Privacy Policy

Who we are

This platform is operated by Mālamalama Farm and Center, a 501(c)(3) nonprofit charitable organization (EIN 26-1769632) based on the island of Maui, Hawaiʻi — also known as Mālamalama Sustainability Center.

For any question about your privacy or this policy, email info@malamalama.org or write to us at P.O. Box 653, Makawao, HI 96768.

Information we collect

We only collect what we need to run the program fairly and well:

• Account details — your email address, and a password if you choose to set one. You can also sign in with a one-time emailed link instead of a password.
• Profile — your name and an optional profile photo.
• Application information — your date of birth, a government-issued ID for identity and residency verification, proof of residency, your written responses and goals, and the references you provide.
• Program activity — your lesson progress, activity and assignment submissions, and any messages you post in community spaces.
• Basic usage data — privacy-friendly, cookieless analytics about how the site performs. We do not track you across other websites.

We do not collect special categories of information such as health, racial or ethnic origin, religion, or political opinions. We do not buy personal information from third-party data brokers.

How we use your information

• To review and decide on applications.
• To run the program — track your progress, deliver the curriculum, and connect mentees with mentors.
• To communicate with you — sign-in links, application updates, and program notifications.
• To keep the platform secure and prevent misuse.
• To understand and improve how the program works.

We do not sell your information, and we do not use it for advertising.

How we make decisions about applications

Applications are reviewed and decided by program staff — real people, not automated systems. We do not use any algorithm, AI tool, or automated profiling to accept or reject applicants.

Who handles your information

We use a small number of trusted service providers to operate the platform. They process data only on our behalf and only to provide their service:

• Supabase — database, sign-in, and secure file storage.
• Vercel — website hosting, content delivery, and performance analytics.
• Resend — delivery of program emails such as sign-in links and notifications.

These services store data on servers in the United States. Program staff, mentors, and reviewers can see your application and progress information when they need it to support you. We may also disclose information if the law requires it.

How we protect your information

Information is encrypted while it travels to and from the site. The database enforces row-level security, so members can only see their own information. Uploaded government IDs are kept in access-controlled storage and are only viewable by the small number of staff who review applications. When you set a password, we check it against a database of known breached passwords without ever sending us your actual password — only a short, irreversible fragment is used for the check.

How long we keep it

We keep different kinds of information for different lengths of time:

• Government-issued ID — kept only until your application decision is finalized, and deleted within 60 days of that decision. You can ask us to delete it sooner if your application is in progress.
• Application and program records — kept while your account is active and for up to seven years afterward for program reporting and impact measurement (the program receives public support from the County of Maui).
• Community messages — kept while the community space exists; you can delete your own messages at any time.

You can ask us to delete your information at any time — see your choices below.

Program emails and announcements

We will send you operational emails about your application and the program — sign-in links, status updates, lesson reminders, and mentor messages. These are part of taking part in the program and do not have an unsubscribe link (you can close your account to stop receiving them).

If we ever add a program newsletter or announcement list, we will ask you to opt in clearly, and every newsletter will have a one-click unsubscribe link.

Your choices and rights

You can ask us at any time to:

• See the information we hold about you.
• Correct anything that is wrong.
• Delete your account and information.
• Receive a copy of your data in a portable format.
• Withdraw an application that is in progress.

To make any of these requests, email info@malamalama.org. We respond within 30 days and do not charge a fee for reasonable requests.

Your rights in specific regions

California residents — under the California Consumer Privacy Act, you have the right to know what information we collect, to delete it, to correct it, to opt out of any sale or sharing (we do neither), and to receive equal service regardless of whether you exercise these rights. Email us using the address above to make a request.

European Economic Area, United Kingdom, and Switzerland — under GDPR and UK GDPR, you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to lodge a complaint with your local supervisory authority. Our legal basis for processing is the contract you enter when you apply to the program, and your consent for any optional items.

Applicants under 18

The program is open to applicants who are at least 16 years old. If you are under 18, please review this policy together with a parent or guardian before applying. We do not knowingly collect personal information from anyone under 16; if you believe a child under 16 has provided us with information, please contact us and we will delete it.

Cookies and analytics

We use only the essential cookies needed to keep you signed in. Our analytics do not use cookies and do not identify you personally. We do not place advertising trackers and we do not allow third parties to track you through our site.

Security incidents

We take reasonable steps to keep your information safe, but no system is perfectly secure. If we discover a security incident that materially affects your personal information, we will notify you and the relevant authorities as required by law.

Changes to this policy

If we update this policy, we will change the effective date at the top and, for significant changes, let you know by email before the change takes effect.

Contact us

Questions about your privacy? Email info@malamalama.org or visit our contact page.