Privacy Policy

Effective date: October 3, 2026

This Privacy Policy explains what information is handled when you use International House New York (IHNYC) Service Docs, House Desk, or Pub (together, the Covered Services), why it is used, and the choices available to you.

The Covered Services are operated by Affective Technologies LLC (“Affective Technologies,” “we,” “us,” or “our”), which processes the information described in this policy. Affective Technologies is an independent technical steward and does not speak for the IHNYC Resident Council, International House New York, AVI Foodsystems, a separate food-service organization, or another venue operator or institution.

Summary

• Affective Technologies LLC processes the information described here. What you choose to submit, you provide voluntarily and authorize Affective Technologies LLC to process for the purposes in this policy. Some information is collected automatically or comes from other people, as Section 2 explains.
• The documentation site is public and has no user accounts or submission form.
• House Desk uses a resident’s name and email to verify and operate a private Programs Calendar subscription.
• House Desk keeps a private copy of the daily resident list from International House’s housing system, which only specifically authorized staff can open.
• House Desk keeps a private archive of messages from the WhatsApp group chats it is connected to, including sender names and shared media. Only specifically authorized staff can open it, and House Desk does not post in those chats.
• Pub handles different information for public pages, moderated media, staff scheduling, and protected operations.
• Protected staff tools receive a verified identity and maintain product-specific access and activity records.
• Ordinary request and security information is processed when any Covered Service is used. The documentation site and the Programs subscription page also use pageview analytics.
• We do not sell personal information collected through the Covered Services or use it for cross-context behavioral advertising.
• Do not share a private calendar URL, personal availability link, sign-in link, or credential with another person.

This summary is for orientation. The sections below describe the policy in more detail.

1. Scope

This policy covers:

This policy does not govern websites, forms, calendar applications, messaging services, or institutional systems operated by someone else. A link or integration does not make that third party part of a Covered Service.

2. Who processes information and how it is provided

Affective Technologies LLC is responsible for processing the information described in this policy. The IHNYC Resident Council, International House New York, and venue operators receive information from the Covered Services only as described in Section 9.

Information you choose to provide

Using a Covered Service, and deciding what to submit to it, is your choice. When you request a Programs Calendar subscription, search the Bulletin, upload to Photo Flash, answer an availability form, or otherwise submit information, you provide it voluntarily and authorize Affective Technologies LLC to process it for the purposes described in this policy. Each feature asks only for the information it needs. If you do not want to provide that information, do not use that feature.

An organization may ask you to use a Covered Service for your role, such as a venue asking staff to submit availability. That requirement comes from the organization, not from Affective Technologies.

Information that does not come from a submission

Some information reaches Affective Technologies without you submitting it through a form:

• technical and security information that any web request generates, described in Section 6;
• messages, sender names, and media posted in a WhatsApp group chat connected to House Desk, described in Section 4;
• the daily resident list from International House’s housing system and newsletters that contributors forward to House Desk, described in Section 4;
• event, notice, schedule, and profile information that authorized staff or other sources provide about an activity or a person; and
• delivery and status information that providers return while carrying out a request.

Affective Technologies processes this information only for the purposes in this policy, and the choices in Section 11 apply to it.

3. Information handled by IHNYC Service Docs

The documentation site publishes static pages. It does not provide a product account, accept a resident submission, or expose product administration.

When a page loads:

• Cloudflare receives ordinary network and request information needed to deliver and protect the site;
• Plausible receives an aggregate pageview and ordinary request information used for site analytics;
• the browser may request typography from Google Fonts and selected diagram or math resources from jsDelivr; and
• the site stores presentation preferences, such as theme and Explorer state, in browser storage on your device.

The documentation does not intentionally send resident records, product-account identifiers, raw email addresses, or search text to analytics. Browser privacy controls may block optional analytics or third-party resources without preventing the written documentation from loading.

4. Information handled by House Desk

Programs Calendar subscriptions

When you request or manage a Programs Calendar subscription, House Desk may handle:

• your name and email address;
• verification, management, renewal, revocation, and subscription-status records;
• a private calendar credential and the records needed to validate it;
• transactional email delivery and failure information; and
• ordinary request, browser, calendar-client, security, and timing information.

The private calendar URL is a credential. A calendar application presents it when fetching the feed and may keep a copy according to that application’s own practices. House Desk cannot remove events that a calendar application has already downloaded.

For subscriptions created since September 13, 2026, House Desk also keeps an encrypted copy of the private calendar URL so that a specifically authorized operator can recover it for support. Each recovery is recorded.

The Programs subscription page loads typography from Google Fonts and sends a pageview to Google Analytics, except when the page is opened from a private link.

Bulletin search

When you search the Bulletin, House Desk processes the words you submit to return matches from reviewed public notices and source material. The search route hashes the caller’s network address for rate limiting. Its analytics event records aggregate result type, result count, processing mode, and latency, but not the raw search text.

Published information and source material

House Desk receives event and notice material for review before publication. Source material, unpublished drafts, duplicate-resolution notes, and operator review records remain outside the public Programs Calendar and Bulletin. Selected, approved event fields may be shared with Pub; resident subscription records and House Desk authorization data are not part of that projection.

Forwarded newsletters

Residents who help keep Programs current can forward I-House newsletters to a private address that House Desk issues to each of them. House Desk keeps each contributor’s email address so it can credit their forwards and pass on the confirmation that their email provider sends when forwarding is set up. Each forwarded message, including its headers and attachments, is kept in an encrypted archive so an operator can recover a missed intake, and House Desk keeps a PDF copy of each newsletter. Only specifically authorized staff can open an original message, and each opening is recorded.

Resident roster

House Desk keeps a private copy of the daily current-resident list that International House’s housing system produces, as delivered by email, so that authorized staff can look up residents and review roster changes over time. Each list includes residents’ names, rooms, scheduled check-out dates, booking-end reasons, and housing-system identifiers. Authorized staff can also add a missing day’s list from a file. Only House Desk administrators and staff given the specific roster permission can open it, and opening a resident’s roster history or searching the resident directory is recorded.

Messages from connected group chats

House Desk is connected to selected WhatsApp group chats, including resident groups and the Pub staff chat, through a connector that Affective Technologies runs. It reads new messages in those chats. It does not post, reply, or react in them.

For each message, House Desk may keep:

• the text or caption, as written;
• the sender’s display name, or a generic label when the name looks like a phone number or another identifier;
• readable details of shared contacts, polls, reactions, and locations;
• when the message was sent or received; and
• shared images, audio, video, and documents, up to 16 MB each.

In the archive, House Desk replaces the phone numbers and WhatsApp identifiers of senders and chats with private codes, so messages from the same chat or sender can be grouped without revealing who they are. Message text is kept as written, so a phone number or email address that someone types into a message remains in the archive.

The archive also holds messages imported from an earlier export of a resident group chat, covering August 2025 to August 2026. That export included message text and sender names but no media. Senders that appeared only as phone numbers are stored under a generic label.

Only House Desk administrators and staff given the specific message permission can open the archive. Editing or deleting a message in WhatsApp does not change the archived copy.

To suggest Programs entries, House Desk also screens new messages for event announcements. This step first removes phone numbers, email addresses, and @mentions from the text, and keeps the result with the chat’s WhatsApp identifier but not the sender’s. Cloudflare Workers AI then classifies it, transcribes voice notes, and reads flyer images; messages are not sent to other AI providers. A suggested event reaches the Programs Calendar only if an operator approves it, and a flyer image that comes with it may be kept with the suggestion. If a message cannot be processed, an operator may receive an email containing its redacted text so a missed event can be recovered.

Protected staff workflows

Protected House Desk surfaces may handle a verified staff identity, managed-role assignments, authored changes, and audit or security records needed to administer and protect the product. Admission to another product does not create House Desk permission.

5. Information handled by Pub

Public pages and music history

Public Pub pages receive ordinary request and security information, and they load typography from Google Fonts. Public setlist and movie-night views contain recognized media metadata and timestamps; they are not designed to identify a patron, listener, or viewer. To build the setlist, Pub sends short audio samples of music played through the venue’s sound system to a music-recognition service.

The public tender directory contains only profile information deliberately published for it, such as a display name, pronouns, biography, photo, and tip links. A tender can edit their own profile through a private, time-limited link that Pub emails to them. Private email, availability, role, scheduling, and operator-note fields are excluded from that public view.

When someone scans a tender’s printed QR code, Pub records the scan, including the network address and browser details, so authorized operators can review scan activity. Pub deletes those network and browser details automatically after 90 days.

Photo Flash and other submitted media

When you use Photo Flash, Pub may handle the submitted photo or short video, or a YouTube link you request for the projector, along with preparation and moderation state, timestamps, and ordinary request or browser information used for security and troubleshooting, including a random browser token, stored in hashed form, that can link repeat submissions. Approved media can be displayed in a shared venue.

Uploaded media is automatically deleted from active media storage 15 days after submission, together with the network and browser details recorded for it. An authorized operator may reject or remove it sooner. YouTube requests are also deleted within 15 days. Pub retains a limited history row after the media expires so operators can account for the submission and its outcome; residual copies may remain temporarily in provider backups or caches.

Scheduling and protected operations

Pub scheduling may handle staff names, profiles, contact details, availability, assignments, delivery results, and scheduling history. A per-person Formbricks availability link includes a scheduling token and name; Formbricks receives the person’s submitted availability and ordinary request information, and Pub imports the response into its protected scheduling records. Protected operational workflows may also contain staff attribution, review state, and audit history. These records are restricted through exact Pub permission assignments and are not patron-facing content. Messages posted in the Pub staff chat reach Pub through House Desk’s group-chat intake, described in Section 4, with the sender’s WhatsApp display name and identifier, which Pub uses to credit closing reports to a tender. Pub removes a message’s original text 90 days after it arrives unless the message still needs review; the structured report and its credit remain.

Protected staff workflows

Protected Pub surfaces may handle a verified staff identity, the person’s exact Pub permission assignment, actions, and security or audit history. A verified identity or access to House Desk does not by itself grant Pub permission.

6. Technical, security, and communications information

Depending on the service and request, Affective Technologies and its infrastructure providers may receive:

• network address and approximate network-derived location;
• browser, device, calendar-client, or user-agent information;
• requested page or endpoint, response status, request time, and performance information;
• provider request, delivery, or security identifiers;
• cookies or similar identifiers needed for security and protected staff sessions; and
• derived or hashed identifiers used for rate limiting, abuse prevention, reconciliation, and auditing.

We use this information to deliver the requested service, diagnose failures, maintain security, prevent abuse, attribute protected changes, and understand aggregate service use.

7. How information is used

Information is used to:

• provide documentation, calendar subscriptions, public information, venue experiences, and staff workflows;
• verify a resident or staff identity for a specific task;
• send requested transactional or operational messages;
• review, publish, moderate, schedule, or remove content and media;
• screen connected group-chat messages for event announcements and keep a private reference archive for authorized staff;
• give authorized staff a private reference of current residents and roster changes;
• enforce product-specific permissions and preserve an audit trail;
• maintain reliability, prevent abuse, investigate incidents, and support recovery; and
• understand aggregate use and improve the Covered Services.

We do not use a private resident or staff record to create a public profile unless the relevant person or authorized source deliberately supplies that information for publication.

8. Service providers and external services

The Covered Services use a limited set of providers and user-selected applications:

Those providers process information under their own terms and privacy practices. Affective Technologies limits an integration to the information needed for its documented purpose where reasonably possible.

The Covered Services may link to forms, documents, social platforms, payment services, calendars, or other resources operated by third parties. Their policies govern information submitted directly to them.

9. Sharing and disclosure

We may disclose information:

• to service providers acting on the purposes described above;
• to an authorized operator or organization when needed to review or carry out the resident, staff, or venue task for which the information was supplied;
• when directed by the person who supplied the information;
• to investigate misuse, protect people or systems, or enforce these policies; or
• when required by law or a valid legal process.

Information intended for publication, such as an approved event, tender profile, special, or moderated Photo Flash item, may be visible to the public or to people in the venue. Protected records are not made public merely because related public information exists.

10. Retention

We retain information for as long as reasonably necessary for the purpose for which it was collected, including service delivery, continuity, security, audit, dispute resolution, and legal obligations. Retention depends on the record and the service:

• subscription records are retained while needed to operate, renew, revoke, or support the subscription;
• private feed and verification records follow their expiry, revocation, and security lifecycle;
• publication and operational history may be retained to explain changes and preserve accountability;
• staff access and audit records may be retained after access ends for security and governance purposes;
• active Photo Flash media is deleted within 15 days as described in Section 5, while a limited accountability record may remain;
• messages, imported history, and stored media in the group-chat archive are kept without a fixed deletion date and are not deleted automatically;
• redacted text used to screen group-chat messages for events is kept for up to 14 days, or up to 30 days when a message could not be processed, and text read from flyer images is cached for up to 30 days;
• forwarded newsletter messages are kept in encrypted form without a fixed deletion date, and House Desk keeps its PDF copies of newsletters as a lasting archive;
• copies of the daily resident list are kept without a fixed deletion date and are not deleted automatically;
• network and browser details recorded with a tender QR-code scan are deleted after 90 days, and the original text of Pub staff-chat messages is removed after 90 days unless the message still needs review; and
• infrastructure and provider logs follow applicable security needs and provider settings.

When information is no longer needed, we take reasonable steps to delete, de-identify, or aggregate it, subject to backups, security records, and legal requirements.

11. Your choices and requests

You may:

• block optional analytics or third-party resources with browser controls;
• clear the documentation site’s preferences by clearing local site data;
• renew, replace, or revoke a Programs feed through House Desk Manage;
• ask an authorized Pub operator to remove active Photo Flash media before its automatic deletion date;
• correct an availability response through the available scheduling flow;
• ask us to remove a specific message or file from the group-chat archive; and
• request access, correction, deletion, or make another privacy request by contacting us.

A request may require reasonable identity verification. Some records may need to be retained for security, audit, contractual, or legal reasons. Affective Technologies will respond consistent with applicable law and the operational responsibilities of the relevant service.

12. Security

We use administrative, technical, and organizational measures intended to protect the Covered Services and the information they handle. These include bounded integrations, product-specific permissions, protected staff entry, moderation, validation, and security logging. No method of transmission or storage is perfectly secure.

Do not email or publicly post a private calendar URL, availability link, sign-in link, password, recovery material, or screenshot containing personal or operational information.

13. International processing

Affective Technologies and its providers may process information in the United States and other locations where they operate. Privacy protections can differ by jurisdiction. We handle privacy requests according to applicable law.

14. Changes to this policy

We may update this policy as the Covered Services or their legal obligations change. The effective date above identifies the current version. A material change will be reflected on this page before or when it takes effect where reasonably possible.

15. Contact

For privacy questions or requests, contact hello@affectivetech.com. Please identify the relevant service without including credentials, private links, or unnecessary personal information.

See also Terms of Use and Platform Stewardship.