Privacy Policy

More Than Conquerors Inc., known as MTC Surf ("MTC," "we," "us," or "our"), operates mtcsurf.org and related MTC account, registration, volunteer, donation, and event services. This policy explains how we handle personal information through those services and related communications. It also covers information retained from our previous website and information you provide to our team for these purposes.

1. Contact us

For privacy questions or requests, contact:

More Than Conquerors Inc. — Privacy
1645 Donlon St., Ste. 103
Ventura, CA 93003
Email: elle@mtcsurf.org
Phone: (805) 216-9824

Please do not send passwords, verification codes, payment-card numbers, identity documents, or detailed medical histories in ordinary email or chat. We will explain a suitable way to provide additional information if it is needed.

2. Information we collect and why

We collect information you give us, information supplied by an authorized parent, guardian, purchaser, guest organizer, or MTC team member, and information generated when you use our services. We also receive necessary information from our service providers and retained MTC records.

• Account and contact information. Name, email, phone number, profile photo if provided, login identifiers, verification status, account roles, and communications. We use these to identify you, provide account access, respond to you, and administer your relationship with MTC.
• Participant and registration information. Participant names and ages, authorized adult and family relationships, event choices, registrations, attendance, cancellations, waitlist status, and emergency or event contact information where requested. We use these to organize participation and communicate about events.
• Safety, equipment, and support information. Height, weight, water comfort, allergies or dietary restrictions, relevant support needs, and optional program-background information. We use these for equipment planning, eligibility where relevant, support, and event safety. Optional background fields should not contain an unnecessary account of a person's trauma or history.
• Forms and consent records. The forms presented, your selections, signer name and capacity, typed or drawn signature, timestamps, and associated technical evidence. We use these to document permissions, maintain accurate records, and respond to questions or claims.
• Volunteer information. Applications and saved drafts, date of birth, experience or introduction, region and role preferences, training acknowledgments, Live Scan appointment/completion information, clearance status, review decisions, assignments, and attendance. We use these to administer volunteer preparation, review, and staffing. The website records Live Scan status; its application forms do not collect fingerprint images.
• Donations and purchases. Donor or purchaser contact details, amounts, selected items or sponsorships, recurring-gift status, transaction references, billing information returned by the processor, receipts, refund/dispute records, guest names, seating, and check-in. We use these to process and account for payments and fulfill event arrangements.
• Messages and preferences. Messages, support requests, partner inquiries, newsletter choices, delivery information, and abuse reports. We use these to communicate, manage preferences, and address problems. Email providers may report delivery, bounce, complaint, open, or click events where their relevant features are enabled.
• Technical and security information. IP addresses or derived identifiers, browser/device information, cookies, session records, request times, errors, and security/audit events. We and our providers use these to operate, secure, troubleshoot, and improve the services.

Payment details entered into Stripe-hosted checkout are collected by Stripe. MTC's website does not receive your full card number or card security code through that checkout. We receive the payment information needed for records, reconciliation, assistance, and refunds or disputes.

We also use information where necessary to meet legal, accounting, insurance, and safety obligations; investigate suspected abuse or fraud; and establish or defend legal claims.

3. Children, participants, and guardian information

Our programs serve young people. Participant registrations and permissions requiring adult consent must be completed by an adult with appropriate authority. An account, family relationship, or caregiver description by itself does not establish legal authority to consent for someone else. For an adult participant, any person acting on their behalf must have the necessary authority.

Teenage volunteers aged 13–17 may have their own accounts, with parent or legal guardian involvement and any permission required for the activity. We receive account details, volunteer applications, preferences, and messages directly from teenagers who use these services. Having an account does not replace volunteer review, event approval, or activity-specific requirements.

Children under 13 should not create accounts or submit information directly through the website. We receive participant information from adults arranging participation. If you believe a child has submitted information directly without appropriate involvement, contact us so we can review the situation and take appropriate action.

Parents, guardians, adult participants, and other legally authorized representatives may contact us to request access to, correction of, or deletion of information they are entitled to manage. We verify identity and authority before responding. We may retain records needed for safety, signed permissions, legal obligations, or claims, and we do not disclose another person's private information through an access request.

4. When information is shared

We share information as reasonably needed for the purposes described here:

• Within MTC: with authorized team members and volunteers according to their responsibilities, including registration, event preparation, safety, volunteer review, finance, and support.
• With service providers: companies that support hosting, storage, authentication, payments, email, security, and technical operations. Current services include Sites/Cloudflare for website delivery, Neon for stored application records, WorkOS for login, Stripe for payments, and Resend and Microsoft 365 for email-related services. Their handling of information also depends on their role and applicable agreements and privacy notices.
• With people you interact with: conversation participants can see information you share in their chats, including your displayed identity. Purchasers or table organizers may manage guest information associated with their purchase. Sponsor names, logos, or recognition material may appear publicly as described in the purchased package or separately agreed.
• With advisers, insurers, authorities, or emergency responders: when reasonably necessary to obtain professional assistance, address safety concerns, meet legal requirements, respond to lawful requests, or protect legal rights.
• At your direction or with appropriate permission: including approved public stories, media, or partner arrangements.

We do not sell personal information. Sponsorship recognition does not itself grant access to private participant, volunteer, or donor records.

MTC chat is an organizational communication service, not a confidential counseling channel. Authorized administrators may access messages as permitted by their role to administer conversations, investigate reports, and address safety or compliance issues. Do not put sensitive participant details into a general group conversation.

5. Photos and videos

Participant photo/video permission is handled separately from these website terms and this privacy notice. The participant registration flow offers a separate media choice. Declining optional media permission does not by itself prevent registration.

Use of a website account or participation in chat does not grant blanket permission to publish a child's image or story. Contact us to discuss a permission change or a concern about published media. We will review the request against the applicable release, your authority, legal requirements, and what we can reasonably control. Copies already distributed or republished by others may not be recoverable.

6. Cookies, external content, and browser signals

We use cookies and similar browser storage to support sign-in, security, preferences, and continuity during tasks such as checkout. Blocking or clearing them may interrupt these features or sign you out. Our infrastructure providers also receive technical information when they deliver or protect a page.

Some pages include content or media supplied by other companies, such as Instagram/Meta or YouTube/Google. Loading that content can disclose your IP address and browser information to its provider; the provider may use cookies or recognize you across services under its own policies. Clicking an external link takes you to a service with its own information practices. You can restrict third-party cookies through your browser, although some content may stop working.

The MTC application does not currently change its behavior in response to the legacy browser "Do Not Track" setting. Embedded providers have their own tracking practices. Contact us about privacy choices or opt-out rights that apply to you. Any legally required handling of browser privacy signals remains MTC's responsibility and is not replaced by an email request.

7. Your choices and requests

You can edit the profile fields made available in your account and contact MTC about information you cannot change yourself. You may ask us to review, correct, provide access to, or delete your information, or to stop an optional use. Applicable legal rights depend on the circumstances and your location.

To make a request, email elle@mtcsurf.org with a description of what you need. We may need proportionate verification of your identity or your authority to act for someone else. We will explain if we cannot fulfill all or part of a request and respond within any legally required period. Deletion of an account does not necessarily delete signed forms, payment records, safety records, or other information we must retain.

Where offered, use the unsubscribe link in an optional newsletter or contact us to stop optional promotional messages. An unsubscribe request does not cancel a registration, ticket, assignment, or recurring gift. Necessary messages about a transaction, active registration, account security, or a requested service may still be sent.

For monthly-gift cancellation, use the instructions at Monthly donation help or contact elle@mtcsurf.org. Privacy requests and newsletter opt-outs do not themselves stop recurring charges.

8. Retention, security, and service locations

We retain records according to their purpose and applicable legal, accounting, insurance, safeguarding, and dispute requirements. Relevant factors include whether an account or registration is active, whether a participant is a minor, the need to preserve signed permissions or transaction evidence, and whether a claim or preservation obligation exists. Saved drafts, message records, technical records, and historical website imports may have different retention needs.

Deletion or removal from an active page may not remove all audit records, legally retained records, or backup copies. Contact us for information about a particular category; this policy does not promise a fixed automatic deletion period for every record.

We use administrative and technical safeguards intended to restrict access and protect information. No internet service or storage system can guarantee absolute security. Our providers may process information in the United States or other locations where they operate, subject to applicable requirements.

9. Changes to this policy

We will post revisions with an updated effective date. For material changes, we will provide a prominent website notice or another appropriate notice, such as email, where required. If a new use requires consent, we will obtain it before beginning that use. A later policy does not retroactively authorize an incompatible use of information already collected.