Privacy Policy

1. Information We Collect

What data we gather and why

Personal Information

Name, email address, and profile picture (from Google OAuth or email signup)
Academic information (major, graduation year, student PID, IEEE member ID)
Contact preferences, display settings, and accessibility preferences
Payment information (Zelle details for reimbursements only)
IEEE email address and credentials (when you request an @ieeeucsd.org account)

Activity Data

Event attendance records, check-in codes, food preferences, and participation points
Account creation date, last login time, and authentication method used
Reimbursement requests, receipts, and financial transaction records
Resume files (optional, stored only if you choose to upload for sponsor sharing)
Event files and attachments uploaded by officers

Technical Information

IP addresses (for security and session management)
Browser type, version, and device information
Authentication method (Logto social login or email)
Session cookies for authentication and preference storage (no analytics tracking)

2. How We Use Your Information

The purposes for data processing

We use the information we collect for the following purposes:

Membership Management: Process memberships, track participation, manage user roles and permissions, and provide organizational services
Event Management: Register attendees, track check-ins, manage food preferences, award participation points, and sync with calendar
Financial Operations: Process reimbursement requests, parse receipts using AI, maintain financial records, and manage fund deposits
Career Services: Share resumes with sponsors (only with your explicit consent) and provide networking opportunities
Communication: Send organizational updates, event notifications, reimbursement status updates, and manage IEEE email services
Security: Prevent unauthorized access, detect fraud, maintain system integrity, and protect member data
Legal Compliance: Meet organizational requirements, comply with university policies, and fulfill regulatory obligations

3. Information Sharing and Disclosure

Who has access to your data

Within Our Organization

Officers: Executive and General Officers may access member data for organizational management, event coordination, and reimbursement processing
Sponsors: Silver tier and above sponsors may access resume database (only with your explicit consent)
Webmaster: Receives notifications about IEEE email account creation and system administration

Third-Party Service Providers

Convex (Self-Hosted)

Purpose: Primary database and file storage for the member dashboard
Data Shared: User profiles, event data, reimbursements, resumes, and uploaded files
Location: United States (self-hosted deployment)
Services Used: Convex database and file storage

Logto

Purpose: Authentication and identity management for the member dashboard
Data Shared: Name, email, profile picture, and authentication session data
Privacy Policy: logto.io/privacy

Resend

Purpose: Transactional email delivery service
Data Shared: Recipient email addresses, names, and email content (invitations, notifications, reimbursement updates, event updates)
Privacy Policy: resend.com/legal/privacy-policy

MXRoute

Purpose: Email hosting provider for @ieeeucsd.org accounts
Data Shared: Email account credentials, email content, and mailbox data (only for users who request IEEE email accounts)
Privacy Policy: mxroute.com/privacy-policy

OpenRouter AI

Purpose: AI-powered receipt parsing for reimbursement automation
Data Shared: Receipt images and extracted text data (only when you submit reimbursements)
Privacy Policy: openrouter.ai/privacy

Google Calendar API

Purpose: Event calendar integration and synchronization
Data Shared: Event names, dates, locations, and descriptions (public event information only)
Privacy Policy: policies.google.com/privacy

Legal Requirements

We may disclose information if required by law, court order, subpoena, or to protect the rights, safety, and security of our members and organization. We will notify affected users when legally permitted.

4. Data Storage and Security

Where and how we protect your data

Storage Locations

Primary Storage: Self-hosted Convex deployment (database and file storage) operated in the United States
Email Services: MXRoute servers for IEEE email hosting (location may vary based on service configuration)
Backups: Encrypted backups of the self-hosted Convex deployment for disaster recovery

Security Measures

End-to-end encryption for data in transit (HTTPS/TLS) and at rest
Role-based access controls enforced through server-side Convex functions and dashboard permissions
Regular security audits and dependency updates
Secure authentication using Logto (OpenID Connect / OAuth 2.0)
Automated backups and disaster recovery procedures

5. Data Retention

How long we keep your information

Active Members: Personal information retained while membership is active and account is in good standing
Inactive Accounts: May be suspended or archived after extended periods of inactivity (typically 2+ years)
Event Data: Attendance records and participation history maintained indefinitely for organizational records and leaderboards
Financial Records: Reimbursement data and receipts retained for 7 years to comply with tax and audit requirements
Legal Obligations: Some data may be retained longer if required by law, legal proceedings, or university policies

6. Your Rights and Choices

You have the following rights regarding your personal information:

Access and Portability

Request access to your personal data
Receive a copy of your data in a portable format
Review your account information and activity

Modification and Deletion

Update your personal information
Request correction of inaccurate data
Request deletion of your account and data
Withdraw consent for optional data processing

Resume Management

You may delete your resume from our platform at any time by going to your account Settings page and removing it from your profile. This will prevent your resume from being shared with sponsors in the future.

7. Cookies and Tracking

How we use cookies on our site

We use minimal cookies and similar technologies to provide essential functionality:

Authentication Cookies (Essential) Required for login, session management, and secure access to your account. These cookies cannot be disabled as they are essential for the website to function.
Preference Cookies (Functional) Remember your display preferences (theme, language), accessibility settings, and notification preferences to enhance your experience.
Local Storage Used to cache data locally for offline functionality and improved performance. This includes theme preferences and temporary form data.

8. International Data Transfers

Cross-border data processing

Our primary data storage is located in the United States through our self-hosted Convex deployment. By using our services, you consent to the transfer of your information to the United States.

We ensure that any international data transfers comply with applicable data protection laws (including GDPR where applicable) and maintain appropriate safeguards for your personal information through:

Standard contractual clauses and provider privacy commitments with third-party service providers
Standard contractual clauses with service providers
Encryption and security measures for data in transit

9. Changes to This Policy

How we notify you of updates

We may update this privacy policy periodically to reflect changes in our practices, legal requirements, or new features. Significant changes will be communicated through:

Email notifications to active members
Prominent notices on our website and dashboard
Updated effective date at the top of this policy

10. Contact Information

If you have questions about this privacy policy or our data practices, please contact:

This privacy policy is maintained by IEEE at UCSD, a student organization at the University of California, San Diego. We are committed to protecting your privacy and complying with applicable data protection laws.