entries with an unfinished payment: deleted after 90 days.
• Rows waiting in an import or sync: deleted after 14 days.
• A student signup that was never confirmed, or that the organization declined: the account and everything in it are deleted after 14 days.
• A student's introduction video and transcript:kept until the student, or the parent or guardian of a student under 18, deletes them, or until the student's record is removed. A video shows a student's face and voice. It is stored privately. Only the student, a linked parent or guardian and the staff of the student's own organization can open it. A university can open it only while a release is active and only if the student, or the parent or guardian of a student under 18, has agreed for that one file.
• Applications, documents and academic records:kept with the student's record, and removed when that record is removed.
• Contacts, gifts, grants, volunteer records and copied emails: kept until staff delete them, or the organization leaves.
• Visit times and bookings:kept with the organization's records.
• Abuse protection records: deleted after 24 hours.
• Payment records: seven years, for tax and accounting.
• Requests made to us about privacy, accessibility, copyright or refunds: three years.
• Support tickets and their replies: deleted 3 years after a ticket was last answered or closed.
• Help button counts and unanswered questions: deleted after 90 days.
• Support access approvals and message reports:kept as a record of who allowed what, and removed when the organization's workspace is deleted.
• Unsubscribe records: kept so that we do not email you again.
• The audit log, the consent record and the record of outcomes: these cannot be edited or deleted, because they are the proof of who agreed to what and who saw what. We keep them for as long as the service runs and review that choice every year.
• Demo visitors and follow up emails: deleted 24 months after your last visit or our last email, whichever is later.
• Demo data: fictional, and reset every night.

Our database provider keeps backups. A deleted record can remain in a backup for a limited time before it is overwritten.

12. Your choices and rights

We give the same rights to everyone, in every state, whether or not a state law requires it.

• See the information we hold about you or your student, and get a copy.
• Correct information that is wrong.
• Delete information. We may need to keep some records, such as proof of consent or a payment, and we will tell you which and why.
• Say no to sharing. A student or guardian can decline to be listed, decline any request, and revoke a release at any time, from the sharing page.
• Stop newsletters with the link at the bottom of any of them.
• Ask or complain without being treated worse for it.

How to ask. For a student record, the fastest route is the CBO or school that manages it, because it can correct or remove the record directly. You can also use our request form or write to privacy@cbosofamerica.org. There is no self-service delete button yet, so a person handles each request.

• We answer within 45 days. If a request is complex we may take up to 45 more, and we will tell you why.
• We may ask you to confirm who you are before we release or delete anything. A parent or guardian can ask for a minor. Someone you authorize in writing can ask for you.
• When a record belongs to a school, requests to see, correct or delete it go through the school, and we act on the school's instruction. For a CBO's record we may also need to check with the CBO first.
• If we say no, you can appeal by replying to our answer. A different person reviews it and replies within 60 days. If you are still unhappy, you can contact your state attorney general.

Notices for some states

• California. We do not disclose personal information to others for their own direct marketing. If you are under 18 and live in California, you can ask us or your organization to remove something you posted. Removal may not be complete: a copy someone else made, or a record we must keep, can remain.
• Nevada. We do not sell personal information. You may still send a do not sell request to privacy@cbosofamerica.org.
• New York. For anyone we know to be under 18, we use information only as the service needs or with consent.

13. Security

• Access rules are enforced in the database on every table.
• Staff accounts must use two-step sign in with a code from an authenticator app.
• Information is encrypted on its way between your device and us, and our database provider encrypts it where it is stored.
• Sensitive actions are written to an audit log that cannot be edited.

No service can promise perfect security. The security page lists the controls in place today and says plainly what we have not yet done.

If something goes wrong. If we find that someone reached personal information without permission, we tell the affected organization promptly, and no later than seven calendar days after we find it. We tell the people affected, and any agency, as the law requires.

14. Email

We send messages you need for your account, such as a receipt, a consent request or a password reset. Organizations can also send newsletters through the workspace. Every newsletter carries our postal address and a link that stops them.

We may also send product update emails about every three weeks. Each one covers what is new for your role and kind of organization. They go to staff of member organizations and to people who tried the demo or joined the waitlist. Every one carries our postal address and a link that stops them.

15. Changes to this policy

When this policy changes we post the new version here with a new date. If a change affects how your information is used, we also email account holders and ask them to agree again the next time they sign in. Earlier versions are available on request.

See also the student data policy, the terms of use and the security page.