Legal

Privacy Policy

Attorney-review draft — version 2026-08-03-a

# Privacy Policy — AAPSL

**Status:** Attorney-review draft — not approved for publication  
**Version:** 2026-08-03-a  
**Controller (working name):** NORA Foundation, operating the American Association for Pro Se Litigants (AAPSL) program  
**Privacy contact:** membership@norafoundation.io  
**Mailing address:** [Counsel / operations to complete]  
**Proposed effective date:** [Counsel to complete]

## 1. Scope

This policy describes how the AAPSL public website and membership systems process personal data. It does **not** cover the separate NORA One litigation-evidence software product, which has its own terms if and when offered.

## 2. Data we collect

### 2.1 Membership applications
- Full name
- Email address
- Phone number
- Primary jurisdiction
- Short statement of purpose
- Attestations (community rules; no sealed/confidential posting)
- Optional sponsored-membership explanation
- Optional research-consent flag

### 2.2 Payments
- Stripe customer email and payment metadata
- Stripe Checkout session id and payment intent id  
We do **not** receive or store full payment-card numbers.

### 2.3 Account and security
- Magic-link authentication events
- Session cookies (httpOnly)
- Role (member/admin)
- Approximate IP-derived rate-limit keys (in-memory; not a marketing profile)

### 2.4 Communications
- Transactional emails (application received, magic links, admin notices)

### 2.5 We do not collect in v1
- Case PDF/DOCX evidence vaults
- Sealed court records
- Government ID images for ordinary members
- Precise geolocation
- Marketing pixels beyond optional privacy-preserving analytics if later enabled

## 3. Purposes

- Evaluate and administer membership
- Process dues and sponsorships
- Authenticate users
- Enforce community and safety rules
- Contact applicants/members about their account
- Secure the service and prevent abuse
- With optional consent only: consider anonymized pattern submissions for research publications (not enabled as an automated pipeline in v1)

## 4. Legal bases [Counsel to localize]

Depending on jurisdiction, processing may rely on contract (membership), legitimate interests (security, community integrity), consent (optional research flag; cookies if non-essential), and legal obligation.

## 5. Sharing

We share personal data only with processors needed to run the service:

| Processor | Role |
|-----------|------|
| Stripe | Payment processing |
| Resend | Transactional email |
| Google Cloud (planned hosting) | Application hosting / logs |
| Cloudflare | DNS for `norafoundation.io` hosts |

We do not sell personal information. We do not send membership narratives to model providers in v1.

## 6. Retention

| Record | Working retention |
|--------|-------------------|
| Applications | Active membership term + [Counsel: e.g., 3 years] after closure, unless longer required |
| Payment identifiers | As required for accounting/tax + Stripe’s retention |
| Magic-link hashes | Until used or expired (minutes/hours), then eligible for purge |
| Server logs | [Counsel/ops: e.g., 30–90 days] |

Deletion or anonymization requests: email membership@norafoundation.io. We may retain limited records for fraud, security, dispute, or legal obligation.

## 7. Security

We use HTTPS in production, access-controlled admin functions, hashed magic-link tokens, and least-privilege operational access. No method of transmission or storage is fully secure.

## 8. Your choices and rights

Subject to law, you may request access, correction, deletion, or export of membership data, and may withdraw optional research consent. Authenticate requests will be verified before fulfillment.

## 9. Children

The service is directed to adults. Do not submit information about children beyond what is strictly necessary and lawful; never post juvenile-identifying sealed information.

## 10. International users

Servers are expected to operate in the United States. [Counsel: add transfer language if serving EU/UK users.]

## 11. Changes

Material changes will be posted with a new version date. Continued use after the effective date constitutes acceptance where permitted.

## 12. Contact

membership@norafoundation.io  
[Physical address to complete]