The short version
- We collect the details you enter in the request form so we can send the code and support your deployment.
- We do not sell or share your personal information for advertising.
- Kiosks run on your organization's own setup. Visitor results and emails collected at a kiosk stay with the organization that runs it, not with us.
- You can ask us to access, correct or delete your information at any time.
1. Who we are and what this covers
OpenCPR is created and maintained by Light-it Inc. ("Light-it", "we", "us"). This Privacy policy explains how we handle personal information collected through opencpr.org, including the request form and emails with our team.
It does not cover data collected by OpenCPR kiosks that other organizations deploy. Those organizations decide what their kiosks collect and are responsible for it. See section 6.
2. Information we collect
| Source | What we collect |
|---|---|
| Request form | Name, email, organization, organization type, country, and any comments you add. We also record the website or campaign link that brought you to opencpr.org. |
| Emails with us | Your messages and contact details, and information you share about your deployment. |
| Website use | Basic technical data such as browser type, device, pages visited and approximate location from your IP address, collected through server logs and Google Analytics. Google Analytics sets cookies only if you accept them (see section 5). |
Please do not send health information or information about kiosk visitors through the form.
3. How we use it
- Review your request and send the code, build guide and support.
- Reply to your questions and follow up about your deployment.
- Send important updates about OpenCPR, such as security fixes or new versions. You can opt out of non-essential emails at any time.
- Understand how many communities OpenCPR reaches and improve the project. We report this only in aggregate.
- Keep the website secure and prevent abuse of the form.
- Comply with legal obligations.
Where the law requires a legal basis, we rely on your request (to provide what you asked for), our legitimate interest in running and improving OpenCPR, your consent where we ask for it, and legal obligations.
4. How we share it
We do not sell your personal information or share it for targeted advertising. We share it only with:
- Service providers who host the website, process form submissions, send email or provide analytics on our behalf, under contracts that limit their use of the data. The website is hosted on Amazon Web Services, which also sends the confirmation email after you request the code, and we measure its use with Google Tag Manager and Google Analytics (Google). Form submissions are processed with n8n, operated by Light-it, and stored in Google Sheets (Google Workspace). Our team is notified of new requests in Slack, and those notifications contain only the organization name, type and country.
- Light-it team members who handle requests and support.
- Authorities or others when required by law, or to protect rights, safety and security.
- A successor if the OpenCPR project or Light-it is involved in a merger, acquisition or transfer, subject to this policy.
5. Cookies and analytics
We use Google Tag Manager and Google Analytics 4 to understand how visitors use the website, and they set cookies only if you choose "Accept" in the cookie banner. Until then, Google Consent Mode sends Google only cookieless, aggregated signals, such as a page being viewed, without storing cookies on your device. We do not use advertising cookies.
If you accept, Google Analytics sets these cookies:
| Name | Purpose | Duration |
|---|---|---|
_ga, _ga_<ID> | Google Analytics: distinguish visitors and their visits | Up to 2 years |
We keep Google Analytics data for 14 months. We also save your choice as opencpr-consent in your browser's local storage, so the banner does not ask again.
You can change your choice at any time with the "Cookie settings" link in the footer, or block cookies in your browser settings; the site will still work.
6. Data collected by OpenCPR kiosks
OpenCPR is self-hosted. When an organization runs a kiosk, session results and any email address a visitor enters to receive their score are processed by that organization's installation. We do not receive this data unless the organization chooses to share it with us.
The organization running the kiosk is responsible for that data, including telling visitors what is collected and getting any consent required, such as parental consent for children. If you used a kiosk and have a question about your data, please contact the organization that runs it.
7. How long we keep it
We keep request and support information for as long as needed to support your deployment and understand OpenCPR's reach, and generally no longer than three years after our last contact with you, unless the law requires longer. Website logs are kept for a shorter period. When information is no longer needed, we delete or anonymize it.
8. Security
We use reasonable technical and organizational measures to protect your information, such as encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
9. Your choices and rights
You can ask us to access, correct, delete or export the personal information we hold about you, or to stop sending you emails. Depending on where you live, you may have additional rights:
- United States. Residents of California and other states with privacy laws may have rights to know, delete and correct personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those laws define it. We will not discriminate against you for exercising your rights.
- Canada. Under PIPEDA and provincial laws, you can access and correct your personal information and withdraw consent, subject to legal limits.
- Other regions. If you are in the EU, UK or another region with data protection laws, you may also object to or restrict processing and complain to your local data protection authority.
To make a request, email hello@opencpr.org. We may need to verify your identity before responding.
10. International transfers
Light-it and our service providers may process information in the United States and other countries, including where our team is based. When we transfer information across borders, we take steps to protect it as this policy describes and as the law requires.
11. Children
The website and request form are intended for adults acting for organizations. We do not knowingly collect personal information from children under 13 (or under 16 where local law sets a higher age) through the website. If you believe a child has sent us information, contact us and we will delete it.
12. Changes to this policy
We may update this policy. We will change the "Last updated" date above and, for significant changes, give notice on the website or by email.
13. Contact
Privacy questions or requests: hello@opencpr.org
Light-it Inc., 20900 NE 30th Ave, Suite 200-27, Aventura, FL 33180, United States