Privacy policy | Center for US-Pakistan Affairs

Who we are

This website, cupa.org.pk, is run by the Center for US-Pakistan Affairs (CUPA, "the Centre", "we"), an independent research centre with offices in Islamabad and Washington, DC. The organisation responsible for your information is [Legal name of the organisation], registration number [Registration number], whose registered address for notices is [Registered address for notices].

This policy explains what we collect when you use the website, what we do with it, and the choices you have. It takes effect on [Effective date]. For questions about your information, write to info@cupa.org.pk.

The short version

We only collect what you send us, and what we need to run and protect the site.
No advertising, no tracking cookies, no selling. We never sell, rent or trade personal information, and we do not show adverts.
Visitor statistics, when switched on, are cookie-free. We use Cloudflare Web Analytics, which counts visits without cookies.
Videos load only when you press play, from privacy-enhanced players.
You can ask us to see, correct or delete what we hold about you at any time.

What we collect and why

When you visit the site

The site is hosted on Cloudflare. Like any web server, Cloudflare processes technical information to deliver pages and protect the site from abuse: your IP address, browser type, the page you asked for and the time. Cloudflare keeps request logs for a short period under its own policies.

The site keeps two small, anonymous records of its own:

Pages not found. When an address on the site does not exist, we note the address and the page that linked to it, so we can fix broken links. We do not record who followed the link. The list is capped at the 2,000 most frequent addresses.
Popular searches. We count the words people type into the site search, so we can see which topics are in demand. A search is not counted at all if it looks personal (it contains an email address, a long number or a web address). Only the 300 most frequent terms are kept, and a term nobody has searched for in a year is deleted.

Visitor statistics

If we switch on visitor statistics, the site loads Cloudflare Web Analytics. It counts page views, referring sites, countries and device types in aggregate. It does not use cookies or local storage, and it is never loaded in the admin portal.

When you contact us

Contact form: your name, email address, the subject you choose and your message. We also store your IP address with the message, so we can stop a single sender flooding the form (no more than a few messages an hour). Messages are saved in our admin inbox and may also be emailed to the staff mailbox.
Email to our addresses (such as info@cupa.org.pk and press@cupa.org.pk): Cloudflare Email Routing delivers your email, with any attachments, into our mailbox, where staff read and answer it. We may forward it to a staff member's own inbox. Messages in Trash and Spam are deleted automatically after 30 days; other messages are kept until we delete them.
Enquiries (for example about partnerships, speakers or media requests): your name, email, organisation, position, country, phone number if you give it, your message and the answers to the questions for that type of enquiry, your consent and your IP address. The enquiry is passed to the team that handles it.

When you subscribe we keep your email address, your name if you give it, the topics you choose, where you signed up (for example the footer or the newsletter page), your IP address and the dates you subscribed, confirmed and, if you do, unsubscribed, with any reason you choose to give.

Double opt-in: nothing is sent until you click the link in our confirmation email.
One-click unsubscribe: every issue has a link to unsubscribe or change your topics. The link is signed, so no login is needed.
No tracking in our emails: we do not put tracking pixels or tracked links in the newsletter. For each issue we record only whether it was sent to you or failed to send.
To prevent abuse of the sign-up form we briefly log the IP addresses of sign-up attempts. That log is deleted after 24 hours.

After you unsubscribe we keep your address marked as unsubscribed, so we do not email you again by mistake. Ask us if you would like it deleted completely.

Events

When you register for an event we keep your name, email address, organisation, designation, phone number, how you will attend (in person or online), any question you send for the speakers, your consent and your IP address. We use them to manage attendance, to send you a confirmation and joining details, and to contact you about that event.

Programmes, fellowships and jobs

When you apply we keep your contact details, country and city, affiliation, education, a profile link if you give one, your statement or cover letter, your referee's name and contact details, your CV and any writing sample, your consent and your IP address. Applications are seen only by the people assessing them. We email you about the progress of your application.

Please tell your referee that you have given us their details.

Scholars Network and Write for CUPA

Network applications: your name, email, country and city, position, institution, career stage, areas of expertise, regions and languages, a short biography, your ORCID iD, Google Scholar, LinkedIn and website links if you give them, how you would like to contribute, your CV, your consent and your IP address.
Members directory: only if your application is approved and you ticked the box to be listed, the public directory shows your name, position, institution, country and areas of expertise. It never shows your email address or CV. You can ask to be removed at any time.
Pitches: your name, email, affiliation, the type of piece, working title, pitch, topics, links to earlier writing, any draft you upload, your originality and conflict-of-interest declarations, your consent and your IP address. Pitches are seen only by the editors.

Journal submissions

When you submit a manuscript we keep the files you upload, the title, abstract and keywords, the names, affiliations, email addresses and ORCID iDs of every author, the corresponding author's details, your cover letter, statements and declarations, your consent and your IP address. You receive a private link to follow the progress of your submission.

The editors also keep the names, email addresses and reports of peer reviewers. If an article is published, the authors' names, affiliations and ORCID iDs become part of the permanent scholarly record and are made available to indexing services such as Google Scholar.

Admin accounts

For staff who sign in to the admin portal we keep a username, a securely hashed password, a sign-in cookie and, to stop password guessing, a record of failed sign-in attempts by IP address, which is deleted after 24 hours.

Cookies and similar technologies

We use no advertising or tracking cookies. The site sets only the cookies it needs to work: one that protects forms against forgery, one that shows a short message after you send a form, and, for staff only, the admin sign-in cookie. Two small preferences are remembered in your own browser. See the cookie notice for the full list.

Videos and content from other sites

Videos on our pages use YouTube's privacy-enhanced mode (youtube-nocookie.com) or Vimeo with "Do Not Track". Nothing loads from YouTube or Vimeo until you press play; from then on their privacy policies apply.
Podcast audio may stream from our podcast host's servers when you press play.
Some photographs on the site are loaded from Unsplash (images.unsplash.com), which sees the technical details of that request, as any website would.
Links to other websites are provided for convenience. We are not responsible for their content or how they handle your information.

Who handles your information for us

We use a small number of service providers, who act on our instructions:

Cloudflare, which hosts the website (Cloudflare Workers), stores its database (Cloudflare D1), delivers and sends our email (Email Routing and Email Service) and, if switched on, provides visitor statistics.
GitHub, where an encrypted backup of the database is stored each night as a private file that is deleted automatically after 30 days. Backups cannot be opened without a passphrase that only the Centre holds.

We do not sell personal information, and we do not share it with anyone else unless the law requires us to or you have asked us to.

Where your information is processed

CUPA works in Pakistan and the United States, and our service providers operate worldwide. Your information may therefore be processed outside the country where you live, including in the United States and the European Union. We choose providers that protect personal information with strong security and contractual safeguards.

How long we keep it

Some records are deleted automatically:

Sign-in attempts and newsletter sign-up attempts: 24 hours.
Mailbox Trash and Spam: 30 days.
Nightly database backups: 30 days.
Admin notifications, which can include a sender's name and the first words of a message: 90 days.
Admin sign-in sessions: they expire after 7 days.
Search terms: the 300 most frequent, and none unused for a year. Pages-not-found list: the 2,000 most frequent addresses.

Other records have no automatic deletion. Contact messages, emails, enquiries, event registrations, applications, pitches, journal submissions and newsletter records, including the IP address stored with them, are kept until we delete them. We delete them by hand when they are no longer needed, and promptly when you ask us to. Published journal articles are kept permanently, as part of the scholarly record.

Your rights and choices

Wherever you live, you can ask us to:

tell you what information we hold about you and give you a copy;
correct information that is wrong or incomplete;
delete your information (we will explain if we must keep something, for example a published article);
stop using your information for a particular purpose, or withdraw a consent you gave us;
remove you from the newsletter or the Scholars Network directory.

Write to info@cupa.org.pk. We may need to confirm your identity before acting on a request, and we will reply within one month. If you are unhappy with our answer, you may also be able to complain to the data protection authority where you live.

How we protect your information

The whole site is served over an encrypted connection (HTTPS). Files you upload, such as CVs, drafts and manuscripts, are stored in our database, not on public web addresses, and only signed-in staff can open them. Admin passwords are stored as salted, slow hashes, never in plain text. Database backups are encrypted. No system is perfectly secure, but we take reasonable care to protect what you send us.

Children

This website is meant for adults. We do not knowingly collect information from children under 16. If you believe a child has sent us personal information, please contact us and we will delete it.

Changes to this policy

When we change this policy we update the "Last updated" date at the top of the page and describe the change in the version note. If a change is significant, we will say so clearly on this page.

Contact

Privacy questions and requests: info@cupa.org.pk.

By post: [Legal name of the organisation], [Registered address for notices].