# Legal

## Policies that protect our members and partners

Comprehensive legal documentation covering Privacy, Terms, Cookies, Acceptable Use, Security, and Copyright policies.

### Latest updates

Updated December 2025 with comprehensive policy content including Cookie Policy, Acceptable Use Policy, and DMCA procedures.

### Privacy Policy

Last updated 2025-12-15

CariClub collects only what we need to connect executives with nonprofit board opportunities. We never sell your personal information. You control your data with access, correction, deletion, and export rights.

- We do NOT sell your personal data
- GDPR & CCPA/CPRA compliant
- 90-day data recovery period after deletion
- Transparent sub-processor disclosures

#### Information We Collect

- Account details (name, email, password)
- Professional information (employment history, education, skills, board experience)
- Profile content (photo, biography)
- Payment information processed securely through Stripe.
- Automatically collected information (device identifiers, IP addresses, browser type, usage data)

### Terms of Service

Last updated 2025-12-15

The agreement governing your use of CariClub. By creating an account, you agree to these terms, including our arbitration agreement and class action waiver.

- 30-day arbitration opt-out window
- Individual arbitration (no class actions)
- Small claims court exception preserved
- Clear IP ownership and licensing

#### Eligibility & Accounts

- Must be at least 18 years old
- Responsible for maintaining account security

### Cookie Policy

Last updated 2025-12-15

CariClub takes a privacy-first approach. We only use essential cookies for authentication and security.

- Analytics cookies NOT currently active
- Marketing cookies NOT used
- Global Privacy Control (GPC) honored
- 30-day notice before activating new tracking

#### Essential Cookies (Active)

- `cc_session`: maintains your authenticated session, expires on browser close
- `cc_auth_token`: stores encrypted authentication token, 7 days
- `cc_csrf_token`: protects against cross-site request forgery, session
- `cc_device_id`: identifies your device for security monitoring, 1 year
- `cc_cookie_consent`: records your consent choices, 12 months

### Acceptable Use Policy

Last updated 2025-12-15

Standards for professional conduct on CariClub. We maintain high standards appropriate for senior professionals.

- Credential accuracy is mandatory
- Three-strike enforcement framework
- Professional conduct expected
- Appeals process available

#### Credential Accuracy

- Accurately state: employment history, titles, dates, educational degrees, and institutions.
- Misrepresentation includes: claiming unearned degrees, fabricating board experience.

### Security Practices

Last updated 2025-12-15

Enterprise-grade security measures to protect your data.

- TLS 1.2+ encryption in transit
- AES-256 encryption at rest
- SOC 2 Type II certification in progress

### DMCA & Copyright

Last updated 2025-12-15

CariClub respects intellectual property rights and complies with the Digital Millennium Copyright Act. Submit takedown notices to legal@cariclub.com.

- DMCA Safe Harbor compliant
- Designated agent registered
- Counter-notification process

#### Filing a Takedown Notice

If content on CariClub infringes your copyright, submit a written notification including your contact information and statement under penalty of perjury.