Privacy Policy

This policy explains what personal information the Maryland Counties Business Association (“MCBA,” “we,” “us”) collects through mc-ba.com, why we collect it, who can see it, how long we keep it, and how to have it removed. It sits alongside our Terms of Service, which govern participation more broadly.

MCBA is a student-led organization. Most of our members are high school students, and many are minors, so this policy is written to be read by students and parents rather than lawyers.

We collect only what the platform needs to work. There is no advertising network, and nothing here follows you to other websites. We do count page views, anonymously and without cookies, so we can see which pages are actually useful. That is described in section 7.

• Member accounts: your name, email address, the student ID number your school issued, and a hashed password. The school ID number exists only so MCBA can confirm you are a student and place you in your school's chapter: nothing is sent to it, and it is shown to nobody outside MCBA. Passwords are stored only as hashes and can never be read back, by us or anyone else.
• Starting a chapter: the name, email, school and grade of the student applying, and anything else they choose to add on the form (a phone number, the faculty advisor's name, the expected size, why they want to start one, and who referred them), so we can respond to the request.
• Chapter membership: which chapter you are in, and when your membership in it runs out.
• Referrals: the referral code you signed up with and so who referred you, and the credits your own referrals earn and where they were spent.
• Summit tickets: your ticket, its code, what you paid and any credit applied, and whether it has been used at the door.
• Learning progress: which resources you have completed, quiz and practice results, points, and the competitions you declare you are entering.
• Portfolio Simulator: the runs you start, the orders you place, and the scores you earn.
• DECA practice and FBLA practice, if you use them: the transcript of what you said in a practice run, the event and scenario, and the evaluation and scores it earned. In a live run with your camera on, up to eight still images are taken during the run, sent for grading and then discarded; only the grader’s one-line note about each is kept. In a recorded review, your video is read inside your own browser and never uploaded to us or to anyone: only the transcript and a set of numbers about your delivery (such as how much of the time you faced the camera, your pace, and your filler words) are sent and kept. Live transcription is done by your browser’s own speech recognition, which your browser’s maker provides (Google in Chrome, Apple in Safari). In FBLA practice, the AI judge also writes one or two follow-up questions from what you said, and they are kept with the run.
• FBLA study counts: for each FBLA concept, how many of its practice questions you have answered and missed, and how often a graded FBLA role play named it as missed, so the FBLA page can suggest what to study next.
• Payments: if you buy a plan, your name, email address and the billing address you enter go to Stripe, which runs the checkout page. Your card number is entered on Stripe’s page and never reaches us. We keep Stripe’s customer and subscription identifiers for your account and a record of each payment: the amount, date, status and a link to the receipt.
• Sponsorships and donations: the name and business name you type on our page before checkout, whether you left “list us as a partner” checked, the amount and tier, and, for a donation, your message and whether you would like to hear about the Summit; from Stripe, the email address and payer name from the checkout. We keep this as the record of who our partners are.
• Sign-in records: the account and role that signed in and when. We do not keep a lasting record of IP addresses.
• Protecting accounts and forms from abuse: when a sign-in fails we briefly keep the email or username that was typed, plus a count of recent failures, so repeated guessing can be slowed down. That record is deleted the moment you sign in correctly, and within an hour either way. Separately, we count recent requests per network address in temporary memory for at most fifteen minutes, so one source cannot flood our forms or our email. Neither is used to identify you or kept for anything else.
• Page views: which page was opened, the page that linked to it, the country it was opened from, and the type of browser and device. This is counted anonymously, is never linked to your account, and sets no cookies.
• Devices: a device identifier, your browser's user-agent string, and a readable label such as “iPhone, Safari,” so you can see where you are signed in and stay within the device limit.
• Messages you send us: anything you type into the contact or feedback forms, or into a custom sponsorship request.

Because many of our members are minors, every account created on mc-ba.com must confirm at signup either that the member is 18 or older, or that a parent or legal guardian has read and agreed to our Terms on their behalf.

We record the moment that confirmation is given. We deliberately do not ask for a date of birth: asking every member to prove their age would mean holding more personal information about minors, not less, and a single confirmation covers both cases.

MCBA is for high school students and is not directed to children under 13. Signing up confirms the member is at least 13, and we do not knowingly collect personal information from a child under 13. If we learn that an account belongs to one, we close it and delete its data. A parent who believes this has happened should email us.

A parent or guardian may withdraw consent at any time by contacting us. Withdrawing consent means the account is closed and the associated data deleted, as described below.

DECA practice and FBLA practice use the microphone, and the camera only if the member turns it on. A parent or guardian should know that before a member uses it. Every practice run asks the member to confirm what will be sent before it starts, and the camera can always be left off.

• To run your account and keep you signed in.
• To run the Competition Academy and record your progress through it.
• To place you in your school's chapter.
• To send you account email: verification links, password resets, your Summit ticket, and replies to messages you send us. We do not send members marketing email; a donor who asked at checkout to hear about the Summit gets that and nothing else. If we start an emailed newsletter, we will say so here first, and every issue will let you unsubscribe without affecting account email.
• To understand which parts of the platform are used, so we can improve them.
• To keep accounts safe, by slowing down repeated password guessing and stopping our forms being used to send bulk email.

We do not use your information to build a profile of you for advertising, and we do not use automated decision-making that produces legal or similarly significant effects.

• You can see everything on your own account.
• There are no chapter accounts. MCBA administrators place members into their school's chapter, using the school ID number to confirm the school; nobody outside MCBA sees it.
• MCBA administrators can see member and student records in order to run the organization.
• DECA and FBLA practice runs are visible to you and to MCBA administrators, who may read a run and its evaluation to check that the grader is accurate. Your FBLA study counts are visible to you. Nothing about a practice run is ever public.
• Nobody else. Student names and progress are never shown on any public page of this site.
• The one thing shown publicly by design: a sponsor's or donor's business name (or their own name, if they gave no business) on the Sponsors page and the home page, as an MCBA partner, when they left that box checked at checkout. Email us to have it taken down.

• We never sell personal information, and we never rent or trade it.
• We never share student information with advertisers.
• We never run advertising scripts, and we never use a tracker that follows you to other websites. The one measurement tool we do run counts page views anonymously and sets no cookies.
• We never publish a student's name, email, school, or progress publicly.

Running the site means some data is stored or transmitted by other companies. We use as few as we can, and each one only does the job named here.

• Vercel hosts the website and runs its server code.
• Vercel Web Analytics counts page views so we can see which pages are useful. It sets no cookies, does not follow you to other websites, and does not build a profile of you.
• Neon stores the database.
• Microsoft Graph, or Resend where Graph is unavailable, delivers account email such as verification links and password resets.
• Stripe processes membership payments and runs the checkout and billing pages. Card details are entered on Stripe’s pages and never reach our servers. Stripe may act as the seller of record for the purchase, in which case the charge appears as LINK.COM* MC-BA.COM and Stripe sends the receipt; Stripe’s own privacy policy applies to what it holds.
• An AI model made by DeepSeek grades DECA and FBLA practice runs, and writes FBLA practice’s follow-up questions. It runs in the United States, on Baseten or Fireworks, reached through Vercel’s AI Gateway, which sends it only to providers that do not use it to train any model. Both providers’ own terms are to keep nothing: what they receive is held only while the run is graded. Nothing is sent to DeepSeek itself. The grader receives the transcript, the scenario and, in a live run with the camera on, up to eight still images; for a follow-up question, only what you said in the run so far and the scenario. It never receives your name, your email or any detail of your account. A provider may keep a request it flags for abuse review, under its own policies.
• For a recorded DECA practice review, the speech-recognition and body-language models are downloaded to your browser from Hugging Face, jsDelivr and Google, and run there. Your video is never sent to them or to us.

• Account and progress data: kept while your account is open.
• Sign-in and device records: kept for 12 months, then deleted.
• Abuse-prevention records: the failed sign-in count is deleted on a successful sign-in, or within an hour. The per-network request counters live in memory for at most fifteen minutes and are never written to the database.
• Messages sent through our forms: kept for 12 months, then deleted.
• Payment records: kept while your account is open and deleted with it. Stripe keeps its own transaction records for as long as financial regulations require, under its own policy.
• DECA and FBLA practice runs: kept while your account is open, and deleted with it, or at any time by deleting the run yourself from the practice page. Deleting a run erases everything in it; of a run that was graded, or that cost anything to grade or to write the judge’s follow-up questions, we keep only its event, the date and what it cost, so it still counts toward the weekly allowance, and that goes when your account does. FBLA study counts: kept while your account is open, and deleted with it. Still images from a live run are never stored, and a recorded review’s video never reaches us.
• Accounts inactive for two years: reviewed and closed, and the data deleted.
• Deletion requests: acted on within 30 days of a verified request.

Backups may hold a copy for a short period after deletion, and are overwritten on a rolling basis.

You, or your parent or guardian, may ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email us and say which of the three you want.

We will verify the request comes from the account holder or their guardian before acting on it, and we will complete it within 30 days. There is no charge.

Some states give residents further privacy rights by law. We honor the requests in this section for every member, wherever they live.

• Passwords are stored as hashes, never as text.
• The whole site is served over HTTPS.
• Every part of the member portal and the admin area checks who you are on the server, on every request, not just in the browser.
• Signing in is limited to a small number of devices per account.

No system is perfectly secure. If a breach ever affects your information, we will tell affected members and, where the law requires it, the relevant authorities.

Where MCBA operates a chapter in partnership with a school or district, that partnership may be governed by a separate written agreement covering student data. Where such an agreement exists and its terms differ from this policy, the agreement governs.

Schools and districts may contact us at the address below with questions about student data, and we will answer them.

If we change this policy in a way that meaningfully affects what we collect or who can see it, we will update the effective date above and notify members by email.