CAMPFLOW Privacy Policy

1. Scope of this Policy

This Policy applies to the following categories of individuals:

• Camp Administrators and Staff who create or access accounts at app.campflow.org;
• Parents or Legal Guardians who complete online forms, make payments, or otherwise supply camper information through the Services; and
• Visitors who browse campflow.org or the public camp-services directory located at app.campflow.org/directory.

Campflow markets and delivers its Services solely within the United States. Individuals located in the European Union, European Economic Area, or United Kingdom are expressly prohibited from using the Services.

2. Key Definitions

For purposes of this Policy, the following terms have the meanings set forth below:

• “Personal Information” means any information that identifies, relates to, describes, or could reasonably be linked with a particular individual.
• “Sensitive Information” includes data such as medical details, accommodation notes, and other categories defined as sensitive under applicable state law.
• “Parent” includes a parent, legal guardian, or other adult with legal authority over a camper.
• “You” or “Your” refers to the individual to whom the Personal Information pertains.

3. Categories of Information Collected and Purpose of Use

Campflow collects only the information that is reasonably necessary to operate the Services and to fulfil contractual or legal obligations. The table below summarizes each category of Personal Information, the principal business purpose for which it is used, and the period for which it is retained.

*In all cases, data is deleted within thirty (30) days of a verified deletion request unless a longer retention period is required by law.   **Analytics cookies are subject to user consent and may be cleared sooner if consent is withdrawn.

4. Sources of Personal Information

We obtain Personal Information from the following sources:

• Direct submissions from camp staff, Parents, or other authorized users through online forms or secure file uploads;
• Automatic collection through cookies, server logs, and similar technologies when you visit our websites or use the application; and
• Payment processors that return non-sensitive transaction results (e.g., success or failure codes) needed to reconcile accounts.

5. Disclosure of Personal Information

Campflow does not sell Personal Information and does not share Personal Information with third parties for cross-context behavioural advertising. We may disclose Personal Information only in the limited circumstances set forth below:

• Service Providers. We engage vetted third-party vendors to perform functions on our behalf, such as email delivery (Mailgun), SMS delivery (TexdGrid), payment processing (Sola), analytics (Google Analytics, Hotjar), and live chat support (Intercom). Each provider is contractually bound to use Personal Information only as instructed and to implement appropriate security measures.
• Camp Organizations. Authorized camp personnel may access camper and Parent data for legitimate operational purposes consistent with this Policy.
• Legal or Regulatory Authorities. We may disclose Personal Information where required to comply with applicable law, court order, or governmental request, or to protect the rights, property, or safety of Campflow, our users, or others.

6. Cookies and Similar Technologies

Campflow uses first-party cookies for session management and security. Third-party analytics and support tools (Google Analytics, Hotjar, Intercom) set additional cookies that help us understand usage patterns and provide real-time assistance. No analytics cookies are placed on your device until you have provided consent via our cookie banner. You may withdraw consent at any time by selecting “Preferences” in the site footer or by clearing cookies in your browser.

7. SMS Communications and Mobile Privacy

When you provide your mobile phone number to receive SMS communications from camps using Campflow:

• No Third-Party Marketing: Your mobile opt-in data will not be shared with any third parties for their marketing purposes. Your phone number is used solely for communications from the camp you enrolled with.
• Opt-Out Instructions: You may opt out of SMS communications at any time by texting STOP to any message you receive. You will receive a confirmation of your opt-out.
• Support: For help with SMS messaging, text HELP to any message you receive, or contact the camp directly.
• Message Frequency: Message frequency may vary based on camp activities and your preferences. Standard message and data rates may apply.

8. Children’s Privacy (COPPA Compliance)

• Campflow is not directed to children under thirteen (13) years of age, and such children are prohibited from creating accounts.
• Parents or camp staff, acting as “verifiable consent holders,” provide any camper data. Each online form includes a mandatory checkbox in which the Parent affirms authority to supply the information and consents to its processing.
• Parents may review, correct, or request deletion of their child’s Personal Information by emailing [email protected]. Upon verification, Campflow will comply with the request within thirty (30) days, unless retention is legally required.

9. Information Security

Campflow employs industry-standard administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, or destruction. These measures include, but are not limited to, transport-layer encryption (TLS 1.2+), hashing and salting of passwords, multi-factor authentication for staff accounts, least-privilege access controls, nightly encrypted backups, and a written incident-response plan. In the event we become aware of a data breach involving Personal Information, we will notify affected individuals without undue delay and otherwise in accordance with applicable law.

10. Your Rights and Choices

Depending on your state of residence, you may have certain rights with respect to your Personal Information, including the right to:

• Access a copy of the Personal Information we hold;
• Request correction of inaccurate information;
• Request deletion, subject to applicable legal exceptions;
• Opt out of analytics cookies and direct marketing emails; and
• In California, request to limit the use of Sensitive Information.

To exercise any of these rights, please email [email protected] or call (845) 539-1444. We will verify your identity before fulfilling the request and will respond within forty-five (45) days, unless an extension is permitted by law.

11. Notice for California Residents

Although Campflow’s current annual revenue is below the statutory threshold for mandatory compliance, we voluntarily extend the rights set forth in the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”) to all California residents. Campflow does not sell or share Personal Information for targeted advertising. California residents may exercise their statutory rights via the methods described in Section 10. Campflow honors Global Privacy Control (“GPC”) signals as a valid request to opt out of any future sale or sharing of Personal Information, should that practice change.

12. International Data Transfers

All Campflow servers are located within the United States. By using the Services, you acknowledge that your Personal Information will be transferred to, processed, and stored in the United States, which may provide different data-protection rules than your country of residence.

13. Data Retention

We retain Personal Information only for as long as it is reasonably necessary to fulfil the purposes outlined in this Policy, to comply with legal obligations, to resolve disputes, and to enforce our agreements. When data is no longer needed, we will securely delete or anonymize it.

14. Changes to This Policy

We may revise this Policy from time to time. Substantive changes will be posted on this page and communicated to camp administrators at least thirty (30) days before the changes become effective. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

15. Contact Us