Privacy Notice

When you visit openarcollective.org

The public website is a set of static files. It sets no cookies, uses no analytics service, and requests no scripts, fonts, or images from any other company. Fonts are served from our own domain. If a page links to GitHub, LinkedIn, or Discord, nothing is sent to those companies unless you click the link.

The site is served through Cloudflare, which handles the connection and, as part of delivering the page and protecting the site from attack, processes your IP address and request details. We do not receive a per-visitor report from that process, and we do not build profiles of visitors.

When you apply for membership

The membership application at join.openarcollective.org asks for your first and last name, your email address, your job title, the organization you are affiliated with, and a link to your LinkedIn profile. It also records your confirmation that the information is truthful, your affirmation of the Foundation's mission, and your agreement to the Community Participation Terms, together with the version of those terms in force when you signed and the date you signed.

We use that information to confirm you work in the accounts receivable industry, which is the one eligibility requirement for membership, and to administer your membership afterward. A director reviews each application, which means a person reads what you submitted. If we admit you, we issue a member number and keep the record of your membership. If we decline, we keep the record of the decision and its reason, because the Community Programs and Standards Policy gives you an appeal and an appeal needs a record.

Members are not published. There is no public member roster, and we do not list your name, your employer, or your membership anywhere on the site.

When your organization signs the Statement of Support

The Statement of Support asks for your organization's legal name, the trade name it uses if that differs, its website, where it is registered, and the name, title, and email address of the person signing on its behalf. It records that person's confirmation that they have authority to sign, the organization's affirmation of the mission, agreement to the terms, the version signed, and the date.

Your organization's name is published on the public Mission Supporter roster. That is the point of the program, and the form says so before you sign. The signer's name, title, and email address are not published. They are kept so we know who committed the organization and so we have somebody to contact about the listing.

When you connect a Discord account

Admitted members can connect a Discord account to reach the members-only areas of the Foundation's server. Doing so asks Discord for permission to read your account identifier and the email address on your Discord account, and to add you to the Foundation's server. We store your Discord account identifier so we can match your Discord account to your membership. We do not read your messages, your other servers, or your friends list, and the permissions we request do not allow it.

Discord is a separate company with its own privacy policy, and anything you post on the Foundation's server is handled under Discord's terms as well as ours. Connecting Discord is optional, and no part of your membership depends on it.

Email we send you

Some of our email is transactional, which means it is the mechanism rather than a message we chose to send. Confirming your address, telling you a decision, and issuing your member number are all transactional, and you cannot opt out of them while your application or membership is live.

Admitted members are also added to the members-only email list. That is a separate thing, it is stated before you apply, and you can leave it at any time without affecting your membership. Every message on that list carries a link to stop receiving Foundation email.

We do not track our email. Open tracking and click tracking are both switched off, so we do not record whether you opened a message, when you opened it, or which links you followed, and the links in our email are our own rather than redirects through a tracking service. Our provider still reports whether a message was accepted for delivery or bounced, because that is how we learn an address is wrong, and that is the whole of what we see.

Who else processes your information

The Foundation is small and runs on other companies' infrastructure. The companies below process personal information on our behalf, each under its own agreement and privacy policy.

• Cloudflare, for DNS, content delivery, and protection of both sites.
• Akamai, through its Linode service, which hosts the server behind join.openarcollective.org.
• Postmark, which sends the Foundation's email.
• Discord, which operates the community server.
• Google, whose Workspace service carries the Foundation's own mailboxes, including the address that receives applications for review.
• GitHub, which hosts the Foundation's source code and the published Mission Supporter roster.

We add a processor only when we need one, and we do not give any of them permission to use your information for their own purposes.

How long we keep it

Membership and Mission Supporter records are kept for as long as the membership or listing is active, and afterward for as long as the Foundation's Document Retention and Destruction Policy requires. Records of a decision, including a decline or a revocation and its stated reason, are kept because the appeal process depends on them. An application that is never confirmed is not a membership, and we will remove it on request.

Your choices

You can ask us what we hold about you, ask us to correct it, ask us to remove it, or ask us to take your organization off the Mission Supporter roster. Write to [email protected] and a person will answer. We will not require you to justify the request.

Removing your information generally ends the membership or the listing it supports, because the record is the membership. Where a record has to be kept for the Foundation's own governance, such as the record of a decision that is subject to appeal, we will tell you what is being kept and why rather than quietly keeping it.

Depending on where you live, you may have rights under laws such as the General Data Protection Regulation or state privacy statutes in the United States. We will honor those requests through the same address regardless of where you are, because maintaining two standards would be more work than doing it properly once.

Security

Both sites are served over HTTPS. Access to the administrative system is limited to the people who run the membership program. We do not ask for and do not store payment details, government identifiers, or financial account information, because the Foundation charges nothing and has no reason to hold any of it.

Children

The Foundation's programs are for working professionals. The sites are not directed at children, and we do not knowingly collect information from anyone under sixteen.

Changes to this notice

If we change what we collect or who processes it, we will update this notice. Material changes affecting current members will also go to the members-only email list.

Contact

Questions about this notice, or about anything the Foundation holds, go to [email protected]. The Foundation is The Open Accounts Receivable Collective Foundation, a Delaware nonprofit corporation operating as The OpenAR Collective.