Legal

Last updated: April 29, 2026

This Privacy Policy explains what information we collect when you use the participatory engagement platform operated by the OUSD Multi-Stakeholder Engagement Group ("OUSD MSEG," "the Group," "we," "us," or "our") at ousd-mseg.org (the "Platform"), how we use it, who we share it with, and what choices you have about it.

We've tried to write it in plain language. Where we use a technical or legal term, we've tried to explain what it actually means in practice.

This Privacy Policy works alongside our Terms of Service. By using the Platform, you agree to the collection and use of information consistent with this Policy.

1. The Short Version

If you only read this section, here's the substance:

• We collect the minimum information needed to run a community engagement platform. Your email, the content you post, and what you tell us in surveys.

• Your email address is private. It is never displayed publicly on the Platform. Only OUSD MSEG administrators with a legitimate operational need can see it.

• We use a privacy-respecting analytics tool (Umami). It does not use cookies, does not identify you personally, and does not track you across other websites.

• We do not sell your personal information. We do not share it with advertisers or data brokers. We do not share it with OUSD or the Board of Education in any form that identifies you individually, except as described in this Policy.

• You can delete your account at any time, and request a copy of your data, through your account settings or by contacting us.

The rest of this document is the longer version, with the disclosures you're entitled to under California law and otherwise.

2. Information We Collect

2.1 Information you provide directly

Account information. When you register, we collect:

• Your email address (used for verification, login, password recovery, and communications you opt into)

• A username or display name (which you choose, and which is publicly visible alongside content you post)

• A password (stored in hashed form — we cannot see it)

• Optional profile details you choose to add (such as a short bio, avatar, or interests)

Content you post. Anything you contribute through the Platform — proposals, comments, survey responses, debate posts, meeting registrations, endorsements, and votes. Public participatory content is, by design, visible to other Platform users and the general public.

Survey and demographic information. From time to time we run surveys, including optional demographic surveys, to help us understand who is and isn't being reached by our engagement work. Participation in these surveys is voluntary. You can skip any question. You can also choose to participate without providing demographic information at all.

Demographic information may include categories that California law treats as sensitive personal information — for example, racial or ethnic origin. We collect this information only when you choose to provide it, only for the purpose of analyzing the inclusiveness of our engagement, and we report it only in aggregate (never tied to your identity in any public output).

Communications with us. If you email us, fill out a contact form, or message us through the Platform, we receive what you send.

2.2 Information we collect automatically

Server logs. When you use the Platform, our servers automatically record technical information including your IP address, browser type and version, operating system, the date and time of your visit, and the pages you accessed. This is standard for any web service and is used for security, debugging, and abuse prevention. Logs are retained for a limited time (see Section 6).

Analytics — Umami. We use Umami for website analytics. Umami is a privacy-focused, open-source analytics tool that we have selected specifically because it does not track individuals. Specifically:

• Umami does not use cookies.

• Umami does not collect personally identifiable information.

• Umami does not track you across other websites.

• Umami collects only aggregate, anonymized data about Platform usage: page views, referrers (the site you came from, if any), general browser and operating system categories, country-level location (derived from IP, then discarded), and screen size.

• IP addresses are used transiently to estimate unique visitor counts and are anonymized; they are not stored or associated with individual users.

This is meaningfully different from analytics tools like Google Analytics, which build behavioral profiles of identifiable users. We chose Umami because it gives us the basic information we need to know whether the Platform is working without surveilling the people using it.

2.3 Information we do not collect

• We do not use third-party advertising or marketing trackers.

• We do not use behavioral advertising pixels, retargeting scripts, or social media trackers.

• We do not collect location data beyond country-level inference from IP for analytics.

• We do not collect biometric, financial, or government-issued identifier information unless a specific verification process requires it (in which case it would be disclosed at the point of collection).

3. How We Use Your Information

We use the information described above to:

• operate the Platform and provide its features (account access, posting content, receiving notifications);

• communicate with you about your account, the Platform, and the Group's work, including newsletters you have opted into;

• understand who is and isn't being reached by our engagement work, in aggregate;

• moderate the Platform, investigate potential violations of our Terms, and respond to security incidents;

• prepare summary reports and aggregate analyses of community input — which may be shared publicly, with OUSD, with the Board of Education, with the press, or with researchers — without identifying individual users;

• comply with legal obligations.

We do not use your information to:

• sell or rent it to third parties (we don't);

• target advertising to you (we don't run ads);

• build personalized profiles for marketing;

• share with OUSD, the Board, or any external party in a manner that identifies you individually, except as described in Section 4.

4. Who Has Access to Your Information

4.1 OUSD MSEG administrators

A small number of Group volunteers serve as Platform administrators. Administrators can see information necessary to operate the Platform — including registered users' email addresses, account activity, and content (including content posted in non-public spaces). Administrators are bound by these privacy commitments and access this information only as needed to run the Platform.

4.2 Other Platform users and the public

Other users (and the general public, for content in public spaces) can see:

• Your username or display name;

• Content you post in public participatory spaces;

• Aggregate Platform statistics (number of participants, proposals, etc.).

They cannot see your email address, your account settings, your private notification preferences, or content you post in any spaces designated as restricted.

4.3 Service providers

We rely on a small number of service providers to operate the Platform:

• A hosting provider that runs the servers the Platform operates on.

• An email delivery service that handles transactional and newsletter emails on our behalf. This provider receives your email address and the contents of emails sent to you so it can deliver them.

• The Umami analytics service described in Section 2.2.

We choose service providers that are appropriate for a privacy-respecting community engagement project. We do not allow service providers to use your information for their own purposes.

4.4 Legal disclosures

We may disclose information when we are legally required to do so — for example, in response to a valid subpoena, court order, or other legal process — or when we believe in good faith that disclosure is necessary to protect the rights, safety, or property of users, the Group, or the public.

We will, where lawful and practical, notify you before disclosing your information in response to legal process so that you have an opportunity to object.

4.5 What we share with OUSD

The Group's purpose is to convey community input to OUSD in a useful form. We do this through aggregate reports, summaries, and synthesized findings. These reports do not identify individual community members.

If you choose to make a public proposal or comment on the Platform, OUSD staff and elected officials may, of course, read it — the same way they can read any public communication. That is the design of the Platform. But we do not provide OUSD with lists of registered users, user-level participation data, or contact information for our community members.

5. We Do Not Sell or Share Your Personal Information

OUSD MSEG does not sell your personal information. We do not share your personal information for cross-context behavioral advertising, as those terms are defined under California law. We do not exchange your personal information with third parties for monetary or other valuable consideration.

We have not done this in the past, and we do not intend to do it in the future. If that ever changes, we will update this Policy and provide you a meaningful opportunity to opt out before any such activity begins.

6. How Long We Keep Information

• Account information is retained for as long as your account is active. If you delete your account, we delete or de-identify your account information within 60 days, except where we are required to retain it longer for legal, security, or fraud-prevention purposes.

• Public content (proposals, public comments, etc.) is retained as part of the Platform's public record even if you delete your account, but you can request that your username be disassociated from it where technically feasible (see Section 8).

• Server logs are retained for up to 90 days for security and debugging.

• Aggregate analytics data (Umami) is retained on a rolling basis as needed to understand longer-term Platform usage trends. It is not associated with individuals.

• Email communications with us are retained for as long as we reasonably need them to address your inquiry and a reasonable period thereafter for our records.

7. Security

We take reasonable measures to protect your information from unauthorized access, alteration, disclosure, and destruction. These include encryption in transit (HTTPS), encrypted storage of passwords, access controls limiting administrator access, and regular software updates.

That said: no internet-connected service can guarantee perfect security. If we become aware of a breach affecting your personal information, we will notify affected users in accordance with California breach-notification law.

You can help by choosing a strong, unique password, keeping it confidential, and reporting any suspicious activity on your account.

8. Your Rights and Choices

8.1 Rights available to all users

Regardless of where you live, you can:

• Access the information in your account through your account settings.

• Update or correct your account information through your account settings.

• Download a copy of your data using the Platform's built-in data export feature (Decidim provides this functionality natively).

• Delete your account through your account settings or by contacting us.

• Manage communication preferences, including unsubscribing from newsletters via the link in every newsletter, or by adjusting notification preferences in your account.

8.2 California residents — additional rights under the CCPA/CPRA

If you are a California resident, you have specific rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know. You can request that we disclose what personal information we have collected about you, the sources of that information, the purposes for which we collected it, and the categories of third parties with whom we have shared it.

• Right to delete. You can request that we delete personal information we have collected about you, subject to limited exceptions (for example, where we need to retain information to complete a transaction, comply with law, or detect security incidents).

• Right to correct. You can request that we correct inaccurate personal information we hold about you.

• Right to limit use of sensitive personal information. To the extent we collect sensitive personal information (such as demographic data you provide in surveys), you can request that we limit our use of it. As described above, we already use such information only for the limited purposes of analyzing engagement inclusiveness and aggregate reporting.

• Right to opt out of "sale" or "sharing" of personal information. As described in Section 5, we do not sell or share your personal information for cross-context behavioral advertising. There is therefore nothing to opt out of, but you have the right to confirm this and to direct us not to begin doing so.

• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

8.3 How to exercise your rights

To exercise any of these rights, contact us using the information in Section 13. We will respond within the timeframes required by applicable law (generally 45 days for California requests, with one extension permitted).

To verify your identity before responding to a request, we may ask you to confirm details associated with your account. We won't ask for more information than necessary.

You can also designate an authorized agent to make a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your identity directly with us.

8.4 "Do Not Track" signals

Some browsers offer a "Do Not Track" setting. Because there is no industry consensus on how websites should respond to this signal, we do not currently respond to it. However, our analytics tool (Umami) does not track individuals across sites in the first place, so the practical concern that "Do Not Track" addresses largely doesn't apply to us.

9. Children's Privacy

The Platform is intended for users 13 years of age and older, as described in our Terms of Service. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly. If you are a parent or guardian and believe your child under 13 has provided us with information, please contact us.

For users between 13 and 18: we treat your information with the same protections as any other user's. We encourage you to review this Policy with a parent or guardian.

The Platform is not the place to discuss specific OUSD students by name or in identifying detail. As stated in our Terms, do not post personally identifiable information about minors — including students other than your own children.

10. International Users

The Platform is operated from the United States, and information you provide will be processed in the United States. If you are using the Platform from outside the United States, you consent to the transfer and processing of your information in the United States. We recognize that the United States may not provide the same data protection standards as some other jurisdictions, and we apply this Privacy Policy uniformly to all users.

11. Third-Party Links

The Platform may include links to OUSD's website, OpenOUSD, news outlets, state agency pages, and other third-party sites. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing them with any information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Policy on the Platform with a new "Last updated" date and, where appropriate, notify registered users by email or through the Platform. The current Policy is always available at ousd-mseg.org/pages/privacy.

If we ever propose to use your information in a materially different way from what is described in the version of this Policy in effect when we collected it, we will provide you with notice and, where required by law, obtain your consent.

13. Contact Us

For privacy questions, requests to exercise your rights, complaints, or anything else related to this Policy:

OUSD Multi-Stakeholder Engagement Group Privacy contact email: engage@ousd-mseg.org

If you have a privacy concern that we have not addressed satisfactorily, you may also have the right to lodge a complaint with the California Attorney General's office or, depending on your jurisdiction, another applicable supervisory authority.