We collect information in two ways: information you give us directly, and information generated automatically when you use the platform.

We do not collect payment information, precise geolocation data, or any data from minors — this platform is for alumni only.

• To create and manage your member account and authenticate your identity.
• To display your profile in the alumni member directory (visible only to other logged-in members).
• To send you newsletters, event notifications, and important announcements — you may unsubscribe at any time.
• To publish stories or content you submit, attributed to your name as you've provided it.
• To administer events, year-group pages, and community features.
• To detect, investigate, and prevent abuse or activity that violates our Terms of Service.
• To fulfil any other purpose you explicitly consent to at the time of submission.

We will never sell, rent, or trade your personal information to third parties for their own marketing purposes.

We use a small number of trusted third-party services to operate the platform:

• MongoDB Atlas — your account and profile data is stored in a MongoDB database hosted on MongoDB Atlas. Data is encrypted at rest and in transit.
• Cloudinary — profile photos and media uploads are stored and served via Cloudinary's content delivery network. Images uploaded by you are subject to Cloudinary's Privacy Policy.
• NextAuth.js / Google OAuth — if you choose to sign in with Google, we receive only your name and email address from Google. We do not receive your Google password or access to other Google services.
• Vercel — the platform is hosted on Vercel. Server-side request logs may be retained briefly for debugging purposes per Vercel's Privacy Policy.

We retain your account data for as long as your account remains active. If you request account deletion, we will remove your personal information within 30 days, except where we are required by law to retain certain records.

Content you have publicly shared (e.g., stories, comments) may remain on the platform in anonymised or attributed form unless you specifically request its removal.

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS), hashed passwords, and access controls limiting who within GOSA can view administrative data. However, no system is completely secure. We encourage you to use a strong, unique password and to log out after each session on shared devices.

Depending on your location, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate or incomplete information in your profile settings.
• Deletion — request that we delete your account and associated data.
• Objection — opt out of newsletter communications at any time via the unsubscribe link in any email we send.
• Portability — request a structured export of your data in a common format.

To exercise any of these rights, please contact us at info@gosa.org.

GOSA Global uses only essential cookies — specifically, a secure session cookie to keep you signed in. We do not currently use advertising cookies, tracking pixels, or third-party analytics cookies.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify members by email. Your continued use of the platform after changes take effect constitutes your acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy, please reach out to us: