What we collect here, and what we do with it.

Scope

This page covers information collected through carescollaborative.org. Information we handle inside an engagement is governed by the agreement with that organization and by the confidentiality obligations described on the Independence page, not by this notice.

Forms and enquiries

We keep what you type into one of our two forms — your name, email address, organization, the broad financial and eligibility categories requested on the access form, and what you tell us about your situation. When you follow one of our own service links into the contact form, we may also store the link’s bounded routing labels: the source page, requested service, and enquiry intent. We add submission, delivery-status, and deletion timestamps. We do not add your network address or browser details to the CARES form record.

Aggregate site measurement and hosting logs

CARES keeps daily aggregate counts for fixed public-route groups and a small set of actions, such as selecting a contact link or successfully storing a form. We also count only the quality bucket—good, needs improvement, or poor—for lightweight browser observations related to largest-content paint, interaction delay, and layout shift. These are directional operational measurements, not an official Core Web Vitals report. Each count contains one fixed route group and one fixed entry-source category: direct, internal, external referral, or campaign. The referring domain and the value of any utm_source parameter are not retained. CARES does not assign a visitor identifier, set an analytics cookie, or store a network address, raw timing, browser detail, form response, diagnostic answer, or calculator entry with these counts. Aggregate counts are deleted after 25 months and are directional rather than a count of unique people.

Like any web host, Netlify necessarily processes request metadata such as your IP address, requested URL, browser user agent, and time of access to deliver and protect the site. Public form and measurement endpoints use Netlify’s IP-and-domain rate limiting to deter abuse. Netlify may retain security and access logs under its own documented practices; CARES does not copy those network identifiers into Supabase with a submission or aggregate measurement.

CARES uses Cloudflare Turnstile on enquiry, access, newsletter-signup, and optional artificial-intelligence report requests to distinguish ordinary human use from automated abuse. When a protected action is available, Cloudflare processes the network address and browser or device signals needed to return a short-lived security token. CARES sends that token and the request network address back to Cloudflare for verification. The token is accepted only for the CARES hostname and the specific action, expires quickly, and cannot be reused. CARES does not put form text, diagnostic answers, calculator values, names, or email addresses in the Turnstile verification request.

CARES also uses Netlify Web Analytics. It derives pageviews, daily unique-visitor counts, broad locations, top pages and sources, missing-resource requests, and bandwidth from Netlify’s delivery logs. Netlify uses network addresses to distinguish unique visitors within a reporting period, but does not add an analytics cookie or client-side analytics code for this service. CARES sees the resulting reports rather than a visitor-level browsing record.

CARES uses Netlify Real User Monitoring on production pages. Netlify adds a small asynchronous script that reports the page pathname without its query string; the measurement name, value, and time; browser and operating-system families; viewport and screen size; device category; production deploy details; and short page-load and event identifiers used to group the measurement. The reporting request necessarily exposes the network address to Netlify. Netlify states that this service does not require a browser cookie. CARES does not send form text, diagnostic answers, calculator values, names, email addresses, or query-string values through this performance measurement. Under CARES’s current plan, both Netlify reporting dashboards show up to 30 days; Netlify controls its underlying log processing and retention under its own terms.

What we do with it. We store the submission, use it to assess and respond to your enquiry or access application, and send the CARES team an inbox notification. We do not use it for unrelated marketing.

Practice Notes by email

Practice Notes by email is a separate choice. The newsletter form asks for an email address, an optional first name, and express consent. We send a one-time link and add the address to the list only after that link is confirmed. We keep the consent version, source and time; confirmation and delivery state; and, when configured, a one-way hash of the requesting network address for abuse prevention. The hash is not used to identify or profile a visitor. Completing an enquiry or access application never subscribes that address.

Resend delivers the confirmation, welcome message, and Practice Notes, and manages the newsletter’s topic preferences and delivery suppressions. Every newsletter includes an unsubscribe link. CARES does not enable open or click tracking for this list and does not use newsletter activity to build a browsing profile.

Individually addressed board invitations

An authorized CARES administrator may use the private administrator panel to send a proposed board member one individually addressed invitation. The administrator enters the recipient’s first name and email address; the subject, sender, reply-to address, website link, and message are fixed. Before delivery, CARES stores the recipient, administrator identifier, purpose, complete rendered message, content hash, delivery state, and provider message identifier as an immutable private record. Resend delivers the message. The address is not added to the Practice Notes audience, and CARES does not add open or click tracking to the invitation.

With the named recipient’s authorization, CARES may send that same fixed message once as a controlled mailbox-placement check and record only whether it appeared in the inbox, promotions, spam, junk, or was not found. CARES does not use provider dashboard test messages for that check because their labels and headers can differ from the production message.

Free tools and local storage

The Readiness Diagnostic, the Allocation Modeler, the Turnover Cost Calculator, and the Caseload & Coverage Stress Test run in your browser. Except for the diagnostic’s separately chosen artificial intelligence feature described below, what you enter remains in that browser’s local storage and is not sent to CARES servers. You can come back to it, and each tool has a control that clears it. It is not encrypted or protected by an account, remains until you clear it or clear the browser’s site data, and may be visible to anyone who uses the same browser profile. Calculator entries and results are not transmitted to CARES servers. Separately, the site sends the fixed aggregate events described above, such as the fact that a tool was started or completed, but never the values entered or the calculated result. The Readiness Diagnostic likewise does not transmit its answers when it produces your private results. Its aggregate usage and performance events do not include answers or calculated scores.

Optional Complete Interpretation Report

If you choose to create the optional AI-assisted Complete Interpretation Report, your browser sends the 40 selected numeric response levels to our server. Our server combines those levels with the instrument version; fixed domain names, purposes, and weights; fixed control and evidence-target text; calculated scores and bands; and any fixed high-consequence flag attached to a control scored zero. That bounded assessment is sent to OpenAI through its application programming interface. We do not send an organization name, your name, an email address, contact information, network address, browser details, or free text. CARES does not save the selected levels, scores, bounded assessment, or resulting narrative in its database. It keeps only limited request identifiers, times, workload and outcome states, and aggregate counters needed to enforce global usage and concurrency limits. Request identifiers and concurrency leases become eligible for deletion after 24 hours and the daily cleanup removes them within 48 hours. Aggregate time-bucket counters become eligible after 14 months and are removed by the next daily cleanup.

The report-specific Turnstile challenge is presented only after you select the report consent box. Its verification is completed before the assessment levels are sent to OpenAI.

OpenAI’s API data-controls policy states that API data is not used to train its models unless the API account opts in. CARES sends store: false, which prevents the Responses API object from being retained as application state. That setting does not eliminate OpenAI’s separate abuse-monitoring logs. By default, those logs may include the bounded prompt and response and may be retained for up to 30 days, or longer when required by law or reasonably necessary to protect its services or a third party from harm. The complete report is optional; your private scores, evidence profile, flags, and starting priorities remain available without it.

What CARES does not do

We do not sell, rent, or trade your information. We do not share it with other organizations for their marketing. We do not use tracking that follows you across other websites. We do not require an account, an email address, or a download form to use the Open Shelf or any tool on this site. CARES does not deploy advertising or analytics cookies and does not use aggregate measurements to build a profile of any person.

Service providers

Netlify hosts and protects the site. Cloudflare provides the Turnstile abuse check described above. This site loads its two typefaces from Google Fonts, which means Google receives your IP address when a page loads. Supabase stores form submissions; the newsletter’s subscriber, consent, delivery, and campaign records; and private board-invitation records. Resend delivers form notifications, newsletter email, and individually addressed board invitations and maintains the corresponding delivery state, contact, topic-preference, and suppression information. If you choose the optional Complete Interpretation Report described above, OpenAI also processes that bounded assessment.

Retention and legal holds

A website enquiry or access application receives a deletion date 24 months after submission and is then automatically deleted. If it becomes an active engagement, grant record, dispute, or another record we are legally required to keep, the relevant information is moved to the appropriate system of record and follows that record’s documented retention schedule instead. When a documented legal obligation requires CARES to preserve a form record, an authorized administrator can apply a legal hold that suspends automated deletion until the hold is released. The current record shows the reason, time, and administrator while the hold is active; those fields are cleared when it is released. A separate append-only audit keeps only the submission reference, applied-or-released action, non-confidential reason, timestamp, and administrator identifier. It does not keep the form body.

An unconfirmed newsletter request is removed after 30 days; its confirmation link expires after 48 hours. We keep an active subscriber record while the subscription is active. Consent, unsubscribe, and campaign audit records are kept for three years; minimal verified suppression records are kept while CARES operates the mailing list so an address is not accidentally added back. Minimal verified webhook-processing records are removed after 90 days. A documented legal hold can suspend the applicable deletion.

We keep each individually addressed board-invitation record, including an authorized mailbox-placement check, for 36 months. A documented legal hold can suspend deletion. The minimal signed webhook-processing record used to deduplicate and audit the Resend event is removed after 90 days under the separate webhook schedule.

Daily aggregate site measurements are deleted after 25 months. They contain no visitor identifier or form, assessment, or calculator content. This 25-month period applies to CARES’s own fixed aggregate counts; the separate Netlify reporting windows are described above.

Your privacy choices

Ask us what we hold about you, ask us to correct it, or ask us to delete it through the contact form or at info@carescollaborative.org. We respond within thirty days. A request may be limited where CARES must preserve a record under law, contract, or a documented legal hold; we will explain that limit when it applies.