Privacy Notice

Scope and controller

The SozoRock Foundation, Inc. is responsible for the personal information described in this notice. Questions may be sent to contact@sozorockfoundation.org.

Information we collect

• Contact information, such as name, email address, location, role, and organization.
• Application information, including the work you want to improve, experience, format preferences, and accommodation requests.
• Program records, including enrollment, attendance, submissions, feedback, support requests, consent records, and completion records.
• Technical information needed to operate and secure the service, such as timestamps, request metadata, logs, device and browser information, and security events.
• Information you choose to provide in messages, forms, files, surveys, or incident reports.

Do not submit sensitive information

Do not submit passwords, authentication codes, medical records, financial account details, government identifiers, confidential employer information, or information you are not authorized to share. If a learning activity requires sensitive information, use a de-identified or fictional example unless written instructions state otherwise.

How we use information

• Review applications and manage cohorts.
• Communicate schedules, decisions, support, and program updates.
• Provide learning activities, feedback, accommodations, and participant services.
• Protect the website, prevent abuse, investigate incidents, and maintain records.
• Improve program content and prepare aggregated or de-identified reports.
• Meet legal, audit, tax-exempt, contractual, and operational obligations.

Legal bases

Where applicable, processing may rely on consent, steps taken at your request, performance of a program relationship, legitimate interests in operating and protecting the Lab, compliance with legal obligations, and protection of vital or public interests. You may withdraw consent for future processing where consent is the applicable basis.

AI and third-party tools

The Lab may use third-party hosting, email, analytics, security, learning, cloud, and AI services. These providers process information under their own terms and privacy practices. The Lab may use OpenAI products and Codex for learning or development activities. Do not place confidential information into a third-party AI service unless you are authorized and the activity expressly permits it.

Sharing

We do not sell or rent personal information. Information may be shared with service providers, authorized facilitators, professional advisers, funders or partners receiving aggregated reports, government authorities where legally required, or another organization involved in a merger, transfer, or reorganization. Public use of a participant name, image, testimonial, or work requires separate permission.

Cookies and analytics

The website uses technologies necessary to deliver, secure, and measure the service. The current public site does not use advertising cookies. See the Cookie Notice for the current categories and controls.

Retention

Application and program records are retained only as long as reasonably needed for review, delivery, reporting, security, legal, audit, and nonprofit recordkeeping. The application database is configured to expire records after approximately two years unless a shorter or longer period is required. Security, consent, transaction, and legal records may be retained longer where necessary.

Security

We use administrative, technical, and organizational safeguards, including restricted access, encryption in transit and at rest, logging, backups, retention controls, service-provider review, and incident response. No system can be guaranteed completely secure.

International transfers

Some service providers may process information in the United States or other countries. Where applicable, we use contractual, technical, or organizational measures intended to protect transferred information.

Your choices and rights

Depending on where you live, you may request access, correction, deletion, restriction, portability, withdrawal of consent, or objection to certain processing. You may also opt out of nonessential email. Submit a request through the Data Rights Request page. We may verify identity and may retain information where required for security, legal, audit, or recordkeeping purposes.

Children

The public application is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the public form. A future youth program would use a separate notice, eligibility rules, and parental or guardian consent where required.

Changes and complaints

We may update this notice as services or laws change. The date at the top identifies the latest revision. Privacy concerns may be sent to the contact above. You may also have the right to complain to a regulator with jurisdiction over your information.