Privacy Policy

Information we collect and use

We use information you provide to operate your account, communicate with you, and administer ISA activities. Depending on the features you use, this includes your name and email, organization and role, invitation and membership records, event registration answers, attendance and check-in records, mailing-list preferences, funding and collaboration applications, supporting documents, and review or payment records. Security and audit records help protect accounts and document administrative changes.

Public event registration does not create a portal account. Portal access is limited to invited staff and affiliate representatives; access to private records depends on current roles and organization responsibilities.

Google sign-in

Continue with Google is an optional alternative to a password. With your permission, Google provides your account identifier, name, email address, email verification status, and profile picture information. Supabase Auth processes this identity information to authenticate you and link you to your invited ISA Portal account. Google sign-in does not itself grant portal access.

We request only basic identity permissions. We do not request access to your Google Drive files, Gmail messages, calendar, or contacts, and the application does not retain Google API access tokens for those services. Google identity information is used for account verification and sign-in, not advertising, sale, or AI model training.

You can remove the connection through your Google Account settings. This does not automatically delete ISA records or your portal account. Contact ISA if you need help removing an account or choosing another sign-in method.

Access and service providers

Authorized ISA organizers and affiliate administrators can access information needed for their permitted responsibilities. Supabase provides authentication, database, and private file storage; Vercel hosts the website and provides website analytics; Resend processes transactional email and mailing-list delivery. These providers process information needed to deliver their services. External websites linked from this site have their own privacy policies.

We do not sell your personal information. We may disclose information when necessary to comply with applicable legal requirements or address security, safety, or abuse concerns.

Sessions, analytics, and email

The site uses authentication cookies to maintain sign-in sessions. Website analytics help us understand site use, while technical and security records support reliability and abuse prevention. Blocking authentication cookies can prevent portal sign-in from working.

Interest-list and announcement emails include an unsubscribe link. Account invitations, password recovery, registration receipts, and other operational messages are separate from mailing-list subscriptions. Unsubscribing does not delete your account or event registration.

Retention and your choices

Records are kept according to their purpose and the application's retention rules. Cleanup removes eligible expired records in scheduled batches; account, funding, attendance, and audit records may need to remain for administration, security, or accountability. Pending staff and affiliate invitations expire after seven days. Expiry is not a promise that every related record is immediately deleted.

To ask about your information, request access, correction or deletion, or raise a privacy concern, email rso.msuisa@msu.edu. We may need to verify your identity and review which records can be removed. Do not send passwords or sensitive documents in your initial message.

Changes to this policy

We update this page when our services or data practices change. The date above identifies the latest revision. Contact ISA with questions about this policy or your use of the website and portal.