Version 1.0. Effective Date: the date shown at the top of this page. Controller: Reseated Councils, Inc., a Delaware nonprofit nonstock corporation. Order of precedence: Certificate, Bylaws, Program Rules, then the Terms and this Notice. This Notice controls on how we process Personal Data.
Layer 1: Summary
- What we collect: what you enter (name, email, country, optional region or city, council, Reports, comments, nominations), sign-in codes, votes, and technical data from your browser.
- Why: to run a free nonprofit assembly, verify eligibility, count votes, publish the Public Record, keep the Site secure and contact you.
- Publication: Public summaries use region and amount bands, with a minimum of 5 Reports per cell. You choose how you are credited.
- Who processes it: our platform, hosting, email, monitoring and AI service providers, mainly in the United States.
- We do not: sell Personal Data or use it for targeted advertising.
- Your choices: access, correction, deletion, portability, objection and appeal. Contact privacy@reseated.com.
Layer 2: Full notice
1. Who we are and how to contact us
Controller: see above. Contacts:
- privacy@reseated.com (requests and appeals)
- security@reseated.com
- legal@reseated.com
- 8 The Green, Ste D, Dover, DE 19901, United States
We have not appointed a representative in the European Union or the United Kingdom.
2. What we collect, why, our legal basis and how long we keep it
| Who | Personal Data | Source | Purposes | Legal basis (EU/UK) | Retention |
|---|---|---|---|---|---|
| Visitors | IP address, device and browser data, pages viewed, referrer, local-storage identifiers (section 11) | Your device | Deliver and secure the Site; aggregate statistics | Legitimate interests (security, operation); consent where required for non-essential storage | Security logs 12 months; platform analytics at the platform’s default retention |
| Program Members, Authorized Representatives and applicants | Business name, registered number (where available), website domain, Authorized Representative’s name, title and email, country, optional region or city, council, independent-ownership and active-trading confirmations and any eligibility evidence supplied, Charter and Terms acceptance records (version, date, email), sign-in code logs, program votes, Roll listing choice | You; our systems | Check eligibility; run membership; authenticate; record and count votes; publish the Roll if you choose | Contract (Terms, Program Rules); legitimate interests (vote integrity) | Active period plus 24 months. Acceptance records for 6 years. Ballots are separated from identity 90 days after a result is certified, and aggregate results are kept permanently |
| Reporters | Contact details, business type, size band, country and region, city (private), amount and duration (published in bands), narrative (private), the organization named (the Other-Party Field, which is never published), attachments (private), attribution choice | You | Assess, group and publish systemic issues; contact you about your Report | Contract; legitimate interests (public-interest reporting) | Private fields: case life plus 3 years. Public summary: archive (section 8) |
| Consultation commenters | Name or chosen attribution, email, organization, comment | You | Publish consultation records; follow up | Contract; legitimate interests | Contact data 24 months; published comment: archive |
| Fellowship nominators | Name, email, country, optional city, council, statement about the nominee | You | Process the nomination | Legitimate interests | 24 months |
| Fellowship nominees | Name, title, company, email, nominator’s statement | The nominator | Assess the nomination; invite the nominee. We publish nothing until the nominee accepts in writing | Legitimate interests | Not accepted or no reply: deleted after 12 months. Accepted: term plus 24 months |
| Named Executives | Name, title, organization, business contact details, public statements, invitation and response status | Public sources; the organization | Invite commitments; track and publish role-related status | Legitimate interests (public-interest record) | Public role record: archive. Contact details: 24 months after last contact |
| Partner representatives | Name, title, email, country, optional city, organization, website, council, authority confirmation | You | Manage the partnership; share program data | Contract; legitimate interests | Partnership plus 24 months |
| Fellows (publicity) | Name, title, photo, company, conflict disclosures | You | Publish Fellow profile only with separate Fellow Publicity Consent; manage conflicts | Consent (publicity); legitimate interests (conflicts) | Term plus 24 months; published items removed within 30 days of consent withdrawal |
| Signatory officers (CEO Signatory Commitment) | Name, title, organization, business contact details, the signed Commitment and replies | The Signatory | Publish the Commitment and replies in full; verification correspondence | Contract (Commitment); legitimate interests (public-interest record) | Public role record: archive. Contact details: 24 months after last contact |
| Pledged Business contacts | Name, title, work email, business name, pledge choices, officer attestation, evidence submitted, Pledge Status, optional city for the public directory | You | Run pledges; show a dated public profile and directory listing (by promise and, if you choose, city) | Contract; consent (directory city listing) | Pledge period plus 3 years |
| Requesters and complainants | Identity, contact details, request or notice content | You | Handle privacy, content and copyright requests | Legal obligation; legitimate interests | 3 years |
Do not send sensitive data. Examples are health, religion, ethnicity, sexual life, immigration status, government ID numbers and financial account numbers. If you send it, we may delete it.
3. Publication and identifiability
Public Record content can be seen by anyone, indexed by search engines and copied. Our publication rules (Terms section 7.6) reduce identifiability. They cannot rule it out.
4. Who receives Personal Data
We do not sell Personal Data or process it for targeted advertising. Service providers receive it under contract to process it for us. Categories, based on our platform provider’s published subprocessor list:
- App platform: Base44 and Wix.com Ltd. (Israel)
- Hosting and databases: Render, Google Cloud Platform, Supabase and MongoDB (United States)
- Email delivery: SendGrid (United States)
- Monitoring and logging: Datadog (United States)
- AI and large language model providers: OpenAI and Anthropic (United States) appear on our platform provider’s subprocessor list. As of October 29, 2026 the Site’s own code makes no AI or language-model calls. Our platform provider’s published terms allow it to use customer data to train its software tools; we are seeking an opt-out from that use and will update this Notice when it is confirmed.
- Analytics: Base44 platform analytics only (no Google Analytics); switched off for browsers that send a Global Privacy Control signal.
We also share Personal Data with:
- professional advisers
- authorities, where the law requires it or to protect rights and safety
- a successor nonprofit that takes over the Site, under terms protecting your data
5. International transfers
We store data in the United States. For data from the EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum and supplementary measures. We may also rely on the EU-U.S. Data Privacy Framework where a recipient is certified. That framework is subject to pending legal challenge. You can ask us for a copy of the relevant safeguards.
6. Security
We use reasonable administrative, technical and physical safeguards appropriate to the data. No system is completely secure.
7. Breaches
If a security breach affects your Personal Data, we will investigate. We will notify you and the relevant authorities where Applicable Law requires.
8. Retention and archive
We keep data for the periods in section 2, then delete or anonymize it. Public Record items may be kept as an institutional archive. We will honor deletion, redaction and unlisting requests unless a legal exception applies. Examples are defending legal claims and keeping a minimal record that the request was made.
9. Your rights
Depending on where you live, you may:
- confirm whether we process your data
- access your data, including inferences we hold
- correct it
- delete it
- get a portable copy
- get a list of the third parties we disclosed it to
- opt out of sale, targeted advertising and significant automated profiling (we do none of these)
- object to processing or restrict it
- withdraw consent, as easily as you gave it
We do not discriminate against anyone for exercising these rights.
10. Making a request and appealing
10.1 Email privacy@reseated.com or use the “Your privacy choices” panel in your account. You do not need an account. We verify requests by sending a one-time code to the email address we hold for you. You may use an authorized agent.
10.2 We respond within 45 days. If we need more time, we tell you within those 45 days why we are taking up to 45 more. Requests are free once in any 12-month period.
10.3 Appeal. If we refuse to act on your request, you can appeal by replying “Appeal” within 60 days of our decision. A different staff member will review it. We will tell you the outcome and our reasons in writing within 60 days. If we deny the appeal, you can complain to the Delaware Department of Justice, Consumer Protection Unit (attorneygeneral.delaware.gov), or to your local authority.
11. Cookies and local storage
Inventory taken from the Site’s code on October 29, 2026.
| Name | Type | Purpose | Duration | Required? |
|---|---|---|---|---|
| rc_session | Local storage | Member sign-in session | Until you sign out | Yes (essential) |
| rc_draft, rc_next | Local storage | Saves your application draft and where to return after confirming your email | Until the application is sent | Yes (essential) |
| rc_gate_later | Session storage | Remembers that you chose “Not now” on the updated-documents screen | Browser tab | Yes (essential) |
| rc_portal_* | Session storage | CEO Seat portal access | Browser tab | Yes (essential) |
| rc_bid | Local storage | Random browser identifier used only to rate-limit reactions and co-signs | Persistent until cleared | Security |
| rc_r_* | Local storage | Remembers that you reacted to an item | Persistent until cleared | No (preference) |
| rc-letter-view | Local storage | Letter reading-view preference | Persistent until cleared | No (preference) |
| sidebar:state | Cookie | Admin sidebar open or closed (staff only) | 7 days | No (preference) |
| base44_analytics_session_id | Platform (Base44) | Platform analytics session; switched off when your browser sends a Global Privacy Control signal | Platform default | No |
| Platform sign-in token | Platform (Base44) | Staff and admin sign-in | Platform default | Yes (staff only) |
Third-party hosts your browser may contact when you use the Site: api.fontshare.com, fonts.googleapis.com and fonts.gstatic.com (fonts); flagcdn.com (flag images); media.base44.com and image hosts referenced in records (logos, photos); YouTube (embedded video on pages that include one). These providers receive your IP address and browser details when your browser requests the file. Email is sent from our servers, not from your browser.
Where the law requires consent, we ask before setting non-essential items. You can change your choice in “Your privacy choices” in your account.
12. Opt-out preference signals
We honor Global Privacy Control and similar opt-out preference signals. We treat a signal as an opt-out of any sale or targeted advertising, and we turn off non-essential analytics for that browser.
13. Do Not Track
We respond to browser “Do Not Track” signals in the same way as section 12. Third parties do not track you across other websites through our Site.
14. Children
The Site is for adults aged 18 or older and is not directed to children. If we learn that we hold a child’s data, we delete it.
15. Changes to this Notice
We post changes here with a new version number and Effective Date. For material changes, we email account holders at least 15 days in advance, and ask for consent again where the law requires it.
Annex A: EEA and UK
- Controller and contacts: section 1.
- Purposes and legal bases: section 2. Where we rely on legitimate interests, you can ask us for our balancing assessment.
- Recipients and transfers: sections 4 and 5.
- Retention: sections 2 and 8.
- Rights: access, rectification, erasure, restriction, portability, objection (including to legitimate-interests processing) and withdrawal of consent.
- No solely automated decisions: we make no decisions with legal or similarly significant effects by automated means alone.
- Data obtained from others (Article 14): Nominees and Named Executives receive this information within one month of our first use of their data, and no later than our first contact with them. We name the source of the data (the nominator, public sources or their organization).
- Is providing data required? Name and email are required to join, report or comment. Everything else marked optional is optional.
- Complaints: you may complain to the data-protection authority where you live or work. In the UK, that is the Information Commissioner’s Office at ico.org.uk.
Annex B: Canada and Quebec
We handle Personal Data of people in Canada in line with Applicable Law, including Quebec’s Act respecting the protection of personal information in the private sector where it applies. Our person in charge of the protection of personal information is the President of Reseated Councils, Inc., reachable at privacy@reseated.com. Your data may be stored and processed in the United States and other countries named in section 4, where courts and authorities may be able to access it. You may access and correct your data and withdraw consent, subject to legal limits. You may complain to the Office of the Privacy Commissioner of Canada or to the Commission d’accès à l’information du Québec.
Questions: legal@reseated.com · privacy@reseated.com · security@reseated.com