HomePrivacy policy
Privacy policy
Exchange Path (“we”, “us”, “our”) operates Exchange Path, a J-1 summer camp coordination service. This page explains what personal data we collect, why we collect it, and the choices you have.
The short version
We only collect what we need to assess your application, share it only with the camps and visa sponsors you’ve agreed to, and never sell it. You can request a copy or deletion at any time by emailing info@exchangepath.org.
§ Who we are
Who we are
Exchange Path is the data controller for personal data submitted through exchangepath.org. Our registered address is 63 Federal Street, Portland, ME 04101, USA. You can reach our privacy team at info@exchangepath.org.
§ What we collect
What we collect
We collect three categories of information:
Identity & contact
Full legal name (as on your passport), date of birth, nationality, postal address, email, phone, and preferred contact channel.
Application content
Educational and work history, references, language proficiency, skills you can lead at camp, medical disclosures relevant to safe placement, photos and ID documents you upload, interview notes, and any messages you send us.
Technical data
IP address, browser, device type, and aggregate usage data — used to keep the site secure, prevent abuse, and debug errors.
§ How we use it
How we use it
We process personal data only for the following purposes:
- Assessing your application and matching you to camps that fit
- Coordinating with U.S. visa sponsors to issue a DS-2019
- Replying to your enquiries and providing customer support
- Sending essential service emails (status updates, document requests)
- Meeting safeguarding, financial, and immigration record-keeping obligations
- Improving the service through aggregate, de-identified analysis
We do not sell your personal data, and we do not use it for advertising profiling.
§ Legal bases
Legal bases
Where applicable law (e.g. UK GDPR, EU GDPR, Indian DPDP Act) requires a legal basis, we rely on:
- Performance of a contract — to assess and process your application once you’ve submitted it.
- Legitimate interests — to operate the service safely (fraud prevention, troubleshooting, communications).
- Legal obligation — to comply with sponsor, immigration, and safeguarding rules.
- Consent — for anything else, asked clearly, withdrawable at any time.
§ Storage
Where we store data
Application records and account data are stored in our Supabase project hosted in the United States. Email correspondence is delivered via Resend (United States) and routed via Cloudflare Email Routing. Payment confirmations (references, invoices, correspondence) are retained by us. Transfers of personal data out of the UK or EU rely on the UK International Data Transfer Addendum and EU Standard Contractual Clauses, and we review each processor for an adequate standard of protection. We do not maintain shadow copies on personal devices.
§ Retention
How long we keep it
We keep your application data for the duration of your participation plus a reasonable period afterwards to support sponsor reporting, financial audits, and safeguarding investigations if any arise. Specifically:
- Withdrawn or unmatched applications — deleted within 12 months of last activity.
- Placed applicants — kept for the full season + 7 years (matching U.S. sponsor record-keeping requirements).
- Financial & invoice records — retained for as long as required by tax law (typically 7 years), including bank transfer references and WhatsApp / email payment coordination where it relates to a payment.
- Site analytics & logs — anonymised or deleted within 90 days.
§ Your rights
Your rights
Depending on where you live, you may have the right to:
- Access a copy of the data we hold about you
- Correct inaccurate or incomplete information
- Delete your account and associated data
- Restrict or object to certain processing
- Receive your data in a portable machine-readable format
- Withdraw consent (where consent is the basis)
To exercise any of these, email info@exchangepath.org from the address on your account. We respond within 30 days.
§ Children
Children & applicants under 18
The Exchange Path programme is open to applicants aged 18 and over. We do not knowingly collect personal data from children under 13. If you believe a child has submitted information through our service, contact us and we will delete it.
§ Changes
Changes to this policy
We may update this policy. Material changes will be notified by email to active applicants and posted here at least 14 days before they take effect. The “Last updated” date at the top reflects the most recent revision.
§ Contact
Contact
Exchange Path
63 Federal Street, Portland, ME 04101, USA
info@exchangepath.org
Related