Information we may collect

Depending on the feature you choose to use, we may receive contact information, organization or community information, program or partnership interests, member preferences, event information, transaction records when commerce is enabled, and technical information needed to operate and secure the website.

Our approved low-risk MAGA Native Forms are designed to collect only the minimum information needed for human review. Public forms should not be used to send passwords, payment-card numbers, government identification images, medical records, confidential research protocols, or other highly sensitive records.

Protected and sensitive workflows

Detailed youth, veteran, reentry, participant, research-enrollment, genealogy, oral-history, clinical, legal, and other protected workflows are not automatically opened just because a page exists. Those workflows remain behind separate privacy, consent, access, retention, and human-review controls until the applicable safeguards are approved and tested.

This general website Privacy Policy does not replace a program-specific Notice of Privacy Practices, informed-consent document, authorization, research notice, participant agreement, or other disclosure if one is legally or contractually required for a particular entity, program, partner, data flow, or activity. MAGA software does not declare that HIPAA, the Common Rule, or another specialized privacy/research regime applies; that applicability is reviewed for the actual activity and parties before a protected workflow is opened.

How we use information

• Respond to inquiries and route requests to the appropriate human reviewer.
• Operate accounts, memberships, events, programs, partnerships, and other requested services.
• Maintain consent, retention, security, troubleshooting, and audit evidence.
• Improve site navigation, accessibility, content relevance, and service planning using minimized first-party signals.
• Meet legal, contractual, grant, accounting, security, or recordkeeping obligations when they apply.

Native forms, pilot interest, consent, and retention

MAGA Native Forms store approved submissions privately in WordPress and maintain minimized lifecycle evidence in the MAGA data layer. The low-risk native-form operating policy uses an administrator-configured retention review window, with bounded manual anonymization for closed records. A record may need to be retained longer when a legitimate security, legal, contractual, grant, audit, or dispute-preservation obligation requires it.

Consent is tied to the stated purpose of the form. A public inquiry or pilot-interest form does not authorize unrelated marketing, clinical care, human-subject research enrollment, research eligibility decisions, regulated cannabis activity, or the handling of protected records. If a later pilot needs health, research, minor-related, regulated, or other protected information, it must use a separately governed workflow and the applicable notices, approvals, consent/authorization, access, retention, incident, and human-review controls.

Artificial intelligence and external tools

Raw protected MAGA form submissions are not sent to external AI or generic MCP tools. MAGA deterministic policy and Smart Logic run first and remain the authorization layer over any connected provider. When an administrator intentionally uses an approved AI provider for a permitted task, MAGA is designed to send only the minimum public or explicitly sanitized information allowed for that task. A provider cannot authorize its own data access, publication, eligibility decision, certification, enrollment decision, or release; consequential decisions remain subject to human review.

Service providers and payment services

We may use hosting, security, email, event, commerce, payment, analytics, accessibility, and other service providers as needed to operate the website. A payment provider may process payment details directly under its own privacy terms when a payment feature is enabled. MAGA Native Forms are not designed to store full payment-card data.

Cookies and account sessions

WordPress and connected site features may use cookies or similar browser storage for login sessions, security, preferences, cart or checkout functions, and basic site operation. Optional analytics or marketing technologies should be enabled only when their purpose and consent requirements have been reviewed.

Your choices and requests

You may ask about information you submitted, request correction where appropriate, or ask us to review retention or deletion options. Some records may need to be preserved when law, security, contracts, grants, audits, disputes, or other legitimate obligations require it. Use the site contact pathway and do not include sensitive records in a general request.

Children, youth, and person-safety information

General public forms are not intended to collect sensitive information from or about minors. Youth-related services and storytelling require separate governance, consent, access, and human-review controls before detailed intake is opened.

We do not intentionally use public pages or general public forms to publish or solicit private participant or staff rosters, residential addresses, personal schedules, person-specific precise locations, nonpublic personal contact lists, security or access instructions, credentials, or sensitive case/vulnerability details. Safety-sensitive information belongs only in an approved restricted workflow with purpose limitation and need-to-know access.

Security and changes to this policy

We use administrative, technical, and workflow controls intended to reduce unnecessary exposure of information, including private submission storage, role-based review, minimized evidence logs, and restrictions on external AI forwarding. No website can promise absolute security. We may update this policy as our services, vendors, legal obligations, or data practices change, and material revisions should be reviewed before publication.