Privacy Policy

What this covers

Arkansas Serve is a service-hour tracking and event-discovery platform with a primary audience of public users in Arkansas seeking volunteer service opportunities with contract options for participation in custom service-hour tracking by schools, juvenile services, court departments, and community organizations available by contract. This policy explains what personal information the platform stores, why, who can see it, and what you can ask us to do about it. Much of the information we use and store is entered by users themselves, an organization about its own members or events, or retrieved from public websites and databases. Where organizations input their own information, that organization decides what to collect and who in its staff sees it (with exception for more strict controls over juveniles' personally identifying information ("PII") that has specific privacy requirements that Arkansas Serve complies with). Arkansas Serve stores the provided information and enforces the boundaries described below.

Browsing without an account

You can browse publicly-visible events and the organization directory's public registered organizations without signing in. We do not ask for anything to do that, and we do not use advertising cookies, tracking pixels, or third-party analytics on the site beyond blockers for automated services such as information crawlers.

Two things still happen technically, and are worth saying plainly:

• Our servers keep operational logs of requests (including IP address and browser user agent) through Microsoft's Azure Application Insights, to keep the service running and secure. The site is also served through a content delivery network, which handles requests on our behalf.
• Pages that show a map or an address-suggestion box load Google Maps directly from Google. When that happens, your browser talks to Google, and Google receives your IP address and the request under its own privacy policy. Pages without a map do not load it.

Nothing on the public pages exposes volunteers' personal information: public listings show the event, the location, and the organization's contact details—never rosters, member names, or anyone's volunteer service hours.

Information we securely store about users

Account and identity: Your name (first, last, and preferred name shown to others) and email address. Sign-in itself is handled by Microsoft Entra External ID—Arkansas Serve never receives or stores your password.

Profile: Whether you are a student, adult volunteer, or staff; your date of birth; phone number; and, for students, grade and school.

Home ZIP code: Optional, and asked only so we can suggest organizations near you. We store the five-digit ZIP code and nothing finer—never a street address, and we never ask your device for your location. You can add it, change it, or remove it at any time from your profile, and you can choose to hide it from the administrators of organizations you belong to. See section 12.

For users under 18: Guardian details. Guardian name, guardian email and/or phone, and a record that guardian consent was given. Your date of birth—not the account type you select—determines whether these are required.

Adult volunteers: Emergency contact name and phone.

Organization requirements: Your status against each requirement your organization tracks (waiver signed, training complete, and so on), when it was completed, when it expires, an administrator's note, and—where the requirement calls for evidence—the document you or an administrator uploaded.

May include background-check status when supervising or working with sensitive or at-risk populations such as juveniles. Whether a check is recorded as none, pending, or cleared, and the date completed. This is set by an organization administrator, never self-reported, and the platform does not store the background check itself or any of its contents.

Memberships and roles: The organizations you belong to, your role in each, any group within an organization you are placed in, and which administrators are assigned to oversee you.

Service activity: Events you sign up for, the shift you chose, your answers to any sign-up questions the organizer asked, whether and when you were checked in, hours logged, the date of service, who submitted them, who reviewed them, any review note, and whether the service was approved by any hour-tracking organizations you belong to.

Organization intake answers: Where an organization asks its own intake questions of the volunteers who join it, your answers to them and any documents you upload with them. The organization writes these questions; we restrict them to a fixed set of field types and prohibit questions about health, religion, race or ethnicity, biometrics, government identifiers, and financial details. Answers are deleted three years after they are submitted—see the Data Retention Policy.

Uploads: Verification documents, requirement evidence, event photos, and organization logos that you or an organization upload.

Notifications: In-app messages about your hours and sign-ups. These delete themselves automatically after 30 days. Some notifications include live event information or PII that is restricted only to authorized event organizers and administrators whom you consent to overseeing your activities.

Policy acceptance: The version of Arkansas Serve "Privacy Policy" and "Terms and Conditions" documents you accepted and the time and date you accepted it, recorded by the server as evidence that consent was given at a particular moment.

Information we store about guardians

A guardian does not need to be an account holder to authorize their child or ward. We store the guardian's email address, name, phone if given, which minors they oversee and at which organizations, and their related consent decisions.

Consent records are kept as history rather than as a switch: granting, withdrawing, and re-granting consent decisions are all retained with their dates, along with the version of the documents in force at the time. We also record the IP address the consent was submitted from, as evidence of the attestation—that is captured by our server, never sent by the browser.

Access links and the short sessions they open are stored only as cryptographic hashes, never as usable tokens, so that no one reading the database can act as a guardian.

How we utilize user information stored in our databases

To operate the platform: to show you events, register you, record and verify your service hours, apply your organizations' requirements and consent rules, notify you about your own activity, and let administrators run their rosters and events.

To suggest organizations near you: if you have given a home ZIP code, we use it to order the organizations we suggest by roughly how near they are. That is the only thing it is used for. It does not affect what you are allowed to see or sign up for, and nothing is hidden from you because of it.

To keep the service secure and working: operational logging, diagnosing faults, and investigating misuse.

We do not sell personal information, we do not share it with advertisers, and we do not use it to build profiles for marketing. There is no advertising on the platform. We do not use your personal information to train machine-learning models.

Who can see your information

Arkansas Serve keeps a separate record of you in each organization users belong to. An organization's administrators can see the record users have with them (only after users have joined the organization or otherwise given their consent)—not users' membership in unrelated organizations, not users' hours served elsewhere, and not which organizations control user hour approvals.

Within an organization a user belongs to, its administrators can see the user's profile, the user's organization-based requirement statuses (for that organization), and any documents the user uploaded to support them, the user's answers to that organization's own intake questions and any documents uploaded with them, user sign-ups, and the user's organization-bound service hours, in order to verify them. Administrators assigned to oversee your volunteer hours such as school counselors or officers of the court may receive notifications when you log hours or need approval of hours.

When you sign up for an event run by another organization, that organization sees what it needs to run the event—that you are registered, your name, your shift, your answers to its sign-up questions, and your attendance—and not your records with any other organization.

Guardians see the minors they are linked to, and their own consent decisions. Where a minor has been asked an organization's own intake questions, their guardian sees both the questions and the answers.

Platform administrators (Arkansas Serve staff) can see records across organizations in order to operate and support the service, including through an internal database query tool. Access is strictly limited to staff who need it.

Demonstration data

The platform contains hidden demonstration organizations, members, and guardians used for training and testing. They hold no real personal information, are hidden from everyone except platform administrators, and are periodically deleted and rebuilt. Real accounts are never marked as demonstration accounts and take-over features for demonstration accounts is not available on real accounts.

Listings collected from other organizations' websites

Some event listings are collected from the public web pages and calendars of Arkansas organizations. This process reads only pages a site permits access to, never anything behind a login, and never anything about individuals outside of publicly listed contact information—it looks for the date, place, and description of a public volunteer opportunity.

Collected listings are reviewed before they appear, and keep their attribution and a link back to the original.

Service providers and where information is held

Data is stored in Microsoft Azure in the United States: member, event, and guardian records in Azure Cosmos DB; uploaded files in Azure Blob Storage. Upload containers are private, and a file is shown only through a short-lived signed link generated at the moment it is viewed. Traffic is served over HTTPS.

The providers we rely on:

• Microsoft Azure—hosting, database, file storage, and operational telemetry (Application Insights).
• Microsoft Entra External ID—sign-in and passwords.
• Azure Communication Services—outgoing email, where enabled.
• Google Maps—maps and address lookup, loaded in your browser on pages that show them.
• Cloudflare—content delivery in front of the website.

Email we send

Today the platform sends two kinds of emails: a notice to a member when their logged hours are approved or rejected and guardian access links to provide consent for minors. Everything else appears as an in-app notification.

For guardian consent emails, an organization's administrator requests the link, and it is delivered to the guardian through the site.

We do not send automated emails for marketing purposes, advertisements for events, or promotional material without the express consent and registration of the user to an automated delivery system for notifications or updates.

How long we keep data

In-app notifications delete themselves after 30 days. Everything else is kept until it is removed by an administrator or by us. There is no automatic deletion of member records, service hours, uploads, guardian consents, or audit logs.

Leaving an organization you joined yourself removes your membership record with that organization. Records an organization created and holds—a school roster entry, approved hours a school or court may need to retain—are removed by that organization, not by you leaving.

Audit records of administrator activity are append-only and are deliberately not deleted.

Your choices and rights

See and correct your information. Your profile is visible to you when signed in, and you can edit it unless your organization has locked profile editing—in which case you must ask the administrator contact available for your organization.

You may request for your information or the information of your child or ward to be removed, deleted, or hidden by sending an email to privacy@arkansasserve.com. We will respond within 30 business days informing you the information we have on record and the procedure for removal. Certain data created by registered organizations that is not available to the public may be subject to that organization's removal policy.

Guardians may withdraw consent at any time, which takes effect immediately and cancels the minor's future registrations with that organization, and guardians may ask about the information held about their child.

Leave an organization you joined yourself at any time from the platform.

Control who sees your home ZIP code. If you have given one, your profile has a setting that hides it from the administrators of the organizations you belong to. It is off unless you turn it on. Turning it on does not change the suggestions you are shown—they still use your ZIP code—and it does not remove the ZIP code from your own profile or from the download described above. To remove the value itself, clear the box in your profile and save.

Minors

Arkansas Serve is designed to be used by minors with guardian involvement. A person's minor status is determined from their date of birth, guardian contact details are required, and an organization can require guardian consent on file before a minor may register. Consent decisions are recorded with their dates and the version of these documents in force.

The optional home ZIP code described in section 3 is asked of everyone on the same terms, including minors. It is a five-digit ZIP code and nothing finer, it is never required, and it can be removed at any time. We do not ask any account for a street address, and we never ask a device for its location.

Where school staff use the platform, information about a student may also be an education record under school policy and applicable law, and the school's own rules apply to it.

For specific information related to compliance with recordkeeping obligations under FERPA, COPPA, HIPAA, and Arkansas juvenile record law—including whether the consent mechanism described above satisfies them—you may contact privacy@arkansasserve.com.

Security incidents

If we become aware of a breach affecting personal information held here, we will investigate, take action to contain it, and notify affected people and the organizations whose members are affected without undue delay, as well as any regulator or authority we are required to notify. The specific timeline is in the Arkansas Serve cybersecurity protocol available upon request.

Additional security by organization or use

Organizations such as educational and governmental partners may request additional security measures to be taken for their users, and details about those organizations' additional security measures will be available upon request by authorized affiliated users.

Changes to this policy

This document carries a version. When it changes materially, we bump the version and you are asked to accept it the next time you sign in; your acceptance is recorded as the version and the date.