Privacy Policy
1. About This Policy
Alabama Possible is a statewide nonprofit organization working to remove barriers to education and prosperity for Alabamians. Achieving that mission depends on trust — the trust of the students we reach, the families who support them, the educators and institutions we partner with, and the funders who invest in this work. Careful stewardship of personal information is how we earn and keep that trust.
This Privacy Policy describes the personal information Alabama Possible collects, how we use and share it, how long we keep it, how we delete it, and the rights and choices available to you. It applies to:
Our website — alabamapossible.org and any other site or online service we own or control that links to this policy.
Our social media presence — the pages and accounts we maintain on third-party platforms, and the information those interactions generate.
The Alabama Direct Admission Initiative — student information we receive through the EAB Edify data platform and from participating schools, districts, and postsecondary institutions, and the outreach we conduct using it.
Information from other partners — personal information that reaches us from partner organizations, funders, coalitions, and service providers under written agreement.
Our communications — email, text message, mail, events, surveys, and program correspondence.
This policy does not apply to the privacy practices of the third parties whose platforms, sites, and services we use or link to. Those organizations operate under their own policies.
2. Terms That Govern Our Use of Information
Different bodies of law and different agreements govern different parts of the information we hold. This section states which terms apply where, because those terms also set the limits on what we can promise in the rest of this policy.
2.1 Student information under the Alabama Direct Admission Initiative
Student information reaching us through the Alabama Direct Admission Initiative is governed by our written data sharing agreement with EAB, which hosts the initiative's dataset on its Edify platform, and by agreements with participating schools, districts, and institutions. Under those terms:
We may use student information only for college access outreach, program administration, engagement tracking, and aggregate reporting, as detailed in Section 4.
We may not transfer student information to any party that is not authorized under the applicable agreement.
We may not retain or use student information beyond the term of the applicable agreement without renewed written authorization.
Where a school or district provides information that constitutes an education record under the Family Educational Rights and Privacy Act (FERPA), we act as an authorized party under that school's or district's direction, and FERPA's protections travel with the information.
Our internal Student PII Privacy Protection Policy sets the operating standards our staff and contractors follow when handling this information — role-based access, multi-factor authentication, approved storage locations, encrypted transmission, confidentiality agreements, and annual training. A copy is available on request.
2.2 The refreshed dataset
The Alabama Direct Admission dataset is not static. It is refreshed periodically from source systems, which means a student record removed from one version of the dataset can be re-supplied in a later refresh. Section 9 describes the suppression mechanism we maintain so that a withdrawal or deletion request continues to be honored across every subsequent refresh.
2.3 Website terms
Use of alabamapossible.org is also subject to any terms of use posted on the site. Where a written agreement between Alabama Possible and your organization addresses privacy or data handling, that agreement governs to the extent it conflicts with this policy.
2.4 Governing law
This policy is administered under the laws of the State of Alabama and applicable federal law, including FERPA and the Alabama Notification Act of 2018.
3. Personal Information We Collect
3.1 Information you provide to us
You may give us personal information directly through our website, at events, by email or text, or in the course of a program. That information includes:
Contact information — name, email address, mailing address, phone number, and the school, district, institution, or organization you are affiliated with.
Registration information — details you provide when you register for an event, conference, training, webinar, or program, including accessibility and dietary requests.
Subscription and marketing preferences — the newsletters, alerts, and updates you choose to receive, and how you engage with those communications.
Donation and supporter information — the information needed to process and acknowledge a contribution. Payment card numbers are handled by our payment processor and are not stored on Alabama Possible systems.
Correspondence and feedback — the content of messages you send us, including questions, survey responses, testimonials, and program feedback.
Application and participation information — information submitted in connection with a program, fellowship, scholarship, grant, or volunteer role.
Other information — information not specifically listed here that we collect with notice at the time of collection.
3.2 Information collected automatically on our website
When you visit alabamapossible.org, we and our service providers may automatically log technical information about your visit: device type and model, operating system, browser type, screen resolution, device identifier, IP address, general location such as city or state, the page that referred you, the pages and screens you viewed, how long you spent on them, the paths you followed, and the times of access.
This information is collected using cookies, browser web storage, web beacons, pixels, and similar technologies. Our emails may also contain web beacons that tell us whether a message was opened and which links were followed. Section 8.4 describes how to manage these technologies.
3.3 Information from social media platforms
We maintain pages and accounts on third-party platforms such as Facebook, Instagram, LinkedIn, X, YouTube, and TikTok. When you visit, follow, comment on, message, or otherwise interact with those pages, the platform provider's own privacy policy governs its collection and use of your information.
The platforms may make information available to us — for example, aggregate audience insights, the public profile information attached to a comment, or the contents of a direct message you send us. We treat information we receive this way in accordance with this policy. Where we run advertising or promoted content, we may provide a platform with an email list so it can match audiences; we do not authorize platforms to use those lists for any purpose other than delivering our own content, and we do not include student information from the Alabama Direct Admission Initiative in any advertising audience.
3.4 Student information from the Alabama Direct Admission Initiative
Through the Alabama Direct Admission Initiative, Alabama Possible receives a deliberately limited set of student information to conduct college access outreach. The table below states what we receive and why.
-
Received: Yes
Purpose: Personalized outreach communications -
Received: Yes
Purpose: Direct communication with students -
Received: Only where provided and consented.
Purpose: Text message outreach, where the student has opted in -
Received: Yes
Purpose: Targeting outreach to the correct cohort and reporting by school -
Received: Yes
Purpose: Informing students of the offers available to them and tracking program outcomes -
Received: Generated by us
Purpose: Measuring outreach effectiveness and avoiding duplicate messages -
Received: No — not collected
Purpose: Not applicable -
Received: No — not collected
Purpose: Not applicable -
Received: No — not collected
Purpose: Not applicable -
Received: No — not collected
Purpose: Not applicable -
Received: Yes
Purpose: Scholarship trends and support -
Received: Yes
Purpose: Language support -
Received: Yes
Purpose: Residency and scholarship support -
Received: Yes
Purpose: Align proactive advising outreach supports -
Received: Yes
Purpose: Impact measures for internal and external reporting
3.5 Information from partners, funders, and service providers
We receive personal information from other organizations in the ordinary course of our work:
Partner organizations and coalitions may share contact information for educators, counselors, community leaders, and program participants so that we can coordinate services, convene participants, or conduct joint outreach.
Schools, districts, and institutions may provide rosters, counselor contacts, or participation lists in support of a specific program.
Funders and grantmakers may share contact information in connection with grant administration, convenings, and reporting.
Service providers — including our email platform, text messaging platform, event registration system, donor database, and analytics providers — generate and return information about how individuals interact with our communications.
Publicly available sources — such as institutional directories and public agency data — may supply professional contact information for outreach to educators and partners.
Our use of information obtained from a partner is limited by our agreement with that partner. Where an agreement is more restrictive than this policy, the agreement controls.
4. How We Use Personal Information
We use personal information for the purposes below and as otherwise described at the time of collection.
4.1 To deliver our programs and services
Conducting college access outreach, including notifying students of admission offers, deadlines, financial aid opportunities, and FAFSA completion support.
Connecting students and families with resources, guidance, advisers, and partner services.
Administering events, trainings, conferences, scholarships, fellowships, and volunteer programs, and communicating with participants about them.
Responding to questions, requests, and feedback.
Sending administrative messages such as registration confirmations, schedule changes, and service notices.
4.2 To communicate about our work
Sending newsletters, program updates, policy briefs, research releases, event invitations, and fundraising communications to people who have asked to receive them or who have an existing relationship with us, as permitted by law.
Personalizing what we send so that it is relevant to your role, region, and interests.
Measuring whether our communications reach and serve their audience.
4.3 To measure, evaluate, and report
Tracking outreach activity and engagement to evaluate program effectiveness and improve program design.
Reporting aggregate, non-identifiable program metrics to funders, partners, boards, policymakers, and the public.
Conducting research and evaluation, including with academic or evaluation partners under written agreement, using de-identified or aggregated data wherever the research question allows.
4.4 To operate and improve our website and systems
Operating, maintaining, securing, and improving alabamapossible.org and our internal systems.
Understanding which content and resources are useful so that we can invest accordingly.
Diagnosing technical problems and protecting against fraudulent, unauthorized, or unlawful activity.
4.5 To meet legal and organizational obligations
Complying with applicable law, lawful requests, subpoenas, audits, and grant requirements.
Establishing, exercising, or defending legal claims, and protecting the rights, privacy, safety, and property of students, staff, partners, and the organization.
Maintaining the records our funders, auditors, and governing board require.
4.6 To create de-identified and aggregate data
We create anonymous, aggregated, and de-identified data from personal information by removing the elements that make it identifiable to an individual. We may use and share that data for lawful organizational purposes, including public reporting and program improvement. We do not attempt to re-identify data once it has been de-identified, and we require the same of anyone who receives it from us.
4.7 Limits on use of student information
Student information from the Alabama Direct Admission Initiative is subject to the narrower limits set by Section 2.1. In particular, we do not use it for fundraising solicitation, commercial marketing, advertising audiences, or any purpose unrelated to college access.
6. Text Message Communications
Where we use text messaging to reach students and program participants, the following terms apply.
Message frequency varies by program. Standard message and data rates apply. Mobile carriers are not liable for delayed or undelivered messages.
We send text messages only to individuals who have opted in, or where the sending is permitted under the terms of the program and applicable law.
No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from every category of sharing described in Section 5 and are not shared with any third party.
You may stop text messages at any time by replying STOP to any message, or by contacting us at the address in Section 15. Replying STOP ends messages from that number; if you receive messages from more than one Alabama Possible number, reply STOP to each. Reply HELP to any message for assistance.
A STOP reply is recorded as a communications withdrawal and processed under Section 9.
7. Cookies, Analytics, and Tracking
Most browsers accept cookies by default and allow you to review, delete, and block them in settings. If you decline cookies, parts of our website may not function as intended. Guidance on managing cookies is available at allaboutcookies.org.
We use analytics providers to understand how our website is used. Where those providers offer an opt-out mechanism, it is available through the provider directly.
Some browsers send a “Do Not Track” signal. There is no common industry standard for responding to these signals, and we do not currently respond to them. Information about Do Not Track is available at allaboutdnt.com.
8. Your Rights and Choices
The rights below are available to everyone whose personal information we hold, regardless of where you live. We do not charge a fee, and we do not require you to create an account to exercise them.
-
What it means: Ask what personal information we hold about you and where it came from.
How to exercise it: Contact us using Section 15
-
What it means: Ask us to correct information that is inaccurate or incomplete.
How to exercise it: Contact us using Section 15
-
What it means: Stop receiving some or all messages from us while remaining eligible for program services.
How to exercise it: Unsubscribe link, reply STOP, or contact us
-
What it means: Stop participating in a program, including the Alabama Direct Admission Initiative, and stop related outreach.
How to exercise it: Contact us using Section 15
-
What it means: Ask us to delete the personal information we hold about you, subject to the limits in Section 9.6.
How to exercise it: Contact us using Section 15
-
What it means: Receive a copy of the information we hold about you in a readable format.
How to exercise it: Contact us using Section 15
-
What it means: Ask how a decision, communication, or data source applies to you, and receive a substantive answer.
How to exercise it: Contact us using Section 15
8.1 Marketing email
Every marketing email we send carries an unsubscribe link. You may also write to us. You will continue to receive messages that are administrative rather than promotional — for example, a confirmation for an event you registered for — unless you ask us to stop those as well.
8.2 Program outreach
A student who no longer wishes to hear from Alabama Possible through the Alabama Direct Admission Initiative may say so in a reply to any message or by contacting us directly. Withdrawing from outreach does not affect any admission offer a student has received, and does not affect the student's standing with any school, district, or institution. Section 9 explains exactly what happens next.
8.3 Choosing not to provide information
Where we need particular information to provide a service — registering you for an event, processing a donation acknowledgment, matching a student to a program — we will tell you at the point of collection. If you decline to provide it, or later ask us to delete it, we may not be able to provide that service.
8.4 Parents and guardians
A parent or guardian may exercise any of the rights above on behalf of a student in their care. We will verify the relationship before acting on the request, using the least intrusive method available. Section 12 describes our practices for younger students.
9. Withdrawal and Deletion Process
This section describes exactly how Alabama Possible handles a request to stop communications or to delete personal information, including the copies that live outside the refreshed Alabama Direct Admission dataset — exports, mailing lists, working files, backups, and copies held by partners. Publishing these steps and timelines is how we hold ourselves to them.
9.1 How to submit a request
A request may be submitted in any of the following ways, and no particular wording is required:
Replying to any email from us with a request to be removed, or using the unsubscribe link in that email.
Replying STOP to any text message from us.
Emailing our privacy contact at the address in Section 15.
Writing to us at the mailing address in Section 15.
Asking a partner school, district, counselor, or institution to relay the request to us on your behalf.
Tell us whether you want communications stopped, information deleted, or both. If a request is ambiguous, we treat it as a request to stop all communications immediately while we ask you what else you want done.
9.2 What happens, and when
Every request follows the same sequence. The clocks below run from the day we receive the request, and each step is logged.
-
What we do: We confirm receipt in writing, identify the request as a withdrawal, a deletion, or both, and give it a tracking reference.
Timeline: Within 5 business days
-
What we do: We confirm the request comes from the individual or an authorized parent, guardian, or representative, using the least intrusive method that establishes the connection.
Timeline: Within 5 business days of acknowledgment
-
What we do: We add the individual to our permanent suppression list, which blocks every outbound email and text message across every platform we use. This happens before any other step, so that no further messages are sent while the rest of the request is processed.
Timeline: Within 2 business days, and no later than 5 business days
-
What we do: We remove or, where a record must be retained, mark as deleted the individual's information in our active systems: constituent and donor database, email platform, text messaging platform, event registration system, and program tracking tools.
Timeline: Within 10 business days
-
What we do: We locate and purge exports, spreadsheets, shared drive files, mailing lists, ad audiences, and other working copies, as detailed in Section 9.3.
Timeline: Within 30 calendar days
-
What we do: We instruct any partner, subcontractor, or service provider holding a copy to carry out the same deletion and to confirm it in writing.
Timeline: Notice within 10 business days; written confirmation within 30 calendar days
-
What we do: For Alabama Direct Admission requests, we notify EAB so that the request is honored at the source, and we record the suppression locally so it survives every future refresh, as described in Section 9.4.
Timeline: Within 10 business days
-
What we do: Backup and archival copies are purged on our regular backup rotation. Until a backup expires, the information is retained solely for disaster recovery and is not used for any other purpose.
Timeline: Within 90 calendar days
-
What we do: We send written confirmation describing what was deleted, what was retained and why, and which partners confirmed deletion.
Timeline: Within 45 calendar days of the request
9.3 Copies outside the refreshed dataset
A deletion request is only meaningful if it reaches every copy. The Executive Director maintains an inventory of the locations where personal information can come to rest, and each request is worked against that inventory. The table below lists those locations and the action required.
-
Action on a deletion request: Contact deleted from all audiences and segments; email address added to the platform's permanent suppression list so that a future import cannot re-add it.
Timeline: 10 business days
-
Action on a deletion request: Number removed from all campaigns and added to the platform's opt-out list.
Timeline: 10 business days; STOP replies process immediately
-
Action on a deletion request: Record deleted, or anonymized where a transaction record must be retained for audit — see Section 9.6.
Timeline: 10 business days
-
Action on a deletion request: Registrations and responses deleted or de-identified; exported attendee lists located and purged.
Timeline: 30 calendar days
-
Action on a deletion request: All exports and derived files on organizational cloud storage and staff devices searched and purged; where a file is needed for reporting, the individual's rows are removed or replaced with aggregate counts.
Timeline: 30 calendar days
-
Action on a deletion request: Address removed from every list, including lists maintained outside the email platform and any list shared with a partner for a joint mailing.
Timeline: 30 calendar days
-
Action on a deletion request: Printed outreach lists and rosters containing the individual are cross-cut shredded.
Timeline: 30 calendar days
-
Action on a deletion request: Any uploaded or matched audience containing the individual is deleted and rebuilt from the suppressed list. Student information is never placed in an advertising audience.
Timeline: 30 calendar days
-
Action on a deletion request: Written deletion instruction issued; written confirmation obtained and filed.
Timeline: Notice in 10 business days; confirmation in 30 calendar days
-
Action on a deletion request: Request relayed to EAB; local suppression entry created so that the individual is excluded from every future refresh — see Section 9.4.
Timeline: 10 business days
-
Action on a deletion request: Purged on the regular backup rotation; no operational use in the interim.
Timeline: 90 calendar days
-
Action on a deletion request: A minimal entry is created and retained permanently — see Section 9.5.
Timeline: Permanent, by design
9.4 How suppression survives a dataset refresh
Because the Alabama Direct Admission dataset is refreshed from source systems on a recurring basis, a student record that we delete today can legitimately reappear in a later refresh. Deleting the record alone would therefore not honor the student's request — the next refresh would restore it.
To prevent that, we do the following:
We relay the request to EAB so that it can be honored at the source under the terms of our data sharing agreement.
We create an entry on our local suppression list, which we maintain separately from the dataset and which no refresh overwrites.
We apply the suppression list to every refresh before any outreach is generated. Any incoming record matching a suppression entry is excluded from outreach, and where the request was a deletion request, the record is removed from the working dataset within 5 business days of the refresh.
We record the date of each refresh and the number of suppression matches applied, so that the control can be audited during the annual policy review.
The effect is that a single request is honored once and stays honored, without the student having to ask again.
9.5 The suppression list
The suppression list is the one record we keep after a deletion, and we keep it precisely so that the deletion holds. It contains only what is needed to recognize a suppressed individual: a one-way cryptographic hash or minimal form of the email address or phone number, the date of the request, the type of request, and the tracking reference. It contains no other personal information.
The suppression list is used for one purpose only — to prevent communications and to exclude records from refreshes. It is never used for outreach, analysis, reporting, or any other purpose, and it is never shared except as an instruction to a platform or partner to suppress the same individual. It is retained permanently, because deleting it would allow the individual's information to return on the next refresh. You may ask us to remove your suppression entry, and we will explain the consequence before doing so.
9.6 What we may retain, and why
We honor deletion requests in full except where retention is required. Where an exception applies, we retain the minimum necessary, isolate it from operational use, and tell you in our written confirmation. The exceptions are:
Legal and regulatory records — information we are required to keep by law, by a grant agreement, or for tax or audit purposes, including donation records.
Claims and investigations — information subject to a legal hold, an active investigation, or a pending claim.
Aggregate and de-identified data — program metrics already reported in aggregate cannot be disaggregated back to an individual and are not deleted. No individual is identifiable in them.
The suppression entry — as described in Section 9.5.
Backups pending rotation — as described in Section 9.2, step 8.
9.7 If we cannot complete a request
If we cannot verify a request, cannot locate any information matching it, or must decline part of it under Section 9.6, we say so in writing, explain why, and describe what you can do next — including asking the Executive Director to review the decision. We do not treat a declined portion as a reason to leave the rest of the request unfulfilled.
9.8 Accountability
The Executive Director owns this process. Every request is logged with its date of receipt, type, verification method, each step completed, the date of completion, any exception applied, and the date of written confirmation. The log is reviewed at least annually, and the review checks a sample of closed requests against the inventory in Section 9.3 to confirm that each copy was in fact cleared. Failure to process a request within these timelines is treated as a policy violation and handled under our internal accountability standards.
10. Data Retention and Deletion Schedule
We retain personal information only as long as it serves the purpose for which it was collected, or as long as an agreement or law requires. The following triggers and schedules apply in addition to any request made under Section 9.
-
Action: All information received under that agreement is securely deleted unless renewed authorization is in place.
Timeline: Within 30 calendar days
-
Action: Removed from all contact lists and suppressed against future refreshes.
Timeline: 5 business days
-
Action: Full process under Section 9.
Timeline: 45 calendar days
-
Action: Purged at the annual review.
Timeline: Annually
-
Action: Deleted or de-identified after the event and its reporting are complete.
Timeline: Within 18 months
-
Action: Reviewed and removed where there has been no interaction and no ongoing relationship.
Timeline: After 36 months of inactivity
-
Action: Retained as required for tax, audit, and grant compliance.
Timeline: Per applicable law and grant terms
-
Action: Retained in the analytics platform for the configured retention window, then deleted.
Timeline: Per platform configuration; no more than 26 months
-
Action: Access to all systems containing personal information is revoked.
Timeline: Immediately upon separation
-
Action: Cross-cut shredded when no longer needed. Student information is not printed unless necessary.
Timeline: On becoming unnecessary
11. Security Practices
We use organizational, technical, and physical safeguards designed to protect personal information. These include role-based access granted strictly on a need-to-know basis and reviewed whenever staff roles change; unique individual login credentials with shared accounts prohibited; multi-factor authentication on systems holding student information; storage limited to approved, encrypted organizational accounts, with personal email accounts, personal cloud drives, and removable media prohibited; encrypted transmission of files containing personal information; locked storage and cross-cut shredding for printed records; written confidentiality agreements and annual privacy training for everyone with access; and written data protection terms in every agreement with a partner or service provider.
No system is perfectly secure, and we cannot guarantee the security of information transmitted to us. Email and text message are inherently insecure channels — please take care with what you send us through them, and never send a Social Security number, financial account number, or password by email or text.
11.1 If a breach occurs
If we suspect or confirm unauthorized access to personal information, we contain the incident immediately, assess its scope and nature within 24 hours, document every action in a written incident log, notify affected data partners under the terms of the applicable agreement, remediate to prevent recurrence, and consult legal counsel regarding notification obligations.
Where the Alabama Notification Act of 2018 applies, we notify affected Alabama residents as expeditiously as possible and no later than 45 days after determining that a breach has occurred and is reasonably likely to cause substantial harm. Where an incident affects more than 1,000 Alabama residents, we also notify the Alabama Attorney General and the nationwide consumer reporting agencies within the same period. Where FERPA-protected education records are involved, we notify the school or district that provided them without unreasonable delay.
12. Children and Students
Our website is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13 through it. If we learn that we have received information from a child under 13 without parental consent, we delete it as soon as reasonably practicable. A parent or guardian who believes their child has provided information to us should contact us using Section 15.
Much of our programmatic work reaches high school students, many of whom are under 18. For those students:
We receive their information from schools, districts, institutions, or the Alabama Direct Admission Initiative under written agreement — not by collecting it directly from the student online.
We limit what we receive to what outreach requires, as shown in Section 3.4, and we do not collect Social Security numbers, dates of birth, financial information, or academic records.
We do not use their information for advertising, advertising audiences, commercial marketing, or fundraising solicitation.
A student or a parent or guardian may withdraw from outreach or request deletion at any time, and the process and timelines in Section 9 apply in full.
Where information constitutes an education record under FERPA, the rights FERPA provides to parents and eligible students are exercised through the school or district that holds the record, and we support those requests when a school or district relays one to us.
13. Other Sites and Services
Our website, publications, and social media posts may link to sites and services operated by others. A link is not an endorsement and does not indicate affiliation. We do not control those sites, we are not responsible for their practices, and their rules on collection, use, and sharing differ from ours. Please read the privacy policy of any site or service you use.
14. Changes to This Policy
We may modify this policy. When we make material changes, we update the effective date, post the revised policy on alabamapossible.org, and, where we believe it reasonably likely to reach you or where the law requires it, notify you directly. Changes take effect on posting, or as otherwise stated at the time of posting. Your continued use of our website and services after a change indicates acceptance of the revised policy.
This policy is reviewed at least annually by the Executive Director and updated as needed to reflect changes in law, data sharing arrangements, organizational practice, or privacy standards. A record of prior versions is maintained and is available on request.
15. How to Contact Us
Questions, requests, and concerns about this policy or our privacy practices should be directed to: privacy@alabamapossible.org