Privacy Policy

1. Introduction

Legal Entity: "Where To Next" is the operating name (DBA - Doing Business As) of SAINT LOUIS VICARIOUS VOYAGERS FOUNDATION LTD, a 501(c)(3) public charity and 509(a)(2) organization registered with the IRS. Throughout this Privacy Policy, references to "Where To Next," "we," "our," or "us" refer to SAINT LOUIS VICARIOUS VOYAGERS FOUNDATION LTD.

We operate the website w2nvolunteer.org and provide educational travel programs for students in the United States and South Africa. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or participate in our programs.

This policy applies to all users in both the United States and South Africa and complies with applicable data protection laws, including the General Data Protection Regulation (GDPR), the Protection of Personal Information Act (POPIA) in South Africa, and relevant US federal and state privacy laws.

1.1 Organizational History and Data Transfer

Where To Next was formerly known as the Saint Louis Vicarious Voyager's Program (VVP). In October 2025, the organization rebranded to Where To Next. As part of this rebrand, all participant data, program records, and personal information previously collected under the VVP name were transferred to Where To Next.

This includes all data from previous programs and activities conducted under the VVP name:

• Costa Rica 2024 (May/June 2024): All participant applications, medical forms, emergency contacts, payment records, photographs, videos, and program documentation from the Costa Rica trip.
• Cuba Trial Run (August 2024): All participant data, trip logistics, and program materials from the Cuba pilot program.
• Semester at Sea Activities: All participant information, event records, photographs, and materials from activities and events conducted in connection with Semester at Sea programs.

If you participated in any VVP program or activity, your personal information is now managed by Where To Next under the same privacy standards and protections outlined in this policy. All privacy consents and preferences granted to VVP remain in effect under Where To Next.

1.2 Disclaimer: No Affiliation with Semester at Sea

2. Information We Collect

We collect information that you voluntarily provide to us when you apply for our programs, register on the website, express an interest in obtaining information about us or our products and services, or otherwise contact us.

• Personal Identification Information: Name, email address, phone number, date of birth, passport details.
• Health Information: Medical history, dietary restrictions, allergies (collected for safety during trips).
• Emergency Contact Information: Names and contact details of parents/guardians.
• Academic Information: School name, grade level, GPA (for scholarship applications).

3. Medical Information and Health Data

Given the nature of our international travel programs, we collect specific health and medical information to ensure the safety and well-being of all participants. This data is treated with the highest level of confidentiality and security.

3.1 Collection of Medical Data

Through our secure Participant Portal and Doctor Portal, we may collect:

• Medical History: Information about pre-existing conditions, surgeries, or chronic illnesses.
• Allergies & Dietary Restrictions: Details on food, drug, or environmental allergies to prevent exposure during the trip.
• Medications: A list of current medications to ensure availability and legality in destination countries.
• Immunization Records: Proof of required vaccinations (e.g., Yellow Fever, COVID-19) for entry into specific countries.
• Doctor Evaluations: Assessments provided by licensed medical professionals via the Doctor Portal confirming fitness for travel.

3.2 Use and Access

Medical information is used strictly for:

• Emergency Response: Providing critical information to medical responders in case of an emergency abroad.
• Program Planning: Accommodating dietary needs and ensuring activities are suitable for all participants.
• Insurance Compliance: Verifying coverage eligibility for travel medical insurance.

Access Control: Access to medical data is strictly limited to:

• Program Leaders: Who need to know about allergies and emergency protocols.
• Medical Staff: Licensed professionals reviewing fitness for travel.
• Emergency Responders: Only when necessary to protect vital interests.

We do not sell, rent, or share medical data with third-party advertisers.

3.3 Security and HIPAA/GDPR Compliance

We employ industry-standard encryption and security measures to protect health data stored in our portals. While we are a non-profit organization and may not be a "covered entity" under HIPAA in all contexts, we voluntarily adhere to HIPAA-standard security practices and GDPR special category data requirements to ensure your sensitive health information is protected against unauthorized access.

4. Recording and Media Usage

Consent to Recording: By participating in our programs, meetings, and events (including Prep Sessions, Information Sessions, Board Meetings, and virtual or in-person gatherings), you acknowledge and agree that these interactions may be recorded by audio, video, and/or photographic means.

Usage Rights: You grant Where To Next the irrevocable, worldwide, perpetual, royalty-free right to use these recordings and your likeness for any purpose, including but not limited to:

• Advertising and marketing materials (website, social media, print)
• Educational and training resources
• Program documentation and promotion

This usage is without further compensation, notification, or permission. If you have specific privacy concerns regarding recordings, please contact us prior to participation.

5. How We Use Your Information

We use the information we collect or receive:

• To facilitate account creation and logon process.
• To send you administrative information.
• To fulfill and manage your participation in our programs.
• To ensure your safety and well-being during trips.
• To respond to legal requests and prevent harm.

5.1 Public Application Status Check

Our website includes a "Check Status" feature that allows applicants to view the status of their application using their email address. By submitting an application, you acknowledge and agree that this feature:

• Displays your name, application type, current status, and submission date
• Does not require account creation or password authentication
• Is accessible to both applicants and their parents/guardians
• Uses secure HTTPS connections to protect your information

We recommend that you do not share your application email address with others to maintain the privacy of your application status.

6. Third-Party Service Providers

6.1 Hosting and Infrastructure

Our website is hosted on GitHub Pages and our backend services are hosted on Heroku (a Salesforce company). These services may have access to your data as necessary to provide hosting and infrastructure services. Both providers maintain industry-standard security practices and comply with applicable data protection regulations.

6.2 Payment Processing

All payments and donations are processed through Zeffy, a fee-free fundraising platform for nonprofits. We do not store credit card information on our servers. When you make a payment, you will be directed to Zeffy's secure platform, and your payment information is subject to Zeffy's Privacy Policy and Terms of Service.

6.3 Video Conferencing Services

We use Google Meet, Zoom, and Webex (by Cisco) to conduct scholarship panel interviews and host prep sessions. Interview links are provided through our automated scheduling system after panel members confirm your selected interview time. When you participate in video conferences, these platforms may collect:

• Video and audio recordings (if sessions are recorded with consent)
• Your name and email address
• Device information and IP address
• Chat messages and shared content during sessions

Your use of these video conferencing platforms is subject to their respective privacy policies and terms of service. We may record scholarship interviews and prep sessions for program evaluation and quality assurance purposes. Participants will be notified before any recording begins and consent is required.

6.4 Email Services

We use SendGrid (by Twilio) and other email service providers to send automated notifications and communications, including:

• Interview scheduling links sent automatically to applicants and parents/guardians
• Pending interview confirmation notifications
• Final interview confirmations with video conference links
• Application status updates and program communications
• Two-factor authentication codes for leader portal access

These providers have access to email addresses and message content as necessary to deliver our communications. All emails are sent via secure, encrypted connections.

6.5 File Storage Services

We use Cloudinary as our cloud storage provider for securely storing and managing uploaded documents and files, including:

• Board of Directors application resumes and cover letters
• Participant passport copies and travel documents
• Medical form attachments and supporting documentation
• Other program-related file uploads

Cloudinary is a secure, industry-standard cloud storage platform that provides:

• Secure file storage: All files are stored on Cloudinary's secure servers with encryption at rest and in transit
• Access control: Files are only accessible via secure HTTPS URLs and are not publicly browsable
• Data persistence: Files remain permanently stored and accessible for program administration
• Compliance: Cloudinary maintains SOC 2 Type II, ISO 27001, and GDPR compliance certifications

When you upload files through our application forms or participant portal, these files are transmitted securely to Cloudinary's servers. Cloudinary acts as a data processor on our behalf and does not use your files for any purpose other than providing storage services to us. For more information about Cloudinary's data practices, please visit their privacy policy at cloudinary.com/privacy.

6.6 Communication Services

We use various communication platforms to stay in touch with participants, parents/guardians, and program stakeholders:

• Google Voice: We use Google Voice for phone and text message communications with participants. Communications through Google Voice are subject to Google's Privacy Policy.
• WhatsApp: Participants may be added to WhatsApp groups or chats for program coordination and communication. WhatsApp is owned by Meta and subject to Meta's Privacy Policy. Messages sent via WhatsApp are end-to-end encrypted, but metadata may be collected by Meta.
• T-Mobile: Our main Where To Next phone operates on T-Mobile's cellular network. Voice calls and SMS messages transmitted through T-Mobile are subject to T-Mobile's privacy policies and may be accessible to T-Mobile as a service provider.

6.7 Cuba Communication Services and Privacy Limitations

6.8 Analytics

We use analytics services to understand how visitors use our website. These services collect anonymous usage data and do not identify individual users.

7. Artificial Intelligence and Automated Processing

7.1 Use of AI Technologies

Where To Next uses artificial intelligence (AI) and automated processing technologies to improve operational efficiency and enhance the participant experience. This section explains how AI may process your personal information.

7.2 Types of AI Processing

AI technologies may be used to process your data in the following ways:

• Administrative Automation: AI assists with scheduling, email composition, document organization, and routine administrative tasks that involve your contact information and program details
• Communication Enhancement: AI may help draft, translate, or optimize communications sent to you, including program updates, notifications, and responses to inquiries
• Document Processing: AI assists with organizing and extracting information from submitted applications, medical forms, and other documents you provide
• Data Analysis: AI analyzes aggregated program data to identify trends, improve operations, and enhance participant outcomes (individual identities are protected in analytical processes)
• Content Generation: AI may help create program materials, educational resources, and marketing content that references participant experiences (with appropriate anonymization)

7.3 AI Service Providers

We use reputable third-party AI service providers that maintain strong data protection practices. When your data is processed by AI systems:

• We prioritize providers that offer data privacy guarantees and do not use customer data to train their public models
• Personally identifiable information is minimized whenever possible
• Sensitive information (such as medical records or financial data) is handled with additional safeguards
• AI processing is subject to the same confidentiality and security standards as human processing

7.4 Automated Decision Making

While AI supports our operations, Where To Next does not rely solely on automated decision-making for significant actions affecting participants. Final decisions regarding program acceptance, scholarship awards, disciplinary actions, and safety matters are always made by qualified human staff members.

8. Data Security

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our website is at your own risk.

9. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information, including:

• The right to request access to your personal information
• The right to request correction or deletion of your personal information
• The right to restrict processing of your personal information
• The right to data portability

To exercise these rights, please contact us at hello@w2nvolunteer.org.

10. Contact Us

If you have questions or comments about this policy, you may email us at hello@w2nvolunteer.org or by post to:

Where To Next
Saint Louis Vicarious Voyagers Foundation Ltd
St. Louis, MO 63129
United States