Privacy Policy.

We collect different types of information depending on how you interact with our Platform.

Information you provide directly. When you fill out a contact form, register for an event, sign up for our newsletter, make a donation, or submit a volunteer application, we may collect your name, email address, phone number, mailing address, military service branch or status, and any other information you choose to provide.

Information collected automatically. When you visit our website, we may automatically collect certain technical information, including your IP address, browser type and version, operating system, referring URL, pages visited, time spent on pages, and general geographic location.

Donation information. When you make a donation, payment details are collected and processed by our third-party donation platform. We do not store credit card numbers or full payment details on our servers.

EDC captures photos and videos at its events, including but not limited to The EDC Remembrance Muster, the Back to School Community Event, kayaking and outdoor programming, volunteer activities, and community gatherings. These photos and videos may feature attendees and are used for promotional and organizational purposes in furtherance of EDC’s mission.

Event images and recordings may appear on the EDC website, social media accounts, newsletters, grant applications, print materials, and other organizational communications.

You may appear in group photos, crowd shots, or background footage even if you are not the primary subject of a photograph or video. EDC retains full editorial discretion over all event media and reserves the right to publish, use, and remove images and videos as it determines appropriate in support of its mission.

Image Removal Requests: If you would like to request the removal of a specific image or video in which you appear, please contact us at legal@espritdcf.org. To help us locate and process your request, please include:

• The event name and approximate date the photo or video was taken
• A detailed description of the image or video (e.g., location within the event, clothing worn, people nearby)
• A screenshot or link to the image or video, if available
• An explanation of why you are requesting removal

EDC will make reasonable and good-faith efforts to honor removal requests. However, we cannot guarantee removal from all platforms, third-party websites, cached versions, or materials where the content may have already been published, distributed, or shared. Removal of one image does not constitute an obligation to locate and remove all images in which you may appear across our media library.

For more information about your rights regarding event photography and media, please refer to the Event Photography and Media Release section of our Terms of Service.

We use the information we collect to:

• Provide, maintain, and improve the Platform
• Authenticate your identity and manage your account
• Manage events, volunteer opportunities, and RSVPs
• Respond to your inquiries and provide support
• Process donations and send tax-deductible receipts
• Send newsletters, updates, and information about our mission and activities (with your consent)
• Support internal nonprofit operations including grant applications, program development, and demographic reporting
• Enforce our community guidelines and Terms of Service
• Improve our website, content, and user experience
• Comply with legal obligations and protect our rights

We will never sell, rent, or trade your personal information to third parties for advertising or marketing purposes. EDC does not run advertisements on the Platform and does not monetize user data in any way.

We rely on trusted third-party service providers to operate our Platform and fulfill our mission. These providers may collect or process information on our behalf as described in their own privacy policies. The categories of providers we use include:

• Hosting and infrastructure providers — for website hosting, application delivery, and standard web server logging (including IP addresses and request metadata).
• Database and application backend providers — for storing application data and managing user accounts, where applicable.
• Analytics providers — to understand how visitors use the site in aggregate.
• Donation and fundraising processors — for online giving. When you donate, you interact with the processor directly; payment card data is handled by their PCI-compliant infrastructure and does not touch our servers.
• Transactional email providers — for message delivery (contact-form notifications, receipts, and system emails).
• Merchandise and e-commerce platforms — our online store, when linked, is hosted on a separate platform. Clicking a shop link takes you off our Platform; we do not receive order or payment details from that platform unless you contact us directly.

Each provider maintains its own privacy and data handling policies. We only share the minimum information necessary for these services to function on our behalf, and we review our provider selections periodically.

To sustain Platform operations and further our mission, EDC may display sponsored content, mission-aligned advertisements, and partner promotions on the website. These may include content from veteran-serving organizations, government programs, educational institutions, employers, and other entities whose services align with EDC’s charitable purpose.

We do not sell, rent, or trade your personal information to advertisers, sponsors, or any third party. Sponsored content and advertisements displayed on the Platform are selected and managed by EDC based on mission alignment, not individual user data profiling.

If EDC partners with third-party advertising networks or platforms in the future, those partners may use standard web technologies (such as cookies or pixels) to measure ad performance. Any such partnerships will be disclosed in this Privacy Policy and in the Third-Party Services section above. You will always have the ability to manage cookie preferences through your browser settings.

Aggregate, de-identified usage data (such as total page views or general demographic trends) may be shared with sponsors and partners to demonstrate Platform reach and impact. This data cannot be used to identify any individual member.

Our Platform uses cookies and similar technologies to provide core functionality and enhance your experience. Cookies are small text files stored on your device by your browser.

We use the following types of cookies:

• Essential / authentication cookies — Required for the Platform to function properly, including session management and authentication tokens. These cookies are necessary for you to remain logged in and access protected areas of the Platform.
• Analytics cookies — Help us understand in aggregate how visitors interact with our site.
• Functional cookies — Remember your preferences and settings

You can control or disable cookies through your browser settings. Please note that disabling essential cookies may affect core Platform functionality.

Depending on your location, you may have certain rights regarding your personal information, including the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal information
• Opt out of marketing communications at any time
• Withdraw consent where processing is based on consent
• Request a copy of your data in a portable format

To exercise any of these rights, please contact us using the information provided below. We will respond to your request within a reasonable timeframe.

Your account data is retained for as long as your account remains active. If you do not log in for an extended period, your account will remain in its current state but we reserve the right to remove inactive accounts after providing reasonable notice.

Account deletion. You may request deletion of your account at any time by contacting us at legal@espritdcf.org. Deletion requests are processed within 30 days. Upon deletion, your account, personal information, and all associated data will be permanently removed.

We may retain certain de-identified, aggregate data derived from your information (such as demographic statistics used in previously submitted grant applications) even after account deletion, as this data cannot be used to identify you.

EDC is committed to protecting the privacy of our donors. All online donations are processed by a third-party PCI-compliant donation platform. EDC does not collect, store, or have access to credit card numbers, bank account details, or other payment instrument information on our servers. All payment data is handled entirely by the processor’s payment infrastructure.

When you make a donation, we may receive and retain the following information from the processor for the purposes of issuing tax receipts, donor acknowledgment, and internal record-keeping:

• Your name and email address
• Donation amount, date, and frequency
• Mailing address (if provided for receipt purposes)
• Whether the donation was designated for a specific fund or purpose
• Any comments or messages you include with your donation

Your rights as a donor:

• You may request to view, correct, or delete your donor records at any time by contacting us at legal@espritdcf.org
• You may opt out of donor communications (newsletters, event invitations, fundraising appeals) at any time by unsubscribing from our mailing list or contacting us directly
• We will never sell, trade, or share your donor information with third parties for their marketing purposes
• Anonymous donations are respected — if you choose to donate anonymously through the donation processor, your name will not be publicly displayed

Donor information may be shared in aggregate, de-identified form in grant applications, annual reports, or organizational communications (for example, reporting total funds raised or number of donors). Individual donor identities are never disclosed without explicit consent.

All data transmitted between your browser and our Platform is encrypted using HTTPS/TLS (Transport Layer Security) encryption. This ensures that information you submit — including login credentials, profile data, messages, and any other personal information — cannot be intercepted or read by unauthorized third parties during transmission.

Our database infrastructure encrypts all data at rest using AES-256 (or equivalent industry-standard) encryption. Your stored personal information, profile data, and uploaded files are protected by industry-standard encryption even when not actively being transmitted.

While we employ these security measures to protect your data, no system is completely immune to all threats. We continuously review and update our security practices to maintain the integrity and confidentiality of your information.

We implement reasonable administrative, technical, and physical safeguards to protect your personal information against unauthorized access, alteration, disclosure, or destruction. All data stored in our backend is encrypted at rest and in transit using industry-standard encryption protocols. Authentication tokens are handled securely, and passwords are hashed and never stored in plain text.

However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

We believe in being straight with you about what kind of organization you're trusting with your data.

What we genuinely do:

• Run on managed hosting, backend, email, and payment platforms that handle infrastructure-level security, encryption at rest, encryption in transit, and platform patching on our behalf. These providers are mature, widely used services with their own security practices documented in their respective privacy and security pages.
• Enforce database access rules so a user can only read and modify the records that belong to them (their own profile, submissions, etc.).
• Never store payment card numbers ourselves. All donation payments are processed by our PCI-DSS compliant payment processor and never touch our servers.
• Hash passwords with our authentication provider so even we cannot see them. We never log in as you and never have access to your raw password.
• Keep secrets (API keys, service credentials) out of the public source code repository. They live in environment-variable stores on our hosting and backend platforms, not in the codebase.

What we don't have:

• A dedicated security or compliance team. Esprit de Corps Foundation is a small, primarily volunteer-led nonprofit.
• Formal third-party security certifications such as SOC 2, ISO 27001, HIPAA, or PCI DSS for our own organization. We rely on our service providers' certifications where those apply (for example, our payment processor holds PCI-DSS, and our hosting and backend platforms hold SOC 2 for their managed services).
• An independent third-party security audit or penetration test of our application code at this time.
• 24/7 security monitoring with on-call response. We monitor on a best-effort basis.
• Independent off-site backups beyond what our database and storage providers offer on their respective plans. If your data is critical to you (for example, important documents or messages), please keep your own copies.

If a security incident occurs: We will investigate in good faith, contain the issue as quickly as we can, and notify affected users by email when required by applicable law (such as state breach notification laws). We may not be able to provide the same speed or formality of response as a large for-profit platform.

Our Platform is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information and terminate the associated account as promptly as possible.

If you are a parent or guardian and believe your child has created an account or provided us with personal information, please contact us immediately at the address below.

We may update this Privacy Policy from time to time to reflect changes in our practices, features, or applicable laws. When we make changes, we will update the “Effective Date” at the top of this page. For material changes, we may also notify registered members via email. We encourage you to review this policy periodically.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: