Privacy Policy

Updated August 29, 2025. This policy is currently under review and may be updated. The Right to Rent Collaborative is committed to complying with applicable data privacy laws to the fullest extent of our ability.

Your privacy is important to us. This Privacy Policy (“Privacy Policy”) describes how Right to Rent Collaborative, Inc. (“R2RC”, “we”, “us”, or “our”) may collect, use, store, disclose, process, and transfer your personal information through your access to or use of R2RC products and services, including those at https://r2rcollaborative.org/ as well as any subdomains, website of ours that links to this Privacy Policy, related websites, and other offerings (collectively, the “Services”) and what rights you have with respect to limiting access to and/or use of such personal information, having such information corrected or removed from our records, and obtaining data related to the disclosure of your personal information. By using the Services, you signify your acceptance of this Privacy Policy. If you do not agree to this Privacy Policy, please do not use the Services. R2RC may change this Privacy Policy from time to time by posting changes at [POLICY URL]. Your continued use of the Services following the posting of such changes will be deemed your acceptance of those changes, unless additional consent is required by law or by the terms of such updated Privacy Policy and you fail to provide such additional consent.

Privacy Policy Applicability

R2RC is a Vermont mutual benefit nonprofit corporation dedicated to providing short-term rental (“STR”) associations and alliances with the capital they need to advocate for policy solutions that strengthen the STR industry. R2RC collects one-time and automatically recurring donations from a variety of STR stakeholders and distributes those advocacy funds in pursuit of its mission. R2RC has applied for a federal tax exemption as a 501(c)(6) pending organization.

This Privacy Policy applies when you use or access the Services or share information with R2RC. By accessing or using the Services, you consent to this Privacy Policy. R2RC may update this Privacy Policy at any time. If you do not consent to this Privacy Policy for any reason, please do not access or use the Services or share your information with us. Please note that this Privacy Policy applies only to the Services and not to any other third-party website linked to or from it, or any third-party website in which R2RC’s content or functionality is embedded. We do not control the privacy policies or practices of others. If you wish to know about the privacy policies and practices of third parties, please visit their websites or contact them directly.

Information We Collect

We collect the following types of information from users of our Services, although for some users, not all information types are collected. (For instance, credit card information is not collected from users of our website who do not make online donations.)

first and last name
telephone number
postal address
email address
whether you own, rent and/or manage STR properties
which STR organizations (if any) you are a member of our affiliated with and, as applicable, your positions within those organizations
information needed by our third party payment processors to process your payments
donation/payment history
IP address
device type
web history and web metrics

Except for information which is automatically collected about you (see Information Collected Automatically below), you have choices regarding what information you share and the Services you want to engage in. You can choose not to provide information to us, but in general, some information about you is required in order for you to access certain functionalities of the Services, including enrolling in automatic donation collection if you choose to do so. We may be unable to process donations or perform other Services which require your personal information if you request that we delete it or restrict its use.

How We Collect Information

Information Provided by You

We receive and collect information you provide via the Services, including through website input fields, donations (whether made online, by mail, or by any other means), phone, email, or other direct outreach from you or voluntary provision by you. This may include personal information that can identify or relate to you, including but not limited to your first and last name, telephone number, postal, and email addresses.

Information Provided by Others From Your STR

If you are affiliated with an STR, we may receive your name, the name of the STR(s) with which you are affiliated, your title, email address and/or phone number from members of the Board of Directors of such STR, STR staff, or others affiliated with the same STR as you. They may provide this via website input fields, grant applications, phone, email, or other means. We cannot control what information third parties may provide to us but all of the privacy rights that apply to you under this Privacy Policy, including, but not limited to, the right to opt out of having us share your personal information, apply to information which third parties provide to us about you.

Information Collected Automatically

We may also collect some information about you automatically in connection with your use of the Services, such as your IP address, the type of device from which you access our website(s), how you arrived at our website(s) (e.g. by clicking on a link in a Google search result), which webpages you click on, and how long you are on various webpages.

We may use cookies, heat mapping, log files, web beacons, device identifiers, advertising identifiers, session replay technologies, and similar tracking technologies, including those from third-party service providers like Google Analytics, Google Tag Manager, HubSpot, and other cloud-based tools, to automatically collect your preferences, performance data, and information about your web usage when you visit the Services. For example, we may collect your IP address, device and Internet service provider information, Web browser details and the address of any referring website. We may also collect information about your online activity, such as pages viewed and interactions with other users. This may include collecting geolocation signals from your IP address or device settings to determine your location. By collecting and using this information, we may operate and personalize the Services for you and may also combine this data with other information we have collected about you. For more information on how we use cookies, please see the “Cookies” section below.

The Services are designed to recognize or respond to “do not track” signals received from browsers. You can control the information collected by such tracking technologies or be alerted when cookies are sent by adjusting the settings on your Internet browser or devices, but such adjustments may affect or disable certain functionality of the Services. You can learn more about your options for opting out of interest-based Google ads at https://adssettings.google.com. You can learn more about targeted ads and your ability to opt out of receiving interest-based ads at optout.aboutads.info and www.networkadvertising.org/choices.

Cookies

Cookies, also known as tracking cookies or browser cookies, and similar technologies such as web beacons, clear GIFs, pixel tags, and JavaScript (collectively, “Cookies”) are small pieces of data, usually text files, placed on a computer, tablet, phone, or similar device when you use that device to access the Services. We use the following types of Cookies:

Essential Cookies. Essential Cookies are necessary for providing you with the Services and features that you requested. For example, these Cookies allow you to log into and stay logged into secure areas of the Services, save language preferences, and more. These Cookies are required to make the Services available to you, so they cannot be disabled if you wish to use the Services.
Functional Cookies. Functional Cookies are utilized to record your choices and settings, maintain your preferences over time, and recognize you when you return to our Services. These Cookies may help us personalize our content for you, greet you by name, and remember your preferences.
Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how visitors (like you) use the Services. These Cookies accomplish this by collecting information about the number of visitors to the Services, what webpages visitors view the most, and how long visitors view specific pages. These Cookies also help us measure and manage the performance of our advertising campaigns in order to help us improve the campaigns and the Services’ content. For example, Google LLC (“Google”) uses cookies in connection with its Google Analytics services. Google’s ability to use and share information collected by Google Analytics about your visits to the Services is subject to the Google Analytics Terms of Use and the Google Privacy Policy. You have the option to opt-out of Google’s use of Cookies by visiting the Google advertising opt-out page at http://www.google.com/privacy_ads.html or the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout/.

You have the option to decide through your internet browser’s settings whether or not to accept Cookies. Most browsers allow users to choose whether to turn off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the browser) allow you to toggle whether to accept each new Cookie. You can also clear all Cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit our website and/or access the Services and some functionalities may not work. To explore what Cookie settings are available to you, look in the “settings”, “preferences” or “options” section of your browser’s menu.

To find out more information about Cookies, including information about how to manage and delete Cookies generally, please visit http://www.allaboutcookies.org/.

Information Collected from Third Parties

We may periodically obtain information about you from local or state STR associations, our association management support service provider, and other independent third-party sources and will add it to our database of information, including any information that you provide to third parties that are associated with or whose products or services are integrated with the Services. While we are not involved in the data collection processes of third parties, we only collect information about you from third parties if such third parties advise us in writing that they observe all applicable privacy laws and regulations with respect to the collection and sharing of the information which they provide to us.

For Automatic Donation Collection

In addition, if you elect to participate in automatic donation collection, we may receive and collect more detailed information you provide by granting us access to Calry Inc.’s API integration with your STR property management system (“Calry’s API”), direct integration, or through other such ways. This includes personal information that can identify or relate to you, including, but not limited to:

Property IDs and related information, including, but not limited to property address information.
Reservation IDs and related information, including, but not limited to:
- reservation creation dates;
- reservation arrival and departure dates;
- guest counts;
- base prices and discounts; and
- other reservation finances.

We do not control the information you provide to Calry’s API. We cannot filter or otherwise moderate the information we receive by being granted access to Calry’s API, which may include information other than what is listed above. You can learn more about Calry’s API and read its privacy policy and terms of service at https://calry.app/legal/privacy-policy/ and https://calry.app/legal/terms-and-conditions/. As with all third-party providers, R2RC is not a party to any agreement between you and/or the STR(s) with which you are affiliated and Calry Inc., and R2RC does not control Calry Inc.’s privacy and data security policies. R2RC reserves the right to change API providers at any time and to continue collecting your personal information from those providers in substantially the same manner as R2RC collects information via Calry’s API.

How We Use Your Information

We process your personal information with your consent or as needed to provide you with the Services. We may also use your personal information to comply with legal obligations, operate our business, protect the vital interests of you or the public, or for other legitimate interests of R2RC as described in this Privacy Policy.

More specifically, we may use your personal information to:

Optimize and improve the Services. We continually try to improve the Services based on the information and feedback we receive from you and our other users, including by optimizing the content on or functionalities of the Services.
Personalize the user experience. We may use your information to measure and optimize engagement with the Services and to understand how you and our other users interact with and use the Services and other resources we provide.
Coordinate with STR associations or alliances. We may use the information you provide us to better coordinate with state and local STR associations or alliances and to improve our efficacy in distributing STR advocacy funds.
Process donations. We may use the information you provide to fulfill, collect one-time, recurring and/or automatically donations. We do not share this information with outside parties except to the extent necessary to provide the Services and related activities, which includes sharing it with payment processors that utilize industry-standard encryption and online payment protocols.
To send periodic communications. The communication methods you provide through our contact forms will be used to send information and updates pertaining to the Services. It may also be used to respond to your inquiries or other requests. If you opt into our mailing list, you may receive emails that include R2RC news, updates, service information, and marketing material. If at any time you would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email or you may contact us via the contact information below. Please note that if you unsubscribe from promotional emails, you may still receive communications related to your subscription, membership, purchases, or other necessary functionalities of the Services.
To send periodic SMS messages. We may occasionally send you SMS messages through the number you provided to us. The messages will be sent based on R2RC’s legitimate business needs, and in furtherance of our providing the Services. If at any time you would like to unsubscribe from receiving future SMS messages, we include detailed unsubscribe instructions for how to do so or you may contact us via the contact information below.
Carry out other legitimate business interests. We may use the information you provide to carry out other legitimate business purposes, as well as other lawful purposes.

We may use any aggregated information (as described below) to perform analytics on the locations of our users, the source of web referrals, measuring the success of marketing efforts, fund drives, email open rates, and other legitimate business purposes reasonably related to any of the foregoing purposes. We may utilize third parties to perform such analytics, including, but not limited to, Rent Responsibly Inc., provided that all third parties shall be bound by privacy obligations with respect to such aggregated data which are at least as stringent as those which bind us under this Privacy Policy and applicable law .

How We Share Your Information

We share your information with our partners, service providers, contractors, agents, and third-party vendors indicated in the “Information We Collect from You” section as needed to fulfill Services. Please note that our partners may contact you as necessary to obtain additional information about you, facilitate any use of the Services, or respond to a request you submit.

Third-party vendors who provide products, services or functions on our behalf may include association management support services, cloud database providers, data analytics companies, customer service vendors, communications service vendors, logistics service providers, marketing vendors, and security vendors. Third-party vendors have access to and may collect personal information only as needed to perform their functions, may only use personal information consistent with this Privacy Policy and other appropriate confidentiality and security measures, and are not permitted to share or use the information for any other purpose.

We may also share your information:

In response to subpoenas, court orders, or other legal process; to establish or exercise our legal rights; to defend against legal claims; or as otherwise required by law. In such cases, we reserve the right to raise or waive any legal objection or right available to us.
When we believe it is appropriate to investigate, prevent, or take action regarding illegal or suspected illegal activities, including, but not limited to, money laundering; to protect and defend the rights, interests and safety of R2RC, the Services, our members and donors, other users of the Services and/or others; or in connection with our Terms of Service and other agreements with customers with whom you may be affiliated.
In connection with a corporate transaction, such as a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy, assignment for the benefit of creditors, a receivership or similar proceeding.

If we need or intend to share your personal information with third parties for any purpose besides those identified above, we will update our Privacy Policy to reflect that and notify you and all users that the Privacy Policy.

Personal Information You Post in Public Areas. When you post a message in an R2RC forum, chat room, message board, review, or provide customer feedback, the information you post may be accessible to other users of the Services and the public. If you post personal information anywhere on the Services that is accessible to other users or the public, be aware that such personal information can be read, collected, used, or disseminated by others and could be used to send you unsolicited information or for other purposes. Accordingly, you assume full risk and responsibility for posting such information and agree that R2RC is not responsible in any way for keeping personal information you choose to post in these public areas private.

Aggregated Information. We may use, publish, share, distribute, or disclose personal information that has been aggregated with information from other users and otherwise anonymized and de-identified in a manner that does not allow third parties, including R2RC partners, customers, and vendors, to de-identify the data or identify it as originating from you. Such information may help R2RC identify and analyze training, demographic, and psychographic trends and information, and report to third parties how many people saw, visited, or clicked on certain content, areas of the Services, or other materials. We may also use such data for optimizing the Services’ functionality, for research purposes in pursuit of the R2RC mission.

How We Store and Secure Your Information

Personal information collected by R2RC may be stored and processed in your region and in any other region where R2RC or its affiliates, subsidiaries, or service providers operate facilities.

R2RC takes technological and organizational measures designed to protect your personal information against loss, theft, and unauthorized access, use, disclosure, or modification and takes care to only utilize the services of third party data processors who do the same. For example:

We transmit data over secured communication channels using SSL Login credentials;
All personal information is stored by trusted third party providers (e.g., Amazon Web Services (AWS), HubSpot, Microsoft Azure, and Google Cloud Platform (GCP), Airtable, Supahost, Calry);
All systems used to provide the Services are password protected, with the exception of areas where you may leave reviews or other information that it should, at the time of your access thereof, be evident are publicly-accessible;
All Services usage is restricted on a per-user basis on the principle of least privilege, meaning that each administrative user only has the database or other permissions necessary to access data which is needed for performance of their tasks; and
All data is encrypted during transfer and while at rest.

We rely on the security policies of third party providers to protect personal information while stored in their respective controlled facilities. We do not audit those security policies but do take care to utilize reputable vendors for such work and review any security audits, analyses, or breach notices which they may provide to us and take such actions as we deem in the best interest of R2RC and the users of the Services in response to the same.

R2RC currently uses Stripe, Inc. (“Stripe”) for payment, analytics, and other business services. Stripe collects identifying information about the devices that connect to each of their services. Stripe uses this information to operate and improve the services it provides to R2RC, including for fraud detection. You can learn more about Stripe and read its privacy policy at https://stripe.com/privacy. As with all third-party providers, R2RC is not a party to any agreement between you and Stripe, and R2RC does not control Stripe’s privacy and data security policies. R2RC reserves the right to change payment processors at any time without notice to you, provided that R2RC shall use reasonable care to select and utilize the services of reputable payment processors.

R2RC complies with applicable data protection laws, including applicable security breach notification requirements.

Data Retention

Unless and until you notify R2RC that you wish for your personal information to be removed from R2RC’s records, in the manner permitted by this Privacy Policy, R2RC will retain your information only as long as necessary for the purposes outlined in this Privacy Policy, in a manner consistent with our data retention policy discussed in this section, and for a commercially reasonable time thereafter for backup, archival, fraud prevention or detection or audit purposes or as permitted by applicable law. R2RC will retain your personal information consistent with the original purpose of collection or as long as necessary to comply with our legal obligations; maintain accurate accounting, financial and other operational records; resolve disputes; and enforce our agreements. We will never retain your information for a period longer than permitted by law.

If you have opted into automatic donation collection, R2RC will store information necessary for R2RC to verify any such donations that you have made using the Services, including, at minimum, donation amount, time of donation, and identifying information such as email address, name and address.

Subject to your right to limit the use of your personal information or to have it deleted, each in accordance with and as permitted under this Privacy Policy, and your other rights outlined in this Privacy Policy, we determine the appropriate retention period for personal information on the basis of the amount, nature, and sensitivity of the personal information being processed; the purpose for which it was collected; the potential risk of harm from unauthorized use or disclosure of the personal information; whether we can achieve the purposes of the processing through other means; and applicable legal requirements.

After expiration of the applicable retention periods, your personal information will be deleted. As discussed below, you may have the right to request that we delete this information earlier.

Accessing and Updating Your Information

To the extent provided by the law of your jurisdiction, you may have the right to:

Access certain personal information we maintain about you and request details about how we process it;
Request certain information regarding our disclosure of personal information to third parties, including the purposes for which it is disclosed and whether we receive money or other things of value for such disclosure;
Request that we update or correct inaccuracies regarding your personal information;
Object to our use of your personal information;
Ask us to block or delete your personal information from our database;
Ask us to discontinue sharing or selling your personal information (to the extent that we may do the same) and to notify third parties with whom we have shared the same that they must stop using and delete such information;
Request that we provide you with all of the personal information that we have about you in a machine-readable format, readily available to be used by you and/or any third parties to whom you may provide it, with the exception of any aggregated data that includes data about you which cannot reasonably be reidentified with you during a deaggregation process;
Confirm whether R2RC stores your data in the United States, the European Union and/or your location or the jurisdictions required by the laws applicable to you; and
Appeal any decision that we make in response to your personal information-related requests.

You may make these requests and any other inquiries about this Privacy Policy by emailing [email protected]. Any such requests are subject to the protection of other individuals’ rights and applicable law.

Many states and other jurisdictions permit you to receive a copy of your personal information once per year at no charge. To the extent permitted by applicable law, a charge may apply before we provide you with a copy of any of your personal information that we maintain or other information which you may request under this Privacy Policy.

Additional Privacy Information

Data Transfer. Our databases and the data processing centers with which we process your information are currently located in the United States of America. R2RC makes no claim that its Services are appropriate or lawful for use or access outside the United States of America. If you access the Services from outside the United States of America, you are consenting to the transfer of your personal information from your location to the United States of America. You are solely responsible for complying with all local laws, rules and regulations regarding online conduct and access to the Services. By providing us your information, you further consent to its storage, use, and processing within the United States of America.

Collection of Data from Children. The Services are not directed to children, and you may not use the Services or provide any personal information to R2RC if you are under the age of 13 and/or if you are not old enough to consent to the processing of your personal information under the law of your country or jurisdiction (the “Age of Minority”). We do not knowingly collect or process personal information of individuals under the Age of Minority unless we receive all necessary consents from the individual’s parent or guardian. Should we become aware that we have personal information of persons under the Age of Minority we will take the necessary steps to delete such information as soon as possible, stop using and processing it for any purposes, and notify any third parties to whom we have provided such information in accordance with this Privacy Policy that they also must delete and stop using and processing such information.

Authorized Agents

If you reside in California, Colorado, Connecticut, Delaware, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Utah, or the European Union you have the right to authorize another individual (an “authorized agent”) to submit certain privacy rights request on your behalf. If you reside in Maryland or Rhode Island, you will have that right beginning in October 2025 and January 2026, respectively. To help protect your privacy and maintain security, we may take steps to verify your identity or the identity and authorization of persons who purport to make requests on your behalf before granting you or them access to the requested information, we may require anyone who states in a Privacy Policy-related request that they are an authorized agent to submit proof of authorization to make the request, such as a valid power of attorney or proof that you have signed permission from the individual who is the subject of the request. Please do not provide any sensitive personal information in connection with this request, such as a copy of or the number of a driver’s license or other government-issued ID. In some cases, we may contact the individual who is the subject of the request to verify their identity and/or confirm you have permission to submit this request. To submit a request as an authorized agent, please contact us at [email protected].

List of Third Party Disclosures

If you are a resident of Oregon, Minnesota, or the European Union, you have the right to obtain a list of third parties to whom we have disclosed personal information. To exercise that right, please email us at [email protected] with this request.

Information for California Residents

California law permits residents of California to request certain details about how their information is disclosed to third parties for direct marketing purposes. Under the law, a business must either provide this information or permit California residents to opt in to, or opt out of, this type of disclosure. To opt out of having information about you disclosed to third parties for direct marketing purposes, please visit the “Your Privacy Choices” link at the bottom of our website.

California law requires businesses to disclose information regarding the rights of California residents pursuant to the California Consumer Protection Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”) (collectively, “CCPA”). Any terms defined in the CCPA (Cal. Civ. Code Sections 1798.100-1798.199.100) have the same meaning when used in this section. California residents may make the following requests with respect to Personal Information in accordance with applicable law:

Right to Know

You may request that we disclose to you the following information:

The categories of Personal Information we have collected about you;
The categories of sources from which the Personal Information was collected;
The business or commercial purpose for collecting, sharing, or selling Personal Information;
The categories of third parties with whom we share Personal Information;
The categories of Personal Information about you that we have shared or sold (as applicable) and the categories of third parties to which the Personal Information was shared or sold (as applicable);
The categories of Personal Information about you that we have disclosed for a business purpose and the categories of third parties to which the Personal Information was disclosed;
The specific pieces of Personal Information we have collected about you.

Right to Portability

You have the right to request that we provide a copy of the Personal Information we collected about you, in a portable and, to the extent technically feasible, readily usable format that allows transmittal of the data to another entity without hindrance. Once we receive such a request and confirm your identity, we will provide you with a copy of your data as required under the CCPA. We may provide this data through via email to the email address provided by you. If you refuse to provide an email address, we will provide this information through other methods of contact which you have given us.

Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to request that we limit the use of your “Sensitive Personal Information” (as defined under the CCPA) to use that is only necessary to perform the services or provide the goods reasonably expected by you.

Right to Delete

You have the right to request that we delete any Personal Information about and collected from you, and that we direct any service provider to whom we have provided such information to delete such Personal Information from its records. Pursuant to the CCPA, however, your Personal Information may not be deleted under certain limited circumstances. For more information about these and other situations in which we may not delete your Personal Information, please see Cal. Civ. Code Section 1798.105(d).

Right to Correct

Subject to certain exceptions, you have the right to request that we correct inaccurate Personal Information that we collected pertaining to you. Once we receive your request and confirm your identity, we will review the request, taking into account the nature of the Personal Information and the purposes of the processing of the Personal Information to see if we can correct the data. We may also request additional information to show that the information pertaining to the correction inquiry is inaccurate.

Right to Opt Out of the Sale or Sharing of your Personal Information.

You have the right to opt out of the sale of your personal information and to opt out of the sharing of your information for purposes of cross-context behavioral advertising. You may exercise these rights by contacting us using one of following methods: (1) call ……; (2) submit a request to [email protected]; or (3) fill out the form by clicking on the “Your Privacy Choices” link at the bottom of our website.

Non-Discrimination

We will not discriminate against you because you exercised your rights under the CCPA by:

Denying goods or services to you;
Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
Providing a different level or quality of goods or services to you; or
Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

We may, however, charge you a different price or rate, or provide a different level or quality of goods or services, if that difference is reasonably related to the value provided to us by your data.

Persons with disabilities may obtain this notice in alternative format upon request by contacting us at ………or calling ……

Exercising Your Rights

You may make any of the requests listed above by using one of the following methods or by following the process outlined in the section of this Privacy Policy that applies to the region of which you are a resident: (1) calling ……; (2) submitting a request to [email protected]; or (3) filling out the form by clicking on the “Your Privacy Choices” link at the bottom of our website. For fraud detection and security purposes we may ask to verify or authenticate your identity before complying with any such request to the extent permitted by law, including by requesting that you confirm your name, email address, a recent donation or other transaction (as applicable), and other information. Such additional information will be used only for the purposes of verifying your identity and for security or fraud-prevention purposes and will be deleted as soon as practicable after processing your request. Please be aware that if we are unable to verify your identity to the requisite degree of certainty, we will not be able to process your request and will so inform you.

An authorized agent may act on your behalf to submit a request. To use an authorized agent, we may ask that you, or the agent, provide us a written document signed by you authorizing the agent to act on your behalf. In addition, we may request information to verify the agent’s identity. We may deny a request from an agent where we have not been provided proof that the agent has been authorized by you to act on their behalf, or where we cannot verify the agent’s identity. Such requirements, however, will not apply where the agent has a power of attorney pursuant to Cal. Prob. Code Sections 4000 to 4465.

Receipt of requests will be confirmed no later than 15 days after such request is received. Requests will be processed with undue delay, but in all cases within 45 days of receipt of the properly submitted request. The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of requests. In such a case we will inform you of any such extension within the initial 45-day response period, together with the reason for the extension.

Categories of Personal Information

In the preceding 12 months, we have collected the following categories of Personal Information about California residents from the following sources and for the following purposes. In the preceding 12 months, we may have disclosed, for a business purpose, the following categories of Personal Information about California residents to the following categories of third parties (to the extent the disclosure was made to a third party).

Category of Personal Information Collected	Method by Which Information Collected	Business or Commercial Purposes of Collection	Category of Third Party to Whom Personal Information May Have been Disclosed for a Business Purpose
First and last name, address, email address	You providing directly to us, either on our website or by other means	Communicating with you	Third party association management service provider
Bank account numbers, routing or SWIFT numbers, credit card numbers, expiration dates, donation amounts and instructions, e.g. schedule, and related information	You providing directly to us, either on our website or by other means	Processing donations, including recurring and/or automatically donations	Stripe, Inc. and/or other third party payment processors
IP address and device type	automatically	Targeting and optimizing content specifically for you	N/A

Right to Appeal

If you are a resident of any state or jurisdiction that grants you any of the above data access or opt-out rights, and, for any of the reasons explained above, and we are unable to comply with your request or the request of an authorized third party, you may appeal our decision. To appeal any data privacy request decision, please call us at……. or send us an email to [email protected] with the subject line “Data Access Request Appeal.” If you are unsatisfied with our response to your appeal, you may contact your state’s Attorney General or data privacy compliance board to file a complaint. Contact information for Attorneys General in states with data privacy laws is listed below:

California Residents:
Office of the Attorney General
California Department of Justice
Public Inquiry Unit
P.O. Box 944255
Sacramento, CA 94244-2550
(916) 210-6276 / (800) 952-5225 Toll Free – CA only TTY/TDD (800) 735-2929

https://oag.ca.gov/contact/consumer-complaint-against-business-or-company

Colorado Residents:
Office of the Attorney General
Colorado Department of Law
Ralph L. Carr Judicial Building
1300 Broadway, 10th Floor
Denver, CO 80203
Phone: (720) 508-6000