Privacy Policy

1. Introduction

Legal Entity: "Where To Next" is the operating name (DBA - Doing Business As) of SAINT LOUIS VICARIOUS VOYAGERS FOUNDATION LTD, a nonprofit organization registered with the State of Missouri. Throughout this Privacy Policy, references to "Where To Next," "we," "our," or "us" refer to SAINT LOUIS VICARIOUS VOYAGERS FOUNDATION LTD.

We operate the website w2nvolunteer.org and provide educational travel programs for students in the United States and South Africa. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or participate in our programs.

This policy applies to all users in both the United States and South Africa and complies with applicable data protection laws, including the General Data Protection Regulation (GDPR), the Protection of Personal Information Act (POPIA) in South Africa, and relevant US federal and state privacy laws.

1.1 Organizational History and Data Transfer

Where To Next was formerly known as the Saint Louis Vicarious Voyager's Program (VVP). In October 2025, the organization rebranded to Where To Next. As part of this rebrand, all participant data, program records, and personal information previously collected under the VVP name were transferred to Where To Next.

This includes all data from previous programs and activities conducted under the VVP name:

• Costa Rica 2024 (May/June 2024): All participant applications, medical forms, emergency contacts, payment records, photographs, videos, and program documentation from the Costa Rica trip.
• Cuba Trial Run (August 2024): All participant data, trip logistics, and program materials from the Cuba pilot program.
• Semester at Sea Activities: All participant information, event records, photographs, and materials from activities and events conducted in connection with Semester at Sea programs.

If you participated in any VVP program or activity, your personal information is now managed by Where To Next under the same privacy standards and protections outlined in this policy. All privacy consents and preferences granted to VVP remain in effect under Where To Next.

1.2 Disclaimer: No Affiliation with Semester at Sea

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us, including:

• Application Information: Name, email address, phone number, date of birth, address, school information, emergency contact details
• Board of Directors Application Information: Full name, email, phone, location (city, state, country), professional background, areas of expertise, motivation statement, resume/CV, optional cover letter
• Medical Information: Health history, medical conditions, allergies, medications, doctor and specialist evaluations
• Travel Documents: Passport information, visa details
• Financial Information: Billing information processed through Square (see Section 4)
• Essay Responses: Scholarship application essays and creative submissions
• Guardian Information: Parent/guardian names and contact details for minors
• Scheduling Information: Interview availability preferences, selected interview times, timezone information, video conference meeting details

2.2 Automatically Collected Information

When you visit our website, we automatically collect:

• IP address and device information
• Browser type and version
• Pages visited and time spent on pages
• Referring website addresses
• Anonymous analytics data

3. How We Use Your Information

We use the information we collect to:

• Process and evaluate scholarship applications
• Process and evaluate Board of Directors applications for organizational governance
• Communicate with applicants, participants, guardians, and board candidates
• Provide application status updates through our public status checker
• Schedule and coordinate scholarship panel interviews via our automated scheduling system
• Conduct board candidate interviews and evaluations
• Send interview scheduling links and confirmations to applicants and parents/guardians
• Coordinate travel arrangements and program logistics
• Ensure participant health and safety during the trip
• Comply with US government regulations regarding travel to Cuba
• Process payments and manage billing
• Send program updates and important notifications
• Improve our website and services
• Comply with legal obligations and Missouri nonprofit governance requirements

3.1 Application Status Checker

We provide a public application status checker at w2nvolunteer.org/check-status.html where applicants can view their application status by entering their email address. This service:

• Requires only your email address to access your status
• Displays your name, application type, current status, and submission date
• Does not require account creation or password authentication
• Is accessible to both applicants and their parents/guardians
• Uses secure HTTPS connections to protect your information

We recommend that you do not share your application email address with others to maintain the privacy of your application status.

4. Third-Party Service Providers

4.1 Hosting and Infrastructure

Our website is hosted on GitHub Pages and our backend services are hosted on Heroku (a Salesforce company). These services may have access to your data as necessary to provide hosting and infrastructure services. Both providers maintain industry-standard security practices and comply with applicable data protection regulations.

4.2 Payment Processing

All payments are processed through Square, Inc. on their secure platform. We do not store credit card information on our servers. When you make a payment, you will be directed to Square's payment platform, and your payment information is subject to Square's Privacy Policy and Terms of Service. Square is PCI-DSS compliant and uses industry-standard encryption to protect your financial information.

4.3 Video Conferencing Services

We use Google Meet, Zoom, and Webex (by Cisco) to conduct scholarship panel interviews and host prep sessions. Interview links are provided through our automated scheduling system after panel members confirm your selected interview time. When you participate in video conferences, these platforms may collect:

• Video and audio recordings (if sessions are recorded with consent)
• Your name and email address
• Device information and IP address
• Chat messages and shared content during sessions

Your use of these video conferencing platforms is subject to their respective privacy policies and terms of service. We may record scholarship interviews and prep sessions for program evaluation and quality assurance purposes. Participants will be notified before any recording begins and consent is required.

4.4 Email Services

We use SendGrid (by Twilio) and other email service providers to send automated notifications and communications, including:

• Interview scheduling links sent automatically to applicants and parents/guardians
• Pending interview confirmation notifications
• Final interview confirmations with video conference links
• Application status updates and program communications
• Two-factor authentication codes for leader portal access

These providers have access to email addresses and message content as necessary to deliver our communications. All emails are sent via secure, encrypted connections.

4.5 File Storage Services

We use Cloudinary as our cloud storage provider for securely storing and managing uploaded documents and files, including:

• Board of Directors application resumes and cover letters
• Participant passport copies and travel documents
• Medical form attachments and supporting documentation
• Other program-related file uploads

Cloudinary is a secure, industry-standard cloud storage platform that provides:

• Secure file storage: All files are stored on Cloudinary's secure servers with encryption at rest and in transit
• Access control: Files are only accessible via secure HTTPS URLs and are not publicly browsable
• Data persistence: Files remain permanently stored and accessible for program administration
• Compliance: Cloudinary maintains SOC 2 Type II, ISO 27001, and GDPR compliance certifications

When you upload files through our application forms or participant portal, these files are transmitted securely to Cloudinary's servers. Cloudinary acts as a data processor on our behalf and does not use your files for any purpose other than providing storage services to us. For more information about Cloudinary's data practices, please visit their privacy policy at cloudinary.com/privacy.

4.6 Communication Services

We use various communication platforms to stay in touch with participants, parents/guardians, and program stakeholders:

• Google Voice: We use Google Voice for phone and text message communications with participants. Communications through Google Voice are subject to Google's Privacy Policy.
• WhatsApp: Participants may be added to WhatsApp groups or chats for program coordination and communication. WhatsApp is owned by Meta and subject to Meta's Privacy Policy. Messages sent via WhatsApp are end-to-end encrypted, but metadata may be collected by Meta.
• T-Mobile: Our main Where To Next phone operates on T-Mobile's cellular network. Voice calls and SMS messages transmitted through T-Mobile are subject to T-Mobile's privacy policies and may be accessible to T-Mobile as a service provider.

4.7 Cuba Communication Services and Privacy Limitations

4.7 Analytics

We use analytics services to understand how visitors use our website. These services collect anonymous usage data and do not identify individual users.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• SSL/TLS encryption for data transmission
• Secure database storage with access controls
• Regular security audits and updates
• Limited access to personal information on a need-to-know basis
• Secure authentication systems for portal access

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Application Data: Retained for the duration of the application cycle and up to 2 years after for program evaluation
• Interview Scheduling Data: Retained for the duration of the application cycle and up to 1 year after for program evaluation and improvement
• Participant Data: Retained for 7 years after trip completion for legal and safety purposes
• Medical Information: Retained for 7 years after trip completion as required by healthcare regulations
• Financial Records: Retained for 7 years as required by tax and accounting regulations

7. Your Rights

7.1 For All Users

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information (subject to legal obligations)
• Object to processing of your information
• Withdraw consent at any time (where processing is based on consent)

7.2 Additional Rights for South African Users (POPIA)

Under POPIA, South African users have additional rights including:

• Right to be notified of data breaches
• Right to lodge a complaint with the Information Regulator
• Right to data portability

7.3 Exercising Your Rights

To exercise any of these rights, please contact us at hello@w2nvolunteer.org. We will respond to your request within 30 days.

8. Children's Privacy

Our program is designed for students aged 14-18. We collect personal information from minors only with verifiable parental or guardian consent. Parents and guardians have the right to:

• Review their child's personal information
• Request deletion of their child's information
• Refuse further collection or use of their child's information

9. International Data Transfers

Your information may be transferred to and processed in the United States, where our servers are located. If you are accessing our services from South Africa or another jurisdiction with different data protection laws, please note that your information will be transferred to the United States. We ensure appropriate safeguards are in place for such transfers in compliance with applicable laws.

10. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience on our website. You can control cookies through your browser settings. Disabling cookies may limit your ability to use certain features of our website.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Your continued use of our services after such changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: