Privacy notice

This notice explains what information Caribbean Mosaic collects, why, who can see it, how long we keep it and the choices you have. Please read it with our Terms of use.

Last updated 1 November 2026.

The short version

You can search and read the library without an account. We don’t use cookies for analytics, advertising or tracking.
We count page views, downloads and searches to see how the library is used. The counts don’t say who you are, with one exception: we record which members open members-only and view-only resources.
If you create an account, we ask for your name, email, country and a few details about your work. Questions about gender, sexual orientation and gender identity are optional.
Your account only keeps a list of your searches and downloads if you turn that on. You can clear it or turn it off at any time.
Your profile is never public. Only the library’s administrators can see your account details.
We never sell your information or use it for advertising.
You can see, correct and remove your details, and ask us to delete your account, at any time.

Who we are

Caribbean Mosaic is run by the Caribbean Forum for Liberation and Acceptance of Genders and Sexualities (CariFLAGS) [full legal name, registration number and registered address to confirm]. CariFLAGS decides how and why your information is used, and is responsible for it under data protection law (the “data controller”).

Our data protection contact is [name or role] at [privacy email address]. [CariFLAGS to confirm whether a data protection officer must be appointed and registered with a regulator.]

When you browse the library

You don’t need an account to search, read summaries or download open-access resources, and we don’t ask who you are.

Like every website, our hosting provider’s servers keep short technical logs of visits: your IP address, browser type, the pages you open, including any words you search for, and the time. We use them only to keep the site running and secure, and they are deleted after [number] days. [CariFLAGS to confirm with the hosting provider.]

To see how the library is used, we count each time someone opens a resource’s page, downloads or reads a resource, or searches. Each count keeps the date and time, the resource, and the country the visit came from: our hosting provider works this out from the IP address, or we use the country on your account if you’re signed in. A search keeps the words searched for and how many results it found, with only the hour and no country. It doesn’t keep your name, account, IP address or anything else that says who you are, and it uses no cookies. Library staff and search engines aren’t counted, the same page or file opened again within half an hour counts once, and we only report the counts as totals.

The one exception is members-only and view-only resources: see Members-only and view-only resources below. Apart from that, what you open or search for is only kept against your account if you turn on your history. See Your history below.

Members-only and view-only resources

Some rights holders share their work with the library on condition that only approved members see it. To protect it, each time you download a members-only resource or read a view-only one, we record your account, the resource, the date and time, and the country the visit came from. We do this whether or not your history is on.

Who can see it: only the library’s administrators, for example to look into a possible breach of our Terms of use. If we tell rights holders how often their work is opened, we only give totals, never names. [CariFLAGS to confirm what rights holders are told.]
What we never do: publish it, show it to other members, or use it for advertising.
How long: after two years, or as soon as your account is deleted, the record no longer says who opened the resource. It is kept only as a count.

It doesn’t appear on Your account. You can ask us for a copy, as explained in Your rights.

When you create an account

An account lets you open view-only and members-only resources once the library team approves you. We ask for:

Required: your name, email address, country, which best describes you (activist, academic or individual) and a password.
Optional: your organisation, your job title or role, and whether you’re affiliated with CariFLAGS.
Optional, with your separate consent: your gender, sexual orientation and gender identity. See the next section.

Your password is stored scrambled (hashed), so no one at CariFLAGS can read it. We record when you agreed to our terms and which version you agreed to, when your account was created, when it was approved and when you last signed in. If you choose to keep your history when you sign up, we record that too.

Before your account is created, we email you a link to confirm your address. Until you open it, the details you entered are held for up to 24 hours, then deleted.

We use these details to decide whether to approve your account, to run it, to contact you about it and to understand who uses the library. Approval is decided by a person, never automatically.

Gender, sexual orientation and gender identity

These questions are optional. You can leave any of them empty, and leaving them empty never affects whether your account is approved or what you can open.

If you answer, we ask you to agree to us keeping your answers. This is your explicit consent, and it is the only reason we hold them.

Why we ask: to help CariFLAGS understand who uses the library. When we report on this, we only use totals, and never numbers so small that someone could be recognised.
Who can see them: only the library’s administrators. They are not included in account approval emails, the digest mailing list or any report that names people.
What we never do: publish them, share them with anyone outside CariFLAGS, or use them to decide anything about you.
Changing your mind: you can change or remove your answers at any time from Your account. When you remove them, we delete them and the record of your consent.

The monthly digest

If you sign up for the digest, we keep your name, email address, country, and your organisation and role if you give them, with the date you agreed and where you signed up. We use them only to send you the digest.

You can unsubscribe at any time from Your account, from the link in any digest email, or by contacting us. We then remove you from our list straight away, and your record is permanently deleted within 30 days.

If you sign up on the digest form, we first email you a link to confirm your address, and only add you once you open it. Until then, the details you entered are held for up to two days, then deleted.

Deleting your account also unsubscribes you from the digest.

Your history (optional)

Your account can keep a list of what you search for and the resources you download or read, so you can find them again. It is off unless you turn it on, when you sign up or later from Your account.

What it keeps: the words you search for and how many results they found, and the resources you download or read, each with the date and time. Nothing is kept while it is off, or when you aren’t signed in.
Who can see it: you, on Your account, and the library’s administrators, for example to help you with a problem or to look into a possible breach of our Terms of use. Each time an administrator opens it, we keep a record of who did and when.
What we never do: publish it, share it with anyone outside the library’s administrators, or use it for advertising.
Clearing it or turning it off: you can do either at any time from Your account. Turning it off also deletes everything it kept.
How long: each entry is deleted after two years, and all of it when your account is deleted. The record of administrators opening it is kept for two years, even if you clear your history, so there is always an account of who saw it.

We keep your history only with your consent, which you can withdraw by turning it off.

When you send in a resource

When you send a resource, we keep the file or link and the details you give about it, together with a record of who sent it and when. The library team receives an email with your name and email address so they can review it and contact you. We email you when we receive it, and again when it is published or if we can’t add it.

Your name is not shown with the resource. The authors shown are the ones you list as the document’s authors.

If we can’t add a resource, we keep a record of it and our reason, so we can answer questions about it later.

When you contact us or report a problem

The contact form asks for your name, email address, a topic and your message. We use them only to reply to you.

Report a problem asks what is wrong with a resource. Your email address is optional, and we use it only if we need to ask you more or tell you what we did.

We don’t record your IP address or account with either form.

The feedback survey

The feedback survey asks how satisfied you are with the library, whether you found what you were looking for and, if you like, what would make it more useful. Your answers are anonymous: we don’t record your name, email address, account or IP address with them, even if you are signed in. Please don’t include your name or anyone else’s personal details in your comment.

To see how many people finish the survey, we count how often the survey page is opened, once a day for each visitor. The count is a number only, with nothing about who opened it. Each answer is dated by the day only, not the time.

Only the library’s administrators can see the answers. When we report on them, we only use totals and short comments that can’t identify anyone.

Our legal grounds

Data protection law requires a legal ground for each use of personal information. Ours are:

Our agreement with you (the Terms of use): to create and run your account, give you access and handle the resources you send.
Consent: for the digest and your history, and explicit consent for your gender, sexual orientation and gender identity. You can withdraw consent at any time. This doesn’t affect anything we did before.
Legitimate interests: to review accounts, protect resources that their owners share only with members (including recording who opens them), count how the library is used so we can improve it, reply to messages and reports, and keep the site secure. We only rely on this where it doesn’t override your interests and rights.
Legal obligations: where the law requires us to keep or disclose information.

Who can see your information

“The library team” means the CariFLAGS staff and volunteers who run Caribbean Mosaic.

Account details and answers about gender, sexual orientation and gender identity: only the library’s administrators.
Your history, if you turn it on: you and the library’s administrators.
Who opened members-only and view-only resources: only the library’s administrators.
Usage counts: the library team. They don’t say who anyone is.
Survey answers: only the library’s administrators, and they aren’t linked to you.
Resources you send, messages and reports: library team members who manage the library.
Everyone else: nobody. There are no public profiles, member lists or author pages for members.

Everyone on the library team who can see personal information must keep it confidential.

We never sell, rent or trade personal information, and never share it for advertising or marketing. We only give it to anyone else if the law requires us to. If we receive a legal demand for it, we will check that the demand is valid, give only what we must, and tell you first unless the law forbids it.

Service providers

We use a small number of providers to run the library. They act only on our instructions, under contracts that require them to keep information secure and confidential, and may not use it for anything else.

Website hosting: [provider name], with servers in [country]. Stores the site, its database and backups.
Email delivery: [provider name]. Sends account, contribution and contact emails.
Digest mailing service: [provider name, for example Brevo]. Holds the digest list and sends the digest.

[CariFLAGS to confirm the providers. Any added later will be listed here.]

Videos from YouTube and Vimeo

Some resources are videos played from YouTube or Vimeo. We use YouTube’s privacy-enhanced mode and Vimeo’s “do not track” setting, so they shouldn’t set cookies before you press play. When you press play, YouTube or Vimeo receives your IP address and viewing information under its own privacy policy.

Links to other websites, such as a publisher’s page or doi.org, only take you there when you click them. Those sites have their own privacy policies.

Cookies

We only use cookies that are needed for signing in. Visitors who don’t sign in get none from us.

wordpress_logged_in_…, wordpress_sec_… and wordpress_…: keep you signed in and protect your account. If you tick “Keep me signed in on this device” they last 14 days. Otherwise they end when you close your browser.
wordpress_test_cookie: checks that your browser accepts cookies when you sign in or reset your password. It ends when you close your browser.

We don’t use analytics, advertising, social media or tracking cookies, so we don’t ask for cookie consent. Your browser may also store a small technical note for displaying emoji. It contains no personal information.

Where your information is stored

Your information is stored on our hosting provider’s servers in [country], and our other service providers may process it in [countries]. Some of these may be outside the country where you live.

Where data protection law requires it, we only transfer information to countries with adequate protection, or under contracts that give it the same protection as at home. [CariFLAGS to confirm the safeguards with its legal adviser.]

How long we keep it

Your account: while it is open. If you ask us to delete it, we do so within 30 days. If no one signs in to an account for five years, we email you, then delete or anonymise it.
Answers about gender, sexual orientation and gender identity: until you remove them or your account is deleted.
Your history: two years for each entry, or less if you clear it, turn it off or your account is deleted.
Usage counts: five years. Records of who opened a members-only or view-only resource stop saying who after two years, or as soon as the account is deleted.
A deletion request: we keep your request, with your name, email address and the dates, for five years as a record that we acted on it.
The digest list: until you unsubscribe. Records are then permanently deleted within 30 days.
Resources you send: published resources stay in the library. If your account is deleted, they are no longer linked to you. Resources we couldn’t add, and their records, are deleted after five years.
Messages and reports: two years after we’ve dealt with them.
Survey answers: these are anonymous. If a comment includes someone’s personal details, we delete it.
Backups: deleted information can stay in backups for up to [number] days until they are replaced.

We never keep personal information for more than five years after your last contact with us, unless the law requires it.

How we protect it

The site uses an encrypted connection (HTTPS).
Passwords are stored hashed, and account details can only be seen by administrators.
Members-only and view-only files are kept in a protected folder and only sent after checking that you may open them.
New accounts, digest sign-ups and changes of email address are confirmed by email, and our forms never reveal whether an email address has an account.
Members can’t reach the site’s dashboard.
To stop misuse, such as repeated sign-in attempts or sign-ups, the site keeps a scrambled form of a visitor’s IP address with a count, for a day at most. It isn’t kept with anything else.
The library team uses individual accounts with strong passwords, and only has the access their role needs.

No website can be completely secure. If a breach could put you at risk, we will tell you and the relevant regulator promptly, as the law requires.

Your safety

Think about who can see your device, your browser history, your downloads and your email inbox. Our emails come from Caribbean Mosaic, and their subject lines never mention sexual orientation or gender identity.

If you share a device, use a private browsing window and don’t tick “Keep me signed in on this device”. If someone else might see your account, leave your history off, or clear it.

Your rights

Depending on where you live, you have the right to:

know what information we hold about you, and get a copy;
correct it if it’s wrong. You can change most details yourself on Your account;
have it deleted. You can ask us to delete your account from Your account;
withdraw your consent, for the digest, your history or your answers about gender, sexual orientation and gender identity;
object to how we use it, or ask us to limit it;
receive it in a format you can take elsewhere;
complain to a data protection regulator.

To use any of these rights, email [privacy email address] or use our contact form. It is free. We may ask you to confirm your identity, usually by replying from the email address on your account. We reply within 30 days, or sooner where the law requires it.

Complaints

Please contact us first, so we can try to put things right. You can also complain to a data protection regulator:

in Jamaica, the Office of the Information Commissioner;
in Barbados, the Data Protection Commissioner;
in the European Union or the United Kingdom, your national data protection authority;
elsewhere, the data protection authority where you live, if there is one.

Children

Accounts and the digest are for people aged [18] or over. [CariFLAGS to confirm the minimum age.] If we learn that someone younger has an account or has signed up for the digest, we will delete their information.

Changes to this notice

We will update this notice when our practices change, and show the date of the latest version at the top. If the changes are significant, we will email account holders and digest subscribers before they take effect.

Contact us

CariFLAGS Secretariat
[postal address]
[privacy email address]

Or use our contact form.