Privacy & Data Stewardship

1. Who we are

“Resilient,” “we,” “us,” and “our” refer to Collective ImpactXP LLC, doing business as Resilient OS.

Resilient develops and stewards human-centered community infrastructure. The hosted platform is referred to as ResilientOS.

Contact:

• Email: info@resilient-os.com
• Mail: Resilient, 4420 N. First #108, Fresno, CA 93726

2. What this policy covers

This policy applies to information Resilient handles through:

• resilient-os.com and its public pages;
• the Resilient Library;
• partnership, contact, and “Find Your Place” forms;
• ResilientOS accounts and authentication;
• support and service communications;
• events, demonstrations, or consultations operated directly by Resilient; and
• technical systems used to operate and protect these services.

This policy does not replace a partner organization’s program-specific privacy notice.

When an organization uses ResilientOS to operate one of its programs or pathways, that organization generally determines why the program information is collected and how it is used. Resilient processes that information to provide, secure, maintain, and support the authorized service.

A program-specific notice, authorization, or signed agreement may provide additional or more protective rules. Those rules control for the applicable information.

3. Information we may collect

Information you provide directly

Depending on how you use Resilient, you may provide:

• your name and preferred contact information;
• organization, role, or professional affiliation;
• information submitted through a partnership or contact form;
• account and profile information;
• communication and notification preferences;
• questions, feedback, or support requests;
• documents or materials submitted through an expressly authorized pathway; and
• other information you choose to provide.

Please do not submit detailed medical information, school records, government identification numbers, financial account information, passwords, victim statements, detailed allegations, or full court records through a general contact form.

Information collected when you use the service

Our systems may collect technical and security information such as:

• Internet Protocol address;
• browser and device type;
• operating system;
• pages or features accessed;
• date and time of access;
• sign-in, authentication, and account events;
• referring page;
• error and performance information; and
• activity needed to detect abuse, protect accounts, and maintain the service.

Information received through an organization

An authorized organization may provide account, membership, role, referral, or pathway information when it has an appropriate basis to do so.

Use of ResilientOS or participation in a network does not itself authorize one organization to disclose information to another.

4. How we use information

Resilient may use information to:

• provide and operate the website and ResilientOS;
• respond to questions and partnership inquiries;
• establish, authenticate, and administer accounts;
• route a request to the organization or person responsible for responding;
• deliver approved communications;
• provide support, training, maintenance, and troubleshooting;
• protect accounts, organizations, participants, and systems;
• detect unauthorized activity, fraud, or abuse;
• maintain records of decisions, permissions, and system activity;
• comply with legal and contractual obligations;
• understand site and service performance; and
• improve Resilient using aggregated, deidentified, or otherwise appropriately limited information.

We do not use information collected for one partner organization to build a participant profile for another organization.

5. How information may be disclosed

Resilient may disclose information in the following circumstances.

To the organization responsible for a pathway

When you submit information through an organization-branded path, the information may be made available to the approved people within that organization who are responsible for reviewing or carrying the work.

The organization’s notice should explain who is responsible and what happens next.

To service providers

We may use carefully selected providers for services such as:

• website and application hosting;
• database and file storage;
• authentication;
• email or approved communications;
• system monitoring;
• error reporting;
• security;
• backups; and
• technical support.

These providers may process information only as necessary to perform their authorized work and are expected to protect it appropriately.

Our current named providers are:

• Vercel — hosting, content delivery, and web analytics;
• Supabase — database, file storage, and authentication;
• Resend and Amazon SES — transactional email; and
• Microsoft — business email.

At your direction

We may disclose information when you ask us to do so or when you provide a valid authorization.

Optional sharing permissions should be specific, separate from ordinary service, and capable of being declined or withdrawn for future activity.

For legal, safety, or security reasons

We may preserve or disclose information when reasonably necessary to:

• comply with applicable law or valid legal process;
• protect the security or integrity of Resilient;
• investigate misuse, fraud, or unauthorized access;
• protect the rights or safety of a person; or
• establish, exercise, or defend legal claims.

In a business transition

If Resilient is involved in a merger, financing, acquisition, reorganization, or transfer of assets, relevant information may be evaluated or transferred as part of that process, subject to applicable law and existing contractual protections.

6. What we do not do

Resilient does not:

• sell personal information;
• use personal information for targeted or cross-context behavioral advertising;
• give one partner organization automatic access to another organization’s records;
• use identifiable personal or partner information to train a general-purpose AI model; or
• treat acceptance of this Privacy Policy as blanket permission for optional communications, publication, research, media use, or external information sharing.

A privacy notice explains practices. It is not a substitute for specific consent or authorization.

7. Cookies, local storage, and measurement

Resilient may use cookies or similar local storage that are necessary for:

• authentication;
• session continuity;
• security;
• saved preferences; and
• reliable operation of the site and platform.

We do not use advertising pixels or cross-site behavioral advertising.

For measurement, Resilient uses one tool: Vercel Web Analytics. It is first-party and sets no cookies. It identifies visitors by a hash derived from the incoming request, with a daily lifespan, and records anonymous aggregate data points only. It is not tied to an individual or to an IP address, and it performs no cross-site tracking.

No error-monitoring, session-recording, CAPTCHA, or advertising technology is present. No third-party scripts run on any public page. Fonts are self-hosted.

8. Browser privacy signals

Resilient does not currently sell or share personal information for cross-context behavioral advertising.

Where required by applicable law, we will treat a legally recognized opt-out preference signal as a privacy request. We do not otherwise respond to browser “Do Not Track” signals because there is not a single universally adopted standard for those signals.

9. Retention

We retain information only as long as reasonably needed for:

• the purpose for which it was collected;
• operation and security of the service;
• an active organizational relationship;
• contractual, legal, financial, audit, or reporting obligations;
• dispute resolution; or
• an approved retention schedule.

Partner-controlled information is retained, returned, exported, or deleted according to the applicable organization’s instructions and signed agreements.

Deleting information from an active system may not immediately remove it from encrypted backups. Backup information is not returned to ordinary use and is removed through the normal backup-expiration process.

10. Security

Resilient uses administrative, technical, and organizational safeguards designed for the information and risk involved.

Those safeguards may include:

• role-based access;
• authentication controls;
• encrypted transmission;
• logging and monitoring;
• restricted support access;
• backups;
• software and security updates; and
• incident-response procedures.

No online system or communication method can guarantee absolute security.

You can help protect information by safeguarding your account, using a private device or email address when appropriate, signing out of shared devices, and notifying us if you believe an account or contact method is no longer secure.

11. Your choices and requests

You may contact Resilient to:

• ask what direct Resilient information we hold about you;
• request a copy where reasonably available;
• request correction of inaccurate information;
• ask for deletion where deletion is available and permitted;
• change communication preferences;
• withdraw an optional permission for future activity;
• ask a privacy question;
• request an accessible or alternative version of this policy; or
• raise a concern about access or misuse.

We may need to verify your identity before acting on a request.

A request may be limited when information must be retained for security, legal, contractual, audit, organizational, or dispute-related reasons. We will explain the response when reasonably possible.

For information controlled by a partner organization, we may direct the request to that organization or assist it in responding.

Send requests to:

info@resilient-os.com
Subject: Privacy Request

12. Children and youth pathways

The general Resilient website is not designed to collect personal information directly from children under 13.

A partner organization that operates a youth pathway must use appropriate age-based notices, permissions, safeguards, and access controls before collecting youth information through ResilientOS.

Youth program information may also be governed by school, court, victim-service, health, grant, or other program-specific requirements.

COPPA applies to child-directed online services that collect personal information and to general-audience services with actual knowledge that they are collecting personal information from a child under 13.

13. Changes to this policy

We may update this policy as Resilient, its technology, or applicable requirements change.

The current version will be posted here with its effective date. When appropriate, we will provide additional notice before introducing a materially different use of personal information.

We will review this policy periodically and whenever a material service or information practice changes.

14. Contact

Privacy questions and requests may be sent to:

Resilient
4420 N. First #108
Fresno, CA 93726
Email: info@resilient-os.com