Privacy Policy

Information We Collect

What families give us at enrollment

A parent or legal guardian fills out our intake form and provides:

• The participant's name, date of birth, grade, and school
• Parent or guardian name, phone number, and email address
• Home address or ZIP code
• An emergency contact, and the names of people authorized to pick the participant up
• Health information we need to keep participants safe — allergies, medications, and any medical or accessibility needs
• Demographic information our grant funders require us to report — ethnicity, gender identity, household size, household income range, primary language spoken at home, education level, and whether the household receives public benefits
• Signed permission forms, including the photo and media release and activity waivers

What we record while programs are running

• Attendance for each program day
• Drop-off and pick-up times, and which authorized adult picked the participant up
• Short survey answers about how participants felt about the program

The camp survey is the one place a young person enters information themselves. It runs on a tablet at the program site, supervised by staff, and asks how confident they feel and what they enjoyed. It collects the participant's name so we can match the answers to the right person — never contact information. It is covered by the permission a parent or guardian gave at enrollment.

What adult program participants give us

Adults who enroll in our Multi-Gen programs, such as Workforce Readiness, provide their own contact and demographic details along with information about their education, employment, income range, and access to a computer and internet at home. We use it to place participants in the right program and to report to funders.

What our websites collect

• Newsletter signups — your name and email address, handled by Constant Contact
• Donations — processed by BetterUnite. We receive your name, contact details, and donation amount. We never see or store your full card number.
• Messages you send us through a contact form or by email

What we do not collect

• Social Security numbers
• Payment card numbers — these go straight to our payment processor and are never stored by us
• Precise location or GPS tracking of any kind
• Biometric information, such as face or fingerprint recognition
• Advertising identifiers. We do not build advertising profiles of anyone, and we especially do not build them of children.

How We Use Information

We use what we collect to:

• Run programs safely — know who is enrolled, who may pick a child up, and what allergies or medical needs staff must be aware of
• Communicate with families about schedules, changes, and opportunities
• Track attendance and participation
• Report to the funders who pay for our programs, using aggregated and de-identified data wherever possible
• Understand what is working and improve our programs
• Meet our legal, grant, and audit obligations

We do not sell your information. We do not rent it, trade it, or use it for advertising. We never have, and we do not plan to.

Our Commitment to Responsible AI

The short version: Data Chica, the system that holds participant records, contains no artificial intelligence. No AI scores, ranks, sorts, flags, or makes decisions about any child or family in our programs. People make those decisions.

The longer version, because we would rather be accurate than simply reassuring. Our staff and technical contractors do use AI-assisted tools in their work — for writing software, drafting materials, and administrative tasks. We think about this the way a kitchen thinks about an allergy: the recipe contains no AI, we follow strict rules to keep it out, and we are not going to pretend the tools do not exist in the building. Here are the rules we follow:

• We never enter participant personal information into public, consumer AI chatbots.
• The tools our technical staff use to build and maintain Data Chica work on software code. On limited occasions — troubleshooting a problem or verifying a report before it goes to a funder — a staff member may use an approved professional tool that can reach program data. That access is read-only wherever possible, supervised by a person, limited to what the task requires, and governed by agreements that prohibit using our data to train AI models.
• No AI system makes or influences a decision about a participant. Not enrollment, not eligibility, not attendance, not safety. Every AI output is reviewed by a Latinitas staff member before it means anything — this is the human-in-the-loop standard in our AI Use and Ethics Charter.
• When we publish content that AI helped create, we label it.
• We actively steer these tools away from stereotypes about ethnicity, gender, and language, and we review their output for bias rather than assuming fairness.
• We collect what we need to know, not what would be nice to know.
• If we ever add a feature that uses AI on participant information, we will update this policy and tell families before it launches.

These commitments come from our AI Use and Ethics Charter, which is inspired by the UNESCO Recommendation on the Ethics of Artificial Intelligence and goes into more detail: https://latinitasonline.org/wp-content/uploads/2026/07/AI-Use-and-Ethics-Charter-1.pdf

Children's Privacy

Our programs serve children, so we take this seriously and we follow the Children's Online Privacy Protection Act (COPPA).

• Almost everything we know about a child comes from their parent or legal guardian, who provides it and signs at enrollment. That signature is the consent COPPA requires.
• Children do not create accounts on our systems and cannot log in. There is no child-facing login anywhere in Data Chica.
• The one place a child enters information directly is the supervised camp survey described above. It asks how they felt about camp; it does not ask for contact information; and it is covered by the parent's enrollment consent.
• We ask children for no more information than is reasonably necessary to take part in a program.
• We never sell children's information, never show children advertising, and never share their information with data brokers or marketers.
• Parents and guardians can review, correct, or delete their child's information, and can tell us to stop collecting more at any time.

Cookies and Analytics

Data Chica sets exactly one cookie: a login session cookie for Latinitas staff members who sign in. It contains no advertising or tracking data. Our public forms — enrollment, check-in, and surveys — set no cookies at all. Data Chica runs no analytics, no tracking pixels, no advertising tags, and no session recording of any kind.

Our public websites use WordPress's built-in site statistics to understand which pages people visit so we can improve them. Most browsers let you block or delete cookies in their settings.

We briefly hold visitors' IP addresses in memory to stop automated abuse of our public forms. These are never written to our database and are discarded within the hour.

Sharing Information

We share information in four situations, and no others:

• With Latinitas staff who need it to do their jobs. Access is limited by role — most staff never see full contact or health details.
• With service providers who help us operate, under contracts that allow them to use the information only to provide that service: Google Cloud, which stores our program database in the United States; our website hosting provider; Constant Contact; and BetterUnite.
• With the funders who pay for our programs, such as Travis County — as aggregated, de-identified data. That means counts and percentages: how many participants attended, what age ranges and ZIP codes they represent. Not names.
• When the law requires it, or when someone's safety is at risk. Like all youth-serving organizations in Texas, our staff are mandated reporters and must report suspected child abuse or neglect to the proper authorities.

We do not sell, rent, or trade personal information, and we do not share it with data brokers or advertisers.

Data Security

Protecting family information is a design requirement for us, not an afterthought:

• Data Chica is private and staff-only. Signing in requires a Latinitas email account and Google's secure sign-in.
• Access is role-based. Staff see what their role requires and nothing more.
• Our attendance, check-in, and survey records identify participants by an internal ID number, not by name. Names and contact details live separately, so day-to-day program screens never expose them.
• Information is encrypted while travelling over the internet and while stored.
• Changes to participant records are logged with the staff member who made them and when.
• Reports we send to funders are generated without names.

No system is perfect, and we will not claim otherwise. If a breach ever affects your family's information, we will tell you promptly and explain what happened and what we are doing about it.

Data Retention

• Participant program records: kept for 7 years after a participant's last program, because government and grant funders require us to keep records available for audit.
• Open-ended survey comments written by participants: kept for 20 months, then deleted. These are a young person's own words, and no funder needs them on file for years — so we hold them only long enough to act on what participants tell us. The multiple-choice survey answers, which are what we report on, follow the program-record schedule above.
• Aggregated, de-identified statistics: kept indefinitely. These no longer identify anyone.
• Newsletter subscriptions: kept until you unsubscribe.
• Security and access logs: kept for 7 years.

When a retention period ends, we securely delete the information.

Your Rights

You can always ask us to:

• Tell you what information we hold about you or your child
• Correct anything that is wrong or out of date
• Delete information, subject to the retention rules above
• Stop sending you emails or newsletters
• Withdraw your photo and media release, so we stop using your child's image in new materials

Exercising these rights costs nothing, and we will never treat you differently for asking.

Parent and Guardian Rights

If your child is enrolled in a Latinitas program, you have the right to:

• Review the personal information we have collected about your child
• Correct anything that is inaccurate
• Request that we delete your child's information
• Refuse to allow us to collect any more information about your child going forward

One honest caveat: some information is necessary for us to run a program safely. If we cannot hold an emergency contact or a record of your child's allergies, we may not be able to enroll them. We will always tell you when that is the case rather than quietly dropping the request.

How to Make a Request

The fastest way is our request form at https://datachica.org/privacy/data-request — it asks for what we need to find your records. You can also email us at info@latinitasonline.org or call (737) 396-4567. So that we do not hand a child's information to the wrong person, we will first confirm your identity and your relationship to the participant.

• Acknowledgment: within 5 business days.
• Deletion, after we have verified your identity: within 30 days — unless a legal or educational obligation requires us to retain the records longer.
• If something must be retained, we will tell you exactly what we kept and why.

At this time, account and student data deletion requests are handled manually by our team. We are developing self-service deletion tools for a future release. Until then, parents, guardians, educators, and authorized users may contact us at info@latinitasonline.org, and we will process verified requests within the timeframes above.

Policy Updates

We will update this policy as our programs and technology change. The effective date at the top always tells you which version you are reading.

If we make a significant change to how we handle participant information, we will email families rather than quietly posting a new version. If a change materially affects information we collect from children, we will obtain new parental consent where the law requires it.

Contact Information

Questions about this policy, or about anything we hold? Reach us at:

• Email: info@latinitasonline.org
• Phone: (737) 396-4567
• Mail: Latinitas, Inc., 1023 Springdale Rd Bldg 2C, Austin, TX 78721

A person reads this inbox. You will not be answered by a bot.