Privacy Policy

1. Information handled when you visit

Requests and technical information. Loading a page sends technical information to the hosting infrastructure, such as your IP address, requested URL, time, browser or user-agent information, and response details. URLs may include your search words and selected filters. Hosting and security logs may record these details to deliver pages, diagnose errors, and protect the service. Do not put personal or sensitive information into directory searches.

Your browser preferences. We store your analytics choice and its date in your browser’s local storage under nationboards.analytics-consent.v1. This preference is used only to honor your choice and expires after 180 days. If storage is unavailable, your choice applies to the current page. Language is selected through the page URL; directory filters and layouts also use URLs, rather than an account profile.

Optional audience measurement. Only if you accept analytics, Google Analytics 4 receives usage events and browser identifiers to help us understand visits and improve the site. This can include pages viewed, session and interaction information, device/browser characteristics, language, and approximate location derived from the connection. Google receives your IP address as part of internet communication; Google states that GA4 does not log or store individual IP addresses.

Optional accounts. Google sign-in supplies a stable Google account identifier and verified email address to identify your account. We store those details, your unique username, account creation and update times, last successful login time, and the version and time of your acceptance of the Terms. The account portal displays your email address read-only; a verified change supplied by Google can update it when you sign in again if it does not conflict with another account.

You may optionally provide your gender and countries or territories of birth and residence. These fields are private, can be changed or cleared in your account portal, and are not needed to browse or sign in. We do not store your Google password, profile photo, full name, or Google access or refresh tokens. There are no public member profiles, payments, newsletters, comments, or file uploads. Account information is separate from public country and officeholder reference content and is not included in public catalog downloads or their open-data licenses.

2. Necessary cookies and optional analytics

Account forms and Google sign-in use necessary cookies. A session cookie holds a random identifier for session data stored in our database and keeps you signed in for up to 14 days. Signing out ends that session. A separate anti-forgery cookie protects form submissions. These cookies are used to provide and secure the account functionality you request, independently of your analytics choice. Blocking them can prevent sign-in or account changes.

Google Analytics is optional. Before you accept, we do not load the Google Analytics script or send analytics events, including cookieless analytics pings. Choosing “Reject analytics” leaves analytics off and does not restrict access. With JavaScript disabled, optional analytics does not run.

We do not load Google Analytics on account, signup, login, logout, or authentication-callback pages, even if you accepted analytics on public pages. Google sign-in separately connects you to Google to authenticate; rejecting analytics does not disable the sign-in service you choose to use.

After acceptance, Google Analytics can set first-party cookies such as _ga and _ga_96M50E87S4 to distinguish browsers and sessions. Our tag requests a maximum cookie lifetime of 180 days without extending it on each page load. Browser settings may shorten this period. Cookie lifetime is separate from Google’s retention of data already received.

Use Cookie settings in the footer to revisit your choice. Rejecting after acceptance disables further measurement on this site, removes accessible first-party Google Analytics cookies, and reloads the page to stop the loaded tag. The preference is specific to each browser and site origin; make your choice again on another device or after clearing browser storage. Withdrawal does not undo processing that occurred before it.

Our tag disables advertising storage, advertising user data, ad personalization, and Google Signals. We do not sell visitor information or use this site’s analytics for targeted advertising. We honor the browser’s Global Privacy Control signal by keeping analytics off. Other browser “Do Not Track” signals do not have a uniform interpretation; the explicit analytics controls remain available.

We remove query strings and fragments from the page URL and referrer values supplied by our tag, so directory search text is not deliberately included in those analytics fields. Application access logs omit query strings and referrers to avoid recording sign-in authorization parameters. Hosting infrastructure may maintain its own request logs. Do not include personal information in URLs.

You can also clear or block cookies and site storage in your browser, or use Google’s Analytics opt-out browser add-on. See how Google uses information from sites that use its services and Google’s Privacy Policy.

3. Purposes and legal bases

We use necessary request information to serve the directory, maintain reliability, investigate faults, and prevent abuse. Where a legal basis is required, these uses rely on our legitimate interests in operating and securing a public reference website, balanced against visitors’ rights, and on legal obligations where applicable. We use your preference solely to respect your selection. Optional analytics relies on your consent, which you may withdraw at any time.

We use account identifiers, email, username, and authentication records to create and secure your account, prevent duplicate accounts, and provide the membership service you request. We use optional profile fields only to save and display the details you choose in your private portal. Where a legal basis is required, providing the requested account service relies on performance of the membership agreement; security and abuse prevention also rely on legitimate interests as described above.

We do not use visitor or account information to make automated decisions with legal or similarly significant effects or send marketing communications.

4. Providers, disclosures, and international processing

Render hosts the application and handles network requests and operational logs. Neon hosts the database containing the public directory, recorded assessments, private account records, and server-side sessions. The application does not create a member search-history record. Google provides sign-in when you choose it and the separate optional analytics service described above.

OpenAI is used in separate, offline workflows to help prepare country-relationship assessments. Directory searches and browsing requests are handled by the application; they are not sent to OpenAI by those workflows. Source websites such as Wikidata are consulted during data maintenance, rather than queried on your behalf when you open a dossier. Flags and site assets are served locally.

Providers may process data in the United States and other countries, where privacy laws may differ from yours. Where required, transfers must rely on applicable legal safeguards, such as approved contractual clauses or an applicable adequacy framework. Provider policies explain their processing and safeguards; your analytics choice controls whether our Google tag is loaded.

We may disclose necessary information when legally required, to protect the service or the rights and safety of others, or in connection with a transfer of the service subject to applicable privacy obligations. We do not share visitor information for third-party direct marketing.

5. Retention and security

The browser preference remains valid for 180 days unless you change it or clear site storage. Our analytics cookie settings also request up to 180 days. Operational logs are subject to the hosting providers’ retention settings and may be kept longer where needed for a specific security investigation or legal obligation. Analytics event data is subject to the Google Analytics property’s retention settings; aggregated reports may remain longer. These periods are independent of cookies, and deleting cookies does not delete information already received by a provider.

Account records are kept to provide and secure membership. Optional profile values can be removed through the portal; account deletion is not currently a self-service feature. Session credentials expire after up to 14 days or when you sign out, although expired database records and backups may remain until maintenance or backup rotation. Expiration prevents those sessions from authenticating. We do not promise that clearing a field immediately removes earlier copies from backups.

We use HTTPS and access restrictions to protect the service. No internet transmission or storage system can be guaranteed completely secure. We retain information only as necessary for the purposes described here, subject to applicable legal requirements.

6. Your privacy rights

Depending on applicable law, you may have rights to access, correct, delete, or receive a copy of personal data; restrict or object to certain processing; withdraw consent; and complain to your local data-protection authority. These rights are subject to legal conditions and exceptions. We do not discriminate against visitors for declining analytics or exercising privacy rights.

The account portal lets you view your account details, change your username, and edit or clear optional profile fields. Other immediate controls are signing out, the footer’s Cookie settings on public pages, and your browser’s cookie and storage controls. There is currently no self-service account-deletion control. Clearing browser storage or withdrawing analytics consent does not delete your account or historical server-side records. Google’s linked privacy tools provide additional controls for information Google handles; revoking Google access does not itself erase your Nationboards account.

California residents may have rights to know, access, correct, and delete personal information, and to opt out of sale or sharing for cross-context behavioral advertising, where the relevant law applies. We do not sell personal information or share it for that advertising purpose, and our tag does not enable ad personalization.

7. Children and external websites

The directory is general-interest reference material and is not directed at children under 13. We do not knowingly seek personal information from children. Where local law requires a parent or guardian’s permission for optional analytics, that permission is required before acceptance; otherwise, leave analytics off.

Following an external link takes you to a service governed by its own privacy policy. We do not control those services or their data collection.

8. Updates

We may update this policy to reflect changes in the site, its providers, or applicable requirements. The effective date identifies the current version. Material changes will be accompanied by any notice or renewed consent required by law.