Privacy Policy

Who this policy covers

This policy covers every person who uses this portal — adults who create accounts and the household members (including children) they register for events. Children never create their own accounts; a parent or guardian creates the household account and enters information on behalf of every attendee.

What we collect and why

Account information

When you sign in for the first time, we create a household account using your email address. You may also provide a family display name, phone number, city, state, chapter affiliation, and emergency contact details. We use this to reach you about your registration, send payment reminders, and support you on-site.

Attendee information

For each person you register, we collect their name, badge name, pronouns (optional), LPA membership number, and shirt size. We use this for name badges, merchandise orders, and eligibility checks.

Registration details

At each event registration we ask for each attendee's dietary notes and accessibility notes. We use these to coordinate catering and on-site support with the hotel and our team. These notes are treated as sensitive — they are never logged, never shared with other households, and are automatically deleted 60 days after the event ends. We also record age at the time of the event (as a number, not a birthdate) for session eligibility and name tag purposes.

Photo consent

Photo consent for each attendee defaults to on. You may opt out for any attendee at any time by editing their details on your account page before the event. We record when consent was given or withdrawn. Event photographers and staff are given the roster with consent status so they can honor your preference.

Payment records

We do not process credit cards or store any payment credentials. To pay online, you leave this site for PayPal's own checkout — PayPal collects and handles your card details, and we never see or store your card number. You do not need a PayPal account to do this. You may also pay by check or in cash to the District. However you pay, the District records only the amount, method, date, and your reference code in the portal for accounting purposes. These records are kept indefinitely.

How we protect your information

• No passwords. You sign in with a one-time code sent to your email. We never store a password for your account.
• Encrypted in transit. All communication between your browser and our servers uses HTTPS.
• No data sharing. We do not sell, rent, or share your information with advertisers, marketers, or third parties beyond the services required to run the portal (see below).
• No public directory. No attendee listing, search, or any other feature lets one household see another household's information.
• Sensitive notes are scoped. Dietary and accessibility notes appear only on your own account page and in admin-only event exports, never in any public or household-facing view.
• Admin access is narrow. Only a small number of named District 6 officials (Director, Treasurer, and a developer for maintenance) can access member data. All access to financial records and roster exports is logged.

Services we use

This portal runs on infrastructure provided by:

• Netlify — hosts the application and runs server-side functions. Your HTTP requests pass through Netlify's servers.
• Neon — stores the database (accounts, registrations, payments) on servers located in the United States.
• Resend — delivers confirmation emails, login codes, and payment reminders. Your email address and message content are processed by Resend to complete delivery.
• PayPal — runs the online checkout when you choose to pay online. PayPal receives the amount you are paying and your reference code; anything else you enter on PayPal's screens, including your card details, you give to PayPal directly and we never see it. PayPal's checkout script runs on our account and registration pages, and PayPal sets its own cookies there.
• GitHub — used to track help requests you send us. If we forward your request, only the text of your message is sent, into a private repository. Your name, email address, and phone number are removed first.

All of these providers are US-based. Netlify, Neon, Resend, and GitHub maintain SOC 2 Type II certifications; PayPal is certified at PCI-DSS Level 1. No data is transferred to or processed in the European Union. We use no analytics services, advertising networks, or tracking pixels. PayPal's checkout script is the only third-party code that runs in your browser, and it runs only on the pages where you can pay.

Children's information

LPA conferences are family events and we regularly collect information about children on behalf of their parents or guardians. All child information is entered by the adult account holder — children do not create accounts or enter data directly. By registering a child, you confirm that you are that child's parent or legal guardian and you consent to their information being collected as described in this policy.

How long we keep your data

Your rights

You can update your household information and attendee details at any time from your account page. You can request deletion of your account and all associated data by contacting us at the address below. Note that payment records are retained for accounting purposes even after an account is deleted, but the link between those records and your household is removed.

Contact us

Questions about this policy or requests to access or delete your data:

LPA District 6
district6@lpaonline.org

We may update this policy from time to time. When we do, we'll update the date at the top of this page.