Privacy Policy

Effective date: November 3, 2026

BLET Division 203 operates a private member and administrative portal for authorized Division users.

Information handled by the portal

The portal may store member PINs, names, email addresses, birth-date information used for identity verification, roster and employment status, login and security records, vacation requests, schedules, claims and supporting images, notifications, election records, and other information submitted through portal features. Access is restricted according to the user's portal role.

Google Calendar data

Only an authorized Division administrator can connect a Google account. The portal requests the Google Calendar calendar.events.owned permission solely to create, view, update, and delete vacation events on Division-owned vacation calendars. This permission does not grant the portal access to calendars merely shared with the connected account.

Google Calendar data is used only to display and administer approved, changed, or cancelled vacation requests. The portal does not use Google Calendar data for advertising, profiling, or any unrelated purpose. The calendar connection does not read Gmail or request Gmail permissions.

Google user data is not sold or transferred to unrelated third parties. Service providers may process information only as necessary to host, secure, and operate the portal.

BLET Division 203's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Vacation Desk email processing

The portal sends vacation workflow email through Resend. Vacation Desk replies are received by Resend at the designated vacation reply address. Resend delivers a signed webhook to the portal, and the portal retrieves and processes the reply to record the Vacation Desk's response. The portal does not connect to, read, search, or monitor a Gmail inbox for vacation replies.

Storage and security

OAuth access and refresh tokens are stored in the portal's restricted server database on persistent hosting storage. Tokens are not displayed to members. The portal uses HTTPS in transit, role-based access controls, and administrative authentication. Claims screenshot files are retained only until an administrator completes the review, after which the portal attempts to delete them.

Retention and deletion

Operational and historical union records are retained for legitimate Division administration, recordkeeping, and dispute-resolution needs. Temporary claim screenshots are deleted after administrative review. An authorized administrator may disconnect Google Calendar access through the connected Google account and may request deletion of stored OAuth credentials or other account information by contacting the Division. Revoking access prevents future Google API access but does not automatically delete legitimate Division records previously synchronized into the portal or the designated Division calendars.

Contact

For privacy questions, access concerns, or a request to disconnect or delete Google authorization data, email bletdiv203@gmail.com.