Privacy Policy

1) Who we are

Data controller: Inter-University Center for Japanese Language Studies (IUC), administered by Stanford University. For privacy questions or requests, email [email protected][click to reveal].

The Portal is operated for IUC alumni engagement and administration.

2) Scope

This policy covers information processed through the Portal at alumni‑facing domains, including iucalumni.org. It complements Stanford's Online Privacy Policy and does not cover unrelated Stanford websites or services with their own notices.

3) Information we collect

• Account & authentication: email used for magic‑link login; session tokens/cookies.
• Profile: name, class year, metro area, professional categories, degree/program information, email options, and other profile fields you choose to provide or update.
• Directory visibility flags: your overall visibility setting and field‑level choices.
• Privacy rights requests: data export requests, deletion requests, request status, and admin handling notes.
• Support communications: feedback, bug reports, messages, and optional feedback attachments you send to us.
• Technical: device and usage data such as IP address, browser type, pages viewed, and timestamps collected via our hosting and security providers for operations and security.

4) Where we get it

• Directly from you when you sign in, complete onboarding, or update your profile.
• IUC systems such as our alumni relationship management system (e.g., Salesforce CRM) for record accuracy and administration; the Portal may sync certain profile fields with these systems.
• Service providers that operate our site may generate technical and security logs.

5) How we use information

• Authenticate you and maintain secure sessions (passwordless magic‑link).
• Provide alumni features: private directory, profile management, privacy controls, feedback, and rights request workflows.
• Respect and enforce your field‑level visibility choices within the directory.
• Administer alumni records and keep them up to date, including sync with IUC systems.
• Communicate service notices (e.g., policy updates, security, critical platform changes).
• Monitor, prevent, and investigate fraud, abuse, or security incidents.
• Improve site reliability, performance, and user experience.
• Comply with law and enforce applicable terms.

Legal bases (where required, e.g., EU/UK): consent (for directory visibility), contract (to provide the Portal), legitimate interests (alumni engagement, security, improvement), and legal obligations.

6) How we share information

We do not sell personal information. We share it only as needed to operate the Portal, comply with law, or with your direction.

• Service providers (processors) that help us host, secure, deliver, and support the Portal, including:
  • Hosting & deployment (e.g., Vercel)
  • Database & authentication (e.g., Supabase/Postgres & Auth)
  • Networking, DNS, edge cache, and web application firewall (e.g., Cloudflare)
  • Email delivery for authentication messages (e.g., Resend)
  • Canonical alumni CRM records and profile sync (e.g., Salesforce)
  • Optional object storage for feedback attachments (e.g., Cloudflare R2)
  These providers only process data on our instructions and under appropriate safeguards.
• IUC administrative systems (e.g., Salesforce CRM) for alumni record administration and accuracy. Sync respects institutional rules and your Portal privacy settings.
• Legal and compliance when required by law or to protect rights, safety, and integrity of the Portal.
• Embedded or linked content (e.g., social media feeds) is governed by the third party's own policies when you view or interact with it.

7) Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit, role‑based access, row‑level security (RLS) at the database layer, admin rights-request logging, trusted-origin checks on mutating routes, and vendor-managed infrastructure security. No method of transmission or storage is 100% secure, but we work to protect your information.

8) Retention

We keep personal information for as long as necessary to operate the Portal, administer alumni records, comply with legal obligations, preserve rights-request audit evidence, and resolve disputes. Data export and deletion request records may be retained as compliance records. Administrative Salesforce records may be retained, restricted, anonymized, or deleted according to IUC/Stanford records policy. Operational logs and backups are retained for limited periods according to vendor and disaster-recovery settings.

9) Your choices & rights

• Directory visibility: control field‑level visibility for information shown within the alumni-only directory experience. Portal visibility updates immediately while administrative Salesforce records may be retained or anonymized per institutional policy.
• Profile management: view, correct, or update information you provided.
• Account deletion: request deletion of your Portal account. Administrative alumni records may be retained per institutional policy. Portal deletion or unpublishing removes Portal copies and directory visibility; Salesforce alumni records are not hard-deleted by default and may instead be anonymized or restricted.
• Access & portability: request a copy of your information in a portable format where required by law.
• Regional rights:
  • California (CPRA): rights to know, correct, delete, and to opt‑out of sale/sharing (we do not sell or share for cross‑context behavioral advertising). We will not discriminate for exercising your rights.
  • EU/UK: rights of access, rectification, erasure, restriction, objection, and portability; you may withdraw consent where processing is based on consent.

To exercise rights, contact [email protected][click to reveal]. We may request information to verify your identity before acting on a request.

We target completion of export and deletion requests within 30 calendar days. Where applicable, California requests are acknowledged within 10 business days and substantively answered within 45 calendar days, with extensions where permitted. EU/UK requests are answered without undue delay and no later than one month, with extensions where permitted.

If you are in the EU/UK, you also have the right to lodge a complaint with your local data protection authority.

10) Cookies & analytics

We use essential cookies for authentication, session security, and related portal operations. We do not use marketing or cross-site tracking cookies. Analytics cookies are optional and controlled through onboarding/settings if analytics is enabled.

11) International data transfers

Our service providers may process data in the United States and other countries. We rely on appropriate safeguards for cross-border transfers (for example, Standard Contractual Clauses offered by our providers) and take steps to help protect your information. Where required, we enter into Data Processing Agreements and Standard Contractual Clauses with our service providers to govern cross-border transfers.

12) Children

The Portal is intended for adult alumni and community participants and is not directed to children under 16. We do not knowingly collect personal information from children under 16.

13) Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be noted on this page with a new "Last updated" date and, when appropriate, additional notice.

14) Contact

Questions or requests? Email [email protected][click to reveal].