Privacy policy
Version 1.0, effective 31 July 2026.
This policy explains what personal data Board USA collects, why it is collected, who it is shared with, and what you can require about it. It covers theboardusa.com and the email sent from it.
1. Who is responsible
Board USA is a career education and preparation practice run by Rafael Souza, based in Houston, Texas, United States. For anything related to personal data, including the rights below, write to [email protected].
Readers come from several countries, so we apply the same standard to everyone rather than the minimum required in any one place.
2. What is collected
| Data | How it reaches us | Why |
|---|---|---|
| Email address | You type it into the form | To send the guide and the writing that follows |
| Where you are in the process (planning, already in the U.S., immigration process under way) | You choose it, optionally, on the page after signup | To tailor what gets sent |
| Consent record: date, time and IP address of the submission | Automatic, at signup | To evidence that the contact was authorised |
| Email delivery and engagement data (opens, clicks) | Automatic, through the email tool | To tell whether the writing is useful and keep the list clean |
| Technical browsing data: device type, browser, approximate country | Automatic, at the server | Security and aggregate access statistics |
We do not ask for your name, phone number, address, identity document, immigration status, bank details or any sensitive category of data to join the list. If that ever changes it will be asked explicitly, for a stated purpose.
3. Legal basis
The guide and the writing that follows are sent on the basis of your consent, given when you submit the form and confirmed by clicking the confirmation email. Technical access logs and the consent record are kept on the basis of our legitimate interest in keeping the service secure and auditable.
Consent can be withdrawn at any time, without giving a reason and at no cost, through the unsubscribe link at the bottom of every email or by writing to the address above.
4. Who the data is shared with
We do not sell, rent or trade personal data. It passes only through the providers the service needs to run:
- Cloudflare, Inc. - website hosting, content delivery and domain email routing.
- Kit (formerly ConvertKit) - list storage and email delivery.
- Google LLC - the inbox that receives mail sent to the contact address.
Data may also be disclosed where a court order or a lawful request from a competent authority requires it.
5. International transfer
The providers above operate in the United States and the practice is based in Houston. If you are outside the United States, your data is processed abroad. By signing up you are aware of that, and the transfer is grounded in your consent and in the fact that it is necessary to deliver exactly what you asked for.
6. How long data is kept
For as long as you are on the list, and for up to five years after you leave it as regards the record of consent and of the unsubscribe request. That retention has one purpose: to evidence that the contact was authorised and that the request to leave was honoured. Everything else is deleted or anonymised.
7. Your rights
Wherever you are, you may ask us to: confirm whether we hold your data; give you access to it; correct anything incomplete or out of date; delete it; restrict or object to its use; provide it in a portable format; tell you who it has been shared with; and withdraw consent. Residents of California may additionally request disclosure of the categories of personal information collected and may direct that it not be sold or shared, which it is not.
Write to [email protected]. We answer within 30 days, at no cost, and you do not have to justify the request. We will not treat you differently for exercising any of these rights.
8. Cookies
This site sets no tracking, advertising or profiling cookies, and runs no third party analytics. What exists are the technical requests a page needs to load, including fonts loaded from Google Fonts, which records the requesting IP address in order to serve the file.
9. Security
Data sits with providers that encrypt it in transit and at rest. The site is served over HTTPS only. Access to the list is restricted to the person responsible. No system is perfect: if a security incident creates meaningful risk, we will notify affected people and the relevant authority as the applicable law requires.
10. Children
The content is written for working adults. We do not knowingly collect data from anyone under 18. If that happens by mistake, the data is deleted as soon as it is identified.
11. Changes
This policy may be updated when the service changes or the law requires it. The version in force is always the one published on this page, dated at the top. Any change that widens how your data is used will be emailed to you before it takes effect.
Questions about this document: [email protected].