Privacy Policy

Prison Professors
Effective Date: February 16, 2026
Last Updated: August 18, 2026

Introduction

Prison Professors (“we,” “us,” or “our”) is a 501(c)(3) nonprofit organization dedicated to criminal justice reform and supporting justice-impacted individuals in building productive lives. We operate the website prisonprofessors.org and associated domains, including the Profiles platform.

We respect the privacy of every person who interacts with our organization — including website visitors, donors, volunteers, and the currently and formerly incarcerated individuals who participate in our programs. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what choices you have regarding your information.

Although nonprofit organizations are generally exempt from the California Consumer Privacy Act (CCPA/CPRA), we voluntarily adopt privacy practices consistent with its principles because we believe the people we serve deserve transparency and control over their personal information.

Who This Policy Applies To

This policy applies to all visitors to our website(s), donors and supporters, volunteers and staff, individuals who participate in the Profiles platform (whether currently incarcerated or formerly incarcerated), family members and designated contacts of Profiles participants, and anyone who communicates with us by email, mail, phone, or social media.

Information We Collect

We collect different types of information depending on how you interact with us.

From Website Visitors

When you visit our website, we may automatically collect your IP address and approximate geographic location, browser type and operating system, pages visited, time spent on pages, and referring website or link. We collect this information through cookies and similar technologies (see the Cookies section below).

From Attorney Directory Consultation Requests

Our attorney directory includes a form for requesting a consultation with a defense attorney. When you submit it, we collect your name, email address and telephone number, the general stage of your case, which federal district it is in, how you prefer to be contacted, any message you choose to write, and your confirmation that you agree to be contacted about it. Alongside your answers we record the page you came from and, if you reached the form from an attorney's profile, which attorney it was, so that the team knows the context you are writing from. The form asks where your case stands rather than what happened, and nothing you send through it is confidential or privileged.

From Donors and Supporters

When you make a donation or sign up for communications, we may collect your name, email address, mailing address, phone number, payment information (processed by our third-party payment processor — we do not store full credit card numbers), donation amount and history, and communication preferences.

From Profiles Platform Participants

When an incarcerated or formerly incarcerated individual enrolls in the Profiles platform, we collect the information provided in the Participant Consent & Publication Agreement, including:

• Full legal name (and pen name, if chosen)
• Date of birth
• BOP register number or state identification number
• Current facility name and address
• CorrLinks email address or mailing address
• Expected release date (if provided)
• Designated outside contact person's name, relationship, phone number, and email
• A signed copy of the Consent & Publication Agreement

We also receive and retain the journal entries, letters, reflections, and other written content submitted by participants, as well as photographs (if voluntarily submitted), records of any edit, removal, or withdrawal requests, and correspondence between the participant and Prison Professors regarding their profile.

From Mailed Letters and Scanned Mail

When a participant without electronic messaging access mails us handwritten letters, journal entries, or other written content, we scan each item to a digital file and store it on our systems. We use an automated artificial-intelligence service to transcribe the scan and prepare draft entries for staff review. As part of that processing, the service reads identifying details that appear in the letter — such as the sender's name and register number — which we use to locate the matching participant profile. A staff member reviews every transcribed entry, confirms the sender's profile, and approves or declines each entry before anything is published. No mailed content is published without staff review.

From Family Members and Designated Contacts

When a family member or designated contact communicates with us on behalf of a participant, we may collect their name, email address, phone number, mailing address, and their relationship to the participant.

From Authorized CorrLinks Extension Operators

Prison Professors provides a Chrome browser extension to specifically authorized staff and contractors who process participant messages received through CorrLinks. The extension uses the operator's existing Prison Professors account for authentication. It records the operator's account identifier, the CorrLinks inbox used, a randomly generated extension installation identifier, extension version, action performed, and action time for security and accountability.

When an operator opens a CorrLinks message, the extension reads that message's sender name, register number, subject, body, message identifier, and date. A register number may be sent to the Profiles platform to locate the matching profile. The full message content is sent when the operator chooses to publish it or explicitly adds it to the private follow-up queue. A follow-up task stores the sender name, register number when available, subject, body, message identifier, message date, and source CorrLinks account for authorized Profiles administrators. An operator-reviewed response is stored with the task after the extension successfully saves it as a CorrLinks draft. Before the first follow-up capture after this data practice changes, the extension displays an in-extension disclosure and requires the operator to confirm the save. CorrLinks account credentials are encrypted on the Prison Professors backend, provided only to an authorized operator for a requested login, and are not persistently stored by the extension.

How We Use Your Information

We use the information we collect for the following purposes.

For Website Visitors

• To operate, maintain, and improve our website
• To understand how visitors use our site so we can improve the experience
• To comply with legal obligations

For Donors and Supporters

• To process donations and issue tax receipts
• To send updates about our programs and mission (with your consent)
• To maintain accurate financial records as required by law

For Profiles Platform Participants

• To publish participant-submitted content on the Profiles platform in accordance with the signed Consent & Publication Agreement
• To communicate with participants about their profiles and content
• To process edit, removal, de-indexing, or withdrawal requests
• To conduct content review before publication (including redaction of third-party names and safety-sensitive information)
• To scan mailed submissions and use an automated artificial-intelligence service to transcribe them and prepare draft entries for staff review before publication
• To contact participants near their release date regarding post-release content options
• To maintain records of consent and participation for legal compliance

For Family Members and Designated Contacts

• To communicate about a participant's profile on their behalf
• To facilitate withdrawal, edit, or removal requests when a participant cannot contact us directly

For CorrLinks Extension Operations

• To authenticate and authorize extension operators
• To locate the participant profile associated with a register number
• To publish operator-approved participant content
• To securely route an operator-selected, non-publishable question or request to a private follow-up queue where authorized Profiles administrators can classify, claim, document, and resolve it
• To let an authorized administrator create a human-reviewed, de-identified and generalized Q&A entry from an answered question for an internal knowledge base that may support future response drafting
• To provide an authorized CorrLinks credential only for the requested login operation
• To audit logins, publications, follow-up captures, replies, and message deletions for security and accountability

Extension and follow-up task data is not sold or used for advertising. Raw task content is not placed in the knowledge base. Only generalized Q&A that an authorized administrator edits, reviews, and attests contains no identifying or case-specific information may be retained there. Raw task content and approved knowledge entries are not used to train or fine-tune a model in this release.

Information We Publish Publicly

The Profiles platform is designed to make participant content publicly accessible. When a participant's content is published, the following may be visible to anyone on the internet:

• The participant's first and last name (or pen name if one was chosen)
• Their state and facility of incarceration (general location only)
• Their expected release date (only if they chose to share it)
• A photograph (only if they submitted one)
• Biographical or background information they provided
• The text of their journal entries, letters, and reflections

We review all content before publication and may redact references to other incarcerated individuals, correctional staff, minors, victims, and individuals involved in pending legal matters. Participants may mark any submission “NOT FOR PUBLICATION” to exclude it from the platform.

Published content may be indexed by search engines, shared on Prison Professors' social media accounts, and cached or archived by third parties beyond our control.

Information Sharing and Disclosure

We do not sell, rent, or trade your personal information to any third party for any purpose.

We may share your information in the following limited circumstances.

With Service Providers

We use third-party services to operate our website, process donations, send emails, host data, and process participant mail. These providers are contractually required to use your information only to perform services on our behalf and to protect it in accordance with this policy. Current service providers include our website hosting provider, payment processor, email marketing platform, analytics services, a cloud file storage provider that holds scanned mail during intake, and an artificial-intelligence service provider that transcribes scanned mail and prepares it for staff review. We require that any artificial-intelligence provider we use is contractually prohibited from using participant content to train its models. Service providers may retain submitted content for a limited period under their own security and legal policies.

With White Collar Advice

We operate the attorney directory together with White Collar Advice. A consultation request you submit through it is sent to White Collar Advice, who arrange and conduct the consultation and who contact you using the details you provided. What you send is used to respond to your request and is not sold, rented or traded, and no part of it is published on the directory or anywhere else.

The directory's anonymous usage records described under Attorney Directory Analytics below are stored by White Collar Advice too, on the same shared system. They carry the random identifier from your browser and none of the details above.

With Legal Authorities

We may disclose your information if required to do so by law, court order, or governmental regulation, or if we believe in good faith that disclosure is necessary to protect the safety of any person, protect the rights or property of Prison Professors, or comply with a legal obligation.

With Participant Consent

We publish Profiles platform content only with the participant's signed consent as described in the Consent & Publication Agreement.

Data Retention

We retain different types of information for different periods based on legal requirements and operational need.

• Signed Consent & Publication Agreements and associated consent records are retained permanently or for a minimum of 10 years after the participant's last interaction, consistent with California's statute of limitations for charitable organizations.
• Profiles platform content that is actively published is retained for as long as the participant wishes it to remain public or until they request withdrawal. Content that has been archived or removed at the participant's request is retained in our internal records for 7 years after removal, unless the participant requests permanent deletion under the post-release options in the Consent Agreement.
• Scanned mail and letters. When a participant mails us handwritten letters, journal entries, or other written content, we scan them and process the scan to prepare the content for publication. The scanned image is retained for up to 7 years after the content is published, as the record of what the participant submitted in their own hand. Mail that consists mostly of documents authored by people other than the sender is deleted within approximately 90 days instead. Working copies held in our intake folder are deleted within 30 days of processing. Machine-generated transcriptions, extracted identifiers, and other automated readings of a letter are deleted 90 days after the letter is published, declined, or fails processing. A scan that is never published — for example, because we cannot identify the sender — is deleted no later than 2 years after we receive it. Participants may request permanent deletion of their scanned letters from our systems at any time under the post-release options in the Consent & Publication Agreement. Anonymous quality measurements that contain no personal information and are not linked to any participant may be retained.
• CorrLinks extension message data is held in the browser only while the operator processes the open message and is not written to extension local storage. If the operator publishes it, the resulting content follows the Profiles platform retention period above. If the operator explicitly adds it to the private follow-up queue, the source message and participant identifiers are stored while action is required. Raw source message bodies, prepared responses, administrator notes, and unapproved review candidates are retained for 90 days after the task is completed or dismissed, then deleted. Before deletion, an authorized administrator may create a human-reviewed, de-identified and generalized Q&A entry. Approved entries are detached from participant, task, message, account, profile, and operator identifiers and may be retained in the internal knowledge base.
• CorrLinks operator and audit records, including operator identifiers, inbox, installation and extension-version identifiers, actions, and action times, are retained for 4 years after the last recorded action for security, accountability, and incident investigation. A deletion request removes these records when the period has expired, unless a longer period is required for an active security investigation or legal obligation.
• Encrypted CorrLinks account credentials are retained only while the account is authorized for this workflow. They are deleted within 30 days after an authorized administrator removes the account, except when temporary retention is legally required.
• Attorney directory consultation requests are held by White Collar Advice rather than by us, for as long as they need them to answer and follow up on the request. We keep no copy. To have one deleted, contact us using the details in the Contact Us section below and we will pass the request on.
• Donor records, including donation history and tax receipts, are retained for a minimum of 7 years as required by IRS regulations.
• Website analytics data is retained in aggregate form and is not linked to individual identities after 26 months.
• General correspondence and operational records are retained for 4 years after the last interaction.

When a retention period expires, we securely delete or destroy the information from active systems. Residual digital copies may remain temporarily in restricted backups and are removed as those backups expire under the applicable backup retention schedule. For physical records (such as mailed letters), this means secure shredding.

Data Security

We take reasonable measures to protect the personal information we collect from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encrypted data transmission (HTTPS/TLS) for all website traffic
• Access controls that limit who within our organization can view personal information
• Separate storage of consent records and published content (consent documents are not stored in publicly accessible systems)
• Secure handling and storage of physical mail received from participants
• Regular review of our security practices

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. If we become aware of a data breach that affects your personal information, we will notify affected individuals as required by applicable law.

Cookies and Tracking Technologies

Our website uses cookies and similar technologies to ensure the website functions properly, to understand how visitors use our site (analytics), and to remember your preferences.

We use the following types of cookies:

• Strictly necessary cookies enable core website functionality such as navigation and access to secure areas. These cannot be disabled.
• Analytics cookies help us understand how visitors interact with our website by collecting information anonymously.
• Functional cookies remember choices you make (such as language or region) to provide a more personalized experience.

We do not use advertising or tracking cookies, and we do not serve targeted advertisements.

You can control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling cookies may affect the functionality of our website.

Your Rights and Choices

Regardless of whether specific privacy laws apply to our organization, we believe everyone who interacts with Prison Professors should have the following rights.

• Access. You may request a copy of the personal information we hold about you.
• Correction. You may request that we correct inaccurate personal information.
• Deletion. You may request that we delete your personal information, subject to our legal obligations to retain certain records (such as tax receipts and consent agreements).
• Withdrawal of Consent (Profiles Participants). You may withdraw your consent to participate in the Profiles platform at any time. See the Consent & Publication Agreement for specific procedures and timeframes.
• De-Indexing (Profiles Participants). You may request that we add technical measures to discourage search engines from displaying your profile in search results.
• Communication Preferences. You may opt out of receiving non-essential communications from us at any time by contacting us or using the unsubscribe link in our emails.

To exercise any of these rights, contact us using the information in the Contact Us section below. We will respond to requests within 30 business days.

Attorney Directory Analytics

Our attorney directory records which states, districts, profiles and contact links visitors use, and when a consultation is requested, so that we can tell how many people the directory helps. Those analytics records are anonymous: they are keyed to a random identifier stored in a cookie in your own browser, and they contain no name, no email address and no advertising or cross-site identifier. The identifier is created by this website and readable only here, so it cannot be matched against an identifier held by any other site, White Collar Advice's own included. The records themselves are stored by White Collar Advice, who operate the directory with us, as described under Information Sharing above.

These records are kept for 13 months and then deleted automatically. You can delete yours at any time, without contacting us and without telling us who you are: the button below erases every directory record attached to your browser's identifier and then clears the identifier itself.

The button below does not delete a consultation request. Those carry no browser identifier for it to match against, and they are held by White Collar Advice as described above; to have one deleted, contact us using the details in the Contact Us section below.

Special Considerations for Incarcerated Participants

We recognize that currently incarcerated individuals face unique privacy challenges, including:

• Limited ability to monitor how their information appears online
• Limited access to legal counsel regarding privacy matters
• Restricted communication channels
• Heightened vulnerability to misuse of personal information

For these reasons, we commit to the following additional practices for Profiles platform participants:

• We will not publish any content without a signed Consent & Publication Agreement on file.
• We review all content before publication and redact references to third parties who have not consented.
• We provide a designated outside contact mechanism so that a trusted person can act on the participant's behalf if needed.
• We proactively contact participants near their release date to discuss whether they wish their content to remain public, be archived, be deleted, or be converted to a pen name.
• We do not condition any services, benefits, or treatment on a participant's willingness to share their content publicly.

Children's Privacy

Our website and programs are not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a minor's information has been submitted to us, please contact us immediately.

We also take steps to redact references to minors in Profiles platform content before publication.

Third-Party Links

Our website may contain links to third-party websites, services, or resources. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party website you visit through links on our site.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last Updated” date at the top of this policy and post the revised version on our website.

For Profiles platform participants, if we make material changes that affect how their personal information or published content is handled, we will make reasonable efforts to notify them in writing through their preferred contact method.

Contact Us

If you have questions about this Privacy Policy, wish to exercise any of your rights, or have concerns about how your information is being handled, you may contact us at:

For Profiles Platform Participants (Currently Incarcerated)

For Family Members or Designated Contacts of Participants

Email: privacy@prisonprofessors.org