Privacy Policy

1. Scope and contact

This policy describes how ASCA Initiative (“ASCA,” “we,” “us,” or “our”) handles personal information through ASCA websites, accounts, software, integrations, APIs, support channels, and enabled product modules.

Organizations using ASCA may separately determine how they use organization-scoped records. Their notices and rules may also apply.

Privacy questions and requests may be sent to [email protected].

2. Information we handle

Depending on the services used, ASCA may handle:

• Account and profile information, such as name, email address, authentication records, preferences, and account-security events.
• Organization information, such as membership, role, authorization, configuration, site, eligibility, and administrator records.
• Service and transaction information, such as registrations, events, orders, subscriptions, billing status, rewards, support requests, and audit history.
• Content supplied through a selected workflow, including messages, files, images, forms, reports, and organization-created content.
• Connected-service information, such as identifiers, permissions, server or channel context, and events received from a community, streaming, identity, or other service you connect.
• Device, network, and usage information, such as IP address, browser or device type, timestamps, route activity, request identifiers, security signals, and diagnostics.
• Communications and lead information submitted through contact, partnership, newsletter, donation-interest, support, or feedback forms.

Some workflows may involve sensitive information. Do not submit highly sensitive information unless the feature expressly requests and supports it.

3. Sources

We receive information:

• Directly from you.
• From an organization that authorizes or administers your participation.
• From a connected service you or an organization enables.
• From transactions and service operation.
• Automatically from devices, browsers, security controls, and service logs.
• From support, abuse, safety, or legal reports.

4. Why we use information

ASCA uses information to:

• Create, secure, and recover accounts.
• Provide organization and module functionality.
• Apply permissions, entitlements, usage limits, and configuration.
• Process authorized registrations, transactions, communications, and support.
• Detect abuse, malware, fraud, unauthorized access, and service failures.
• Investigate incidents, enforce platform rules, and support review or appeals.
• Maintain auditability, reliability, backups, and business continuity.
• Measure and improve service quality, safety, accessibility, and usability.
• Meet legal obligations and respond to valid legal requests.
• Send requested operational or marketing communications, with applicable choices.

We do not sell or monetize club-member personal information. ASCA does not authorize customer content to be used for unrelated model training without a separate, explicit, reviewed authorization.

5. Organizations and role boundaries

An organization may control its membership, events, configuration, moderation rules, administrators, and organization records. ASCA provides platform infrastructure and may independently determine processing needed for account security, platform integrity, billing, legal compliance, and service operation.

The legal role of ASCA and an organization may vary by workflow and jurisdiction. This policy does not label every relationship as controller, processor, service provider, custodian, or owner.

Shared identity does not permit one organization to see another organization’s records. ASCA and participating organizations must limit an eligibility or partner disclosure to the information necessary for its stated purpose.

6. Moderation and automated processing

Advanced Moderation and Automated Response (A.M.A.R.) and Moderation And Conflict Resolution Operative (M.A.C.R.O.) may process configured messages, context, images, and supported files to provide moderation or conflict-analysis signals.

These systems can be inaccurate, uncertain, or unavailable. An assessment is separate from an organization policy, human review, moderation decision, and executed action. Organizations choose their rules and authorized workflows within ASCA platform limits.

ASCA describes these services and recipient categories by function. Confidential implementation and security architecture may change without changing the stated processing purpose. Service providers are not authorized to use customer content for unrelated purposes. ASCA uses contractual, configuration, access, and technical controls to limit provider processing and independent retention where supported.

7. Cookies and analytics

ASCA uses essential storage for account access, security, and preferences. Optional analytics or marketing technologies load only according to the choices described in the Cookie Policy.

ASCA’s public site honors its implemented consent control, Global Privacy Control, and Do Not Track handling. Withdrawing optional consent stops future optional loading and removes known analytics identifiers where technically supported.

8. Disclosure and service-provider categories

ASCA may disclose information:

• To the organization responsible for the relevant workspace or workflow.
• To service providers supporting hosting, storage, databases, authentication, communications, billing, security, diagnostics, content-safety processing, file handling, and customer support.
• To connected services at your or an organization’s direction.
• To transaction participants where needed to complete an authorized order, event, benefit, or partner workflow.
• To professional advisers, insurers, auditors, or authorities where authorized and necessary.
• In connection with a valid legal request, safety need, investigation, or organizational transition, subject to applicable restrictions.

We disclose functional provider categories rather than confidential system architecture. We will provide additional provider information where an applicable agreement or law requires it.

9. International processing

ASCA is operated by a private initiative located in Singapore and may support users and organizations in other countries, including the United States and Canada. Service providers and connected services may process information in multiple locations.

ASCA uses appropriate contractual, organizational, and technical measures for cross-border processing where required. A specific transfer mechanism or legal role depends on the service, provider, and jurisdiction.

10. Retention

ASCA assigns information to retention classes based on purpose, organization configuration, service tier, security, dispute, finance, legal preservation, and operational need.

• Customer-visible context is retained according to the selected feature, organization configuration, and applicable plan limit.
• Account and organization records remain while needed to provide the service and manage authorized relationships.
• Transaction, audit, security, abuse, and incident records may be retained longer when needed for reconciliation, investigation, safety, legal preservation, or service integrity.
• Backups and deletion queues may retain protected copies for a limited operational period before secure deletion or de-identification.

Security and service-integrity evidence is not presented as customer context. ASCA reviews retention against the stated purpose and applicable legal or business need. The Data Retention and Deletion Policy provides more detail.

11. Security

ASCA uses layered controls appropriate to the information and risk. These may include encrypted transport, application-level encryption for selected sensitive fields, separation of encryption keys from encrypted records, tenant-scoped authorization, least privilege, private storage, access restrictions, malware and file-safety controls, audit records, and incident response.

No online service can guarantee absolute security. Connected community and streaming services have their own access and data practices. Do not treat ASCA or a connected service as an end-to-end encrypted channel unless that feature is expressly documented.

12. Your choices and requests

Depending on your relationship and applicable law, you may request:

• Access to or a copy of personal information about you.
• Correction of inaccurate information.
• Deletion or de-identification.
• Information about use, sources, or disclosure.
• Withdrawal of consent for future consent-based processing.
• Objection, restriction, or opt-out where applicable.
• Review of an automated or moderation-related consequence.
• An export of supported account or organization information.

ASCA may need to verify identity and authority. Some information cannot be deleted immediately or may be withheld because of another person’s rights, organization recordkeeping, security, fraud prevention, transaction reconciliation, legal preservation, or another lawful exception.

ASCA does not discriminate against a person for exercising an applicable privacy right.

13. Request verification, authorized agents, and appeals

A request must provide enough information for ASCA to identify the relevant person, account, organization, workflow, and records without collecting unnecessary additional information. ASCA may verify a request through an existing authenticated session, a verified contact method, organization authority records, transaction information, or another proportionate method.

An authorized agent may submit a request where permitted. ASCA may require evidence of the agent's authority and may verify the request directly with the individual unless applicable law provides otherwise. Organization administrators cannot exercise an individual's personal rights merely because they have technical access, and an individual cannot use a privacy request to obtain another person's information or confidential organization records.

ASCA will acknowledge and respond within the period required for an applicable request. If additional time is permitted and needed, ASCA will provide the required notice. A response may explain that ASCA does not hold the requested information, cannot verify the request, must preserve specified records, or cannot fulfill part of the request because of another person's rights, security, fraud prevention, legal process, or another applicable exception.

Where an applicable law provides an appeal right, the response will identify the appeal method. A complaint may also be directed to a competent regulator where that right applies.

14. Legal bases and regional processing grounds

The legal basis for processing depends on the person, service, purpose, jurisdiction, and ASCA's role. Where a law requires a stated legal basis, ASCA may rely on:

• performance of or steps requested before entering an applicable agreement;
• consent for a specific optional purpose;
• legitimate interests in providing, securing, supporting, and improving the service where those interests are not overridden by protected rights;
• compliance with a legal obligation;
• protection of vital interests in a qualifying situation; or
• another basis identified in a service- or jurisdiction-specific notice.

Consent may be withdrawn for future consent-based processing without making prior lawful processing invalid. Refusing optional consent will not be treated as refusal of an unrelated service unless the information is genuinely needed for that service and the consequence is clearly presented.

ASCA will not universally label itself or every organization as a controller, processor, business, service provider, operator, or analogous actor. The applicable service record and agreement must assign the relevant role.

15. United States privacy disclosures

Where the California Consumer Privacy Act applies, the categories described in Section 2 are collected from the sources in Section 3 for the purposes in Section 4 and disclosed to the recipient categories in Section 8.

ASCA does not sell personal information or share it for cross-context behavioral advertising. Applicable California residents may request to know, access, correct, or delete information and may exercise applicable rights concerning sensitive information without discriminatory treatment.

Other U.S. state privacy laws may provide rights to access, correct, delete, obtain a portable copy, opt out of certain sale, targeted-advertising, or profiling activity, limit specified sensitive-data processing, use an authorized agent, or appeal a decision. ASCA will apply those rights when the law covers the person, ASCA, and the relevant processing. This notice does not claim that every state law or threshold applies.

ASCA does not offer a financial incentive for personal information unless a separately reviewed program notice describes the material terms, value calculation, withdrawal method, and applicable rights.

16. Browser signals, cookies, and preference controls

The Cookie Policy explains categories of cookies and similar technologies. Where the service and applicable law require it, ASCA will provide a consent or preference control before loading optional technology.

ASCA will process a recognized Global Privacy Control signal according to the implemented control and applicable law. Because no uniform legal or technical standard requires every service to respond identically to a browser's Do Not Track setting, ASCA describes the behavior actually implemented rather than claiming universal support.

Account, browser, device, and connected-service preferences may operate separately. Clearing storage, switching browsers, using another device, disconnecting an integration, or signing out may require the choice to be set again.

17. Children and minors

ASCA is not intended to collect personal information directly from a child who cannot lawfully use the selected service without an approved parent, guardian, school, or organization pathway. Student organizations may include minors, but that does not eliminate age, consent, notice, safeguarding, or organization responsibilities.

If you believe a child provided personal information through an unsupported pathway, contact us so we can review and take appropriate action. A complete service- and jurisdiction-specific minors framework must be approved before a minor-facing workflow is activated.

18. Connected accounts, social login, and public areas

When ASCA operates through a community, streaming, payment, identity, or other connected service, that service may independently receive and handle information under its own terms and privacy notice. ASCA cannot control how information was handled before ASCA received it or how the connected service handles it independently.

ASCA does not represent that a connected service is a confidential or end-to-end encrypted communication channel. A user remains responsible for deciding what information to disclose through an independently operated service.

If a user links an external identity or social account, ASCA receives only the identifiers, profile fields, authorization details, and permissions made available through the approved connection. The user or organization may be able to revoke access through ASCA or the connected service. Revocation stops future authorized access but does not automatically erase records already needed for account security, organization authority, completed transactions, audit, or legal preservation.

Content intentionally published to a public profile, directory, listing, event, post, review, marketplace, or other public area can be viewed, copied, indexed, or redistributed by independent parties. Privacy controls do not guarantee removal from an independent cache, search result, connected service, or copy made before the content was withdrawn.

19. Organizational and business transitions

Information may be reviewed, transferred, segregated, restricted, or preserved as part of an authorized organization leadership change, disputed control, merger, acquisition, financing, restructuring, insolvency, service transfer, or sale of relevant assets. Any recipient remains subject to applicable confidentiality, purpose, notice, contract, and legal restrictions.

A transition does not authorize one organization to obtain another organization's records or permit an outgoing administrator to retain access. ASCA may delay a transfer while authority, ownership, privacy, security, billing, or legal-preservation questions are reviewed.

20. Changes

We will version this policy and identify its publication and effective dates. Material changes require a reviewed notice and, where required, consent or reacceptance. An update becomes effective on the date stated in the published version after any required notice or consent process.

21. Contact and complaints

Send privacy questions, requests, or complaints to [email protected]. Include enough information for us to understand the request, but do not email passwords, payment credentials, government identifiers, medical records, or private moderation evidence.