What We Hold.
What We Won't Hand Over.

1.Who We Are

Uncage RRJ is a 501(c)(4) social welfare organization based in the Fredericksburg region of Virginia. We document the Rappahannock Regional Jail and the Rappahannock Regional Jail Authority through public records requests, attendance at public meetings, data analysis, and the testimony of people who have lived inside that facility and the families who love them. Our stated goal is transformation of the jail into the Rappahannock Regional Restoration Center — a facility organized around restoration rather than punishment.

We operate the website at uncage-rrj.org, including the report intake form, the Musings publication, and associated email addresses. In this policy, "we," "us," and "our" mean Uncage RRJ. "You" means anyone who visits our site, submits a report, emails us, or otherwise interacts with us.

We are the data controller for information described in this policy. Our privacy contact is listed in Section 27.

2.Our Source-Protection Promise

Most privacy policies exist to protect the organization that publishes them. This one exists primarily to protect you. We commit to the following, and we ask you to hold us to it:

1. Minimum viable collection. We collect only what a specific task requires. When anonymity and data are in conflict, anonymity wins.
2. Anonymity is the default state, not an upgrade. The report form does not ask for identity unless you affirmatively choose to give it.
3. No re-identification. We will not attempt to unmask an anonymous source through metadata analysis, cross-referencing, writing-style comparison, or any other technique.
4. No voluntary disclosure to the entities we investigate. We will not voluntarily provide identifying information about a source to the Rappahannock Regional Jail, the Jail Authority, any member locality, any sheriff's office, any probation office, or any of their employees, attorneys, insurers, or contractors.
5. Consent controls publication. We do not publish, quote, or attribute your account without your specific permission for that use.
6. We resist compelled disclosure. See Section 11 for exactly what we do when served with legal process.
7. We tell you the truth about our limits. See Section 15. We would rather you distrust us accurately than trust us inaccurately.

3.Scope of This Policy

What this policy covers

• The website at uncage-rrj.org and all of its pages, including the report form and the Musings blog.
• Email correspondence with our published addresses.
• Recorded interviews and testimony we gather directly, including telephone interviews with incarcerated people and scheduled video or voice sessions.
• Information you volunteer at public meetings, canvasses, or events we organize.

What this policy does not cover

• Third-party platforms. Our Instagram, Facebook, YouTube, and Linktree presences are governed by those companies' policies, not ours. When you interact with us there, you are inside their surveillance environment, not ours. Assume the platform is watching.
• Sites we link to. We link heavily to news outlets, court records, and government sources. Their privacy practices are their own.
• Government records systems. When we file a public records request, that request and often the requester's identity may become a public record under Virginia law. See Section 18.
• Jail-operated communication systems. Phone, mail, tablet, kiosk, and video systems inside a correctional facility are monitored by the facility and its vendor. We have no control there. See Section 17.

4.What We Collect

4.1 Just reading the site

You can read every public page of this website without giving us anything. We do not require an account. We do not run a registration wall. We do not deploy an analytics package, and no behavioral profile of your reading is created by us.

4.2 Automatic technical data (web server and network logs)

Like effectively every website on the internet, our infrastructure generates access logs. Our web host and our network/CDN provider record standard request data, which may include:

• IP address of the requesting connection
• Date and time of the request
• The URL or file requested, and the HTTP response code
• Browser user-agent string and, in some cases, referring page
• Approximate geographic region derived from IP, and coarse bot/threat scoring

We do not use these logs to profile readers, and we do not consult them to identify sources. They exist for uptime, error diagnosis, and denial-of-service and abuse mitigation. They are generated and retained by our providers on their own schedules, which we do not fully control. This is the single most important limitation in this document, and Section 15 addresses it directly.

4.3 The report / whistleblower form

Our report form is the primary place where you might give us sensitive information. It has two modes.

Anonymous mode (the default)

When the "reveal identity" toggle is off, the name, email, and phone fields are hidden, cleared, and not transmitted. The submission is recorded as ANONYMOUS. In this mode we receive:

• Your relationship to the jail (for example: former inmate, current inmate, family member, friend, current RRJ employee, former RRJ employee, witness, other)
• The incident category you select (for example: medical neglect, mental health neglect, physical abuse by staff, sexual abuse or harassment, improper isolation, inhumane conditions, staff retaliation, death in custody, staff corruption)
• The approximate date you enter, if any
• Your free-text description of what happened
• Any files you choose to attach
• The fact that you checked the required consent box

Identified mode (only if you choose it)

If you switch the toggle on, we additionally receive whatever you type into the name, email, and phone fields. We use that solely to follow up with you, verify details, ask whether you consent to specific uses of your account, and connect you with resources or counsel if you ask. Providing contact information is always optional.

Abuse rate-limiting

To stop automated flooding of the intake, the form counts submissions against a salted one-way hash of the connecting IP address combined with the current date. The raw IP is not written to that file, and the hash rotates daily, so the record cannot be used by us to look up who submitted what. The rate-limit file holds hashes and timestamps only — no report content.

Attachments

Uploaded files are renamed to a random, non-identifying filename on receipt and stored in a server directory that is blocked from direct public web access. Accepted types are images, PDF, Word documents, and plain text, up to 10 MB per file and five files per submission. We do not currently strip embedded metadata from your files. Please strip it yourself — Section 16 explains how.

Where submissions go

A submission produces two artifacts: (1) a plain-text notification emailed to our intake inbox, and (2) an append-only backup log written to protected server storage so that a report is never silently lost to a mail delivery failure. Both are covered by the retention schedule in Section 13.

4.4 Email and direct correspondence

If you email us, we receive your message, your email address, your display name, and the technical headers your mail provider attaches — which commonly include originating server information and may include an IP address. We cannot prevent that; it is how email works. If that concerns you, use the anonymous web form instead of email, or send from a freshly-created account on a privacy-respecting provider.

4.5 Interviews, testimony, and recordings

We conduct recorded interviews with incarcerated and formerly incarcerated people, families, and former staff. When we do:

• We tell you at the outset that we are recording and what we intend to use it for.
• We ask for your consent before publishing, and we honor a request to use a pseudonym, alter your voice, or withhold identifying detail.
• You may withdraw consent for future use at any time. We will remove material from our own platforms promptly. We cannot retract copies already downloaded, reshared, or mirrored by others.
• Calls placed to or from a correctional facility are recorded and monitored by that facility regardless of our practices. See Section 17.

4.6 The Musings blog

The blog has no public comment system, no reader accounts, and no newsletter signup. Reading a post creates no record with us beyond the server logs in Section 4.2. Individual posts may contain embedded social media content; see Section 7.

4.7 Administrative access

Our own editorial back end uses a strictly-necessary session cookie for authenticated staff only. It is never set for ordinary visitors, contains no analytics, and exists solely to keep an authorized editor logged in.

4.8 Sensitive categories

By its nature, a report about a jail may include information about health and medical treatment, mental health, disability, pregnancy, sexual violence, criminal history, immigration status, religion, or race. We treat all of it as sensitive personal data subject to the strictest handling in this policy: need-to-know access, no third-party analytics touching it, and no disclosure without your specific consent or a legal obligation we have exhausted our ability to resist.

5.What We Never Do

6.Cookies & Tracking Technologies

We use no cookies for tracking, advertising, personalization, or measurement. We do not display a cookie consent banner because we have nothing to ask consent for.

Your network or CDN provider may set a security cookie to distinguish humans from automated traffic during a challenge. That is a security function, not tracking, and we do not read it. Embedded social media content inside a blog post can set third-party cookies — see Section 7.

7.Third Parties & Service Providers

We keep our vendor footprint deliberately small. Here is the complete list of third parties that can receive data in connection with this site, and why.

Beyond these providers, we may share information with attorneys representing Uncage RRJ or a source, and with professional advisors bound by confidentiality, strictly as needed. We do not add vendors that build advertising or surveillance products.

8.How We Use Information

We use what you give us only for the following purposes:

• Documentation and investigation. To record conditions at the jail, corroborate patterns across accounts, and build a factual record.
• Public records work. To formulate targeted public records requests. We describe patterns in aggregate; we do not name a source to a records custodian.
• Advocacy and public education. To inform public comment at Jail Authority and locality meetings, published reports, and our journalism — subject always to consent for anything attributable.
• Following up with you. To ask clarifying questions or route you to legal, medical, or reentry resources, if you gave us a way to reach you.
• Referral, with consent. To connect you with counsel, oversight bodies, or journalists — only when you specifically approve that referral.
• Safety and integrity. To detect spam, abuse, and attempts to poison our intake with fabricated reports.
• Legal compliance. To meet obligations that genuinely apply to us, as narrowly as we can read them.

We do not use your information for any purpose materially different from these without asking you first.

9.Legal Bases for Processing (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

• Consent (Art. 6(1)(a)) — for submitting a report, for publishing your account, and for recording an interview. For sensitive-category data, we rely on your explicit consent (Art. 9(2)(a)). You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)) — for site security, abuse prevention, and operating our infrastructure. Our interest is documenting government conduct affecting people in custody; we have balanced it against your rights by minimizing collection and running no tracking.
• Substantial public interest and freedom of expression — where permitted by Art. 9(2)(g) and by the journalistic, academic, and literary expression provisions of Art. 85 and their national implementations, for the processing of sensitive data necessary to report on conditions of confinement.
• Legal claims (Art. 9(2)(f)) — where processing is necessary to establish, exercise, or defend legal claims.
• Legal obligation (Art. 6(1)(c)) — where a law that applies to us compels processing.

10.When We Disclose Information

We disclose personal information in only these circumstances:

1. With your specific consent. The normal case. You tell us what may be shared, with whom, and under what attribution.
2. To our service providers, limited to what their function requires (Section 7).
3. To attorneys and advisors under obligations of confidentiality.
4. In aggregated or de-identified form. We publish counts, patterns, and trends that cannot reasonably be tied back to an individual. This is our default mode of publication.
5. To prevent imminent serious harm. If we receive a credible report of an imminent threat to someone's life — including a person in custody who is in medical crisis or at risk of suicide — we may contact emergency services, medical providers, or oversight authorities. We will limit disclosure to what is necessary and will tell you afterward whenever we safely can. We would rather someone live than have a perfect privacy record.
6. Where a mandatory reporting duty applies to us under Virginia law, such as certain reports concerning abuse or neglect of a child or a vulnerable adult.
7. In response to valid, enforceable legal process that we have been unable to defeat, narrow, or quash. See Section 11.

We will not disclose source-identifying information to the Rappahannock Regional Jail, the Jail Authority, any member locality, a sheriff's office, a probation office, or their employees, attorneys, insurers, or contractors on a voluntary basis. Not as a courtesy, not to preserve a working relationship, not to settle a dispute.

11.Subpoenas, Warrants, and Law Enforcement Requests

We investigate government institutions. It is foreseeable that a government institution will someday demand our records. Here is our standing protocol, adopted in advance so it is not improvised under pressure:

1. Nothing on an informal ask. We disclose nothing in response to a phone call, an email, a letter, a badge at the door, or an "off the record" request. If it is not a signed order or lawfully issued process, the answer is no.
2. Everything goes to counsel. Any subpoena, warrant, court order, civil discovery demand, or preservation request is routed immediately to our attorney for review of validity, jurisdiction, and scope.
3. We assert every available privilege and objection, including applicable reporter's-privilege and newsgathering protections, First Amendment associational protections, and the federal Privacy Protection Act of 1980 protections for journalistic work product and documentary materials. We move to quash or narrow overbroad demands.
4. We fight for advance notice to you. Where we are not legally gagged, we will notify an affected source before producing anything, with enough time for you to seek your own counsel and intervene. If we are gagged, we will challenge the gag and notify you as soon as we lawfully can.
5. We produce the narrowest possible response. If production is ultimately compelled, we produce only what the order actually requires — no volunteered context, no adjacent files, no helpful extras.
6. We publish what we can. Every demand we receive is logged and reported in aggregate in our transparency reporting (Section 12), with the full document published when we are permitted to do so.
7. We do not create evidence for anyone. We do not generate, compile, enrich, or reconstruct records we do not already keep in order to satisfy a request.

12.Transparency Reporting & Warrant Canary

We intend to publish a transparency statement on this page at least annually, reporting the number of legal demands received, the number complied with, the number resisted, and the number of source-identifying disclosures made.

The absence, staleness, or alteration of the statement above should be treated as meaningful.

13.Retention Schedule

We keep what the work requires and delete the rest. Where we say "as long as the matter is active," we mean while an investigation, publication, records dispute, or litigation hold is genuinely live — not indefinitely by default.

A litigation hold, preservation order, or active safety concern can override a deletion date. Where that happens, we isolate the held material and delete it as soon as the hold lifts.

14.Security Measures

What we actually do, in concrete terms:

• Encryption in transit. The entire site is served over HTTPS with HTTP requests redirected to HTTPS.
• Hardened response headers, including X-Content-Type-Options, X-Frame-Options, and a referrer policy that limits what other sites learn about where you came from.
• Uploads are not publicly reachable. The upload directory is blocked from direct web access, files are renamed to random identifiers, and file types and sizes are restricted.
• No raw IP storage in the intake system. Rate-limiting uses a daily-rotating one-way hash.
• Input sanitization on all submitted fields, and server-side validation of required fields and consent.
• Encrypted email for the intake inbox.
• Least-privilege access. Only the small number of people who need to read intake can read intake. Administrative access is authenticated and separated from the public site.
• Data minimization as a security control. The best-protected record is the one we never created.

15.What We Cannot Promise

We would rather lose your trust honestly than keep it dishonestly. These are real limits:

• We are a small volunteer-driven organization, not a newsroom with a security team. We do not have the resources of an outlet that operates a hardened anonymous drop.
• We do not control our infrastructure providers' logs. Our host and our network provider see connection metadata for every request. If someone served valid process on them, we might never know.
• We currently do not operate a Tor onion service or SecureDrop instance. If your threat model includes a well-resourced adversary with the ability to compel records from infrastructure companies, this website alone is not sufficient protection.
• We do not strip metadata from your uploads. Do it yourself before sending.
• Email is not confidential in the way people assume. Headers reveal routing information and providers on both ends retain copies.
• No transmission or storage system is perfectly secure. We cannot guarantee against a sophisticated compromise.
• Virginia has no absolute shield law conferring an unqualified journalist's privilege by statute. We will assert every protection available to us; we cannot promise a court will agree.
• We cannot control other people. If you tell your account to us and also to five other people, our practices are not the weak link.

If your safety depends on absolute anonymity, please read the next section carefully and consider speaking with a lawyer before speaking with us.

16.How to Reach Us More Safely

This is not legal advice, and no method is risk-free. It is practical guidance from people who take this seriously.

Before you contact us

• Do not use a device or network that belongs to your employer — especially if your employer is the jail, a locality, a sheriff's office, or a jail contractor. Employer-owned devices and networks can be monitored lawfully and routinely.
• Use a personal device on a network not tied to you where practical, or the Tor Browser, which conceals your IP from the sites you visit.
• Use a private/incognito window, and clear history afterward if others use your device.
• Create a fresh email account on a privacy-respecting provider if you want a reply channel without exposing your identity. Do not name it after yourself.
• Prefer the anonymous web form over email if identity protection is your priority.

Strip metadata from files

Photos commonly embed GPS coordinates, capture time, and device serial information. Documents embed author names, organization names, edit history, and sometimes usernames and file paths.

• Photos: take a screenshot of the photo and send the screenshot, or use your operating system's "remove location / remove properties" option before attaching.
• Windows: right-click the file → Properties → Details → "Remove Properties and Personal Information."
• macOS / iOS: when sharing a photo, use Options and turn off Location. For documents, export to PDF and check document properties.
• Documents: paste the text into a plain-text file rather than sending the original office file, when the formatting is not the evidence.
• Do not rename a file to something identifying. We rename on receipt, but the original name reaches us.

Write carefully

• Describe what happened, not how you uniquely came to know it, unless that detail is essential.
• Avoid details only a handful of people could know, if you need to stay unidentifiable.
• Avoid distinctive phrasing you use publicly elsewhere.
• Do not paste an internal document verbatim if a paraphrase carries the same information — verbatim text can be traced to a specific copy or recipient.

Know your rights before you act

Retaliation against certain whistleblowers is unlawful, and Virginia provides some statutory protections for public and private employees who report suspected wrongdoing. Protections are narrow, fact-specific, and easy to forfeit by taking the wrong step first. If you are a current employee, talk to a lawyer before you remove documents from a workplace. We can discuss legal referrals with you.

17.Special Notice for Incarcerated People and Their Families

• Jail phone calls are recorded and often monitored. A call to us is a call inside their system. Speak accordingly.
• Tablet and kiosk messaging is not private. Messages sent on a facility-provided tablet or kiosk are stored by the vendor and accessible to the facility.
• Non-legal mail is opened, scanned, and frequently digitized and retained by a third-party processor.
• Retaliation is a real risk. People who report conditions inside face documented risks of transfer, loss of privileges, disciplinary charges, and worse. Weigh that. We will not push you to speak.
• A family member on the outside can file for you. Selecting "family member" on our form and describing what your loved one reported is often meaningfully safer than a call from inside.
• We will never publish an incarcerated person's name, housing unit, charges, or identifying detail without permission from that person or, where they cannot safely be reached, from their next of kin acting in their interest.
• Medical information stays sealed unless you tell us otherwise. We treat health details as sensitive data and will discuss any use with you first.

18.Public Records & Information About Third Parties

Much of our work involves personal information we did not receive from you: names in budget documents, board rosters, inspection reports, death reviews, court filings, meeting minutes, and responses to Virginia Freedom of Information Act requests.

How we handle it

• Public officials acting in an official capacity are documented as such. Names, titles, votes, salaries, and official conduct of officials and jail administrators are matters of public interest and we publish them.
• Private individuals get more care. We redact or withhold identifying details about incarcerated people, patients, minors, and crime victims that appear in records unless publication serves a clear public interest and does not create a safety risk.
• Medical and mental health detail is redacted by default when it concerns a private individual who has not consented.
• We correct the record. If we publish something inaccurate about you, tell us and we will investigate and correct it with a visible note.
• Filing a records request may make your identity public. If you ask us to file on your behalf, we will discuss that exposure with you first. In practice we file in the organization's own name.

Removal requests

If you are a private individual named in something we published and you believe it endangers you, contact us at the address in Section 27 with the URL and what you are asking for. We review every such request seriously and respond. We weigh your safety and dignity against the public interest in an accurate historical record, and we will explain our reasoning either way. We do not remove accurate reporting about the official conduct of public officials.

19.Your Privacy Rights

We extend the substance of the following rights to everyone who contacts us, regardless of where you live, even where a statute would not require it of us.

Rights we honor for all

• Know what information we hold about you and where it came from.
• Access a copy of it in a portable format.
• Correct anything inaccurate or incomplete.
• Delete it, subject only to a genuine legal hold or an overriding safety obligation, which we will explain.
• Withdraw consent to publication, quotation, or attribution at any time, going forward.
• Object to or restrict a particular use.
• Non-retaliation. Exercising any of these rights will never affect how seriously we take your report.

Virginia residents

The Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.) applies to entities that control or process the personal data of at least 100,000 Virginia consumers in a year, or 25,000 consumers where more than half of gross revenue comes from selling personal data (§ 59.1-576). Uncage RRJ meets neither threshold, sells no personal data, and additionally falls within the statute's nonprofit-organization exemption to the extent that definition reaches us. We nonetheless honor VCDPA-equivalent rights — access, correction, deletion, portability, and opt-out of sale, targeted advertising, and profiling — as a matter of policy. There is nothing to opt out of on the last three, because we do none of them.

California residents

We honor CCPA/CPRA-equivalent rights: to know, to access, to delete, to correct, to portability, to opt out of sale or sharing, to limit use of sensitive personal information, and to non-discrimination for exercising them. For clarity and for the record: we have not sold or shared personal information in the preceding twelve months, and we have no plans to. We do not use or disclose sensitive personal information for purposes beyond those permitted as necessary to provide our services.

EEA, UK, and Swiss residents

You have the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, and the right to lodge a complaint with your national supervisory authority or, in the UK, the Information Commissioner's Office. We do not use automated decision-making that produces legal effects for you.

Other jurisdictions

If your local law grants you a privacy right not listed here, ask us for it. Our default answer is yes.

20.How to Exercise Your Rights

1. Email our privacy contact in Section 27 with the subject line "Privacy Request."
2. Tell us which right you are exercising and what information it concerns.
3. If you reported anonymously, include your Report ID — the reference returned when you submitted. That is often the only way we can locate an anonymous submission, and we deliberately have no other way to link it to you.

Verification

We must be reasonably sure you are who you say you are before we hand over or delete records — otherwise this policy becomes a tool for someone to extract information about a source. We verify with the minimum necessary: usually matching the email address or Report ID already on file. We will not require you to create an account, and we will not demand a government ID unless the request is high-risk and no lesser method exists.

Timing and cost

• We acknowledge requests within 10 business days.
• We substantively respond within 45 days, extendable once by 45 days with notice if the request is complex.
• Requests are free. We will not charge you to see your own information.
• If we decline in whole or part, we will tell you why and how to appeal. Appeals go to the same address with the subject line "Privacy Appeal" and receive a written decision within 60 days. If we deny an appeal, we will tell you how to contact the Virginia Attorney General or your own regulator.

Authorized agents

You may use an authorized agent, including an attorney or a family member acting for an incarcerated person. We will ask for reasonable proof of authorization.

21.Do Not Track and Global Privacy Control

Browsers can send a Do Not Track header or a Global Privacy Control signal. There is no industry consensus on DNT, so many sites ignore it. Our position is simpler: we behave as though every visitor sent both signals, all the time. We do not track, target, or sell, so there is nothing for the signal to change.

22.Children's Privacy

This website is not directed to children. We do not knowingly collect personal information from anyone under 13, and we do not knowingly process the personal data of a minor under 16 for targeted advertising, sale, or profiling — activities we do not engage in at all.

We recognize that minors are affected by incarceration — as children of incarcerated parents, as young people held in custody, and as family witnesses. If you are under 18 and want to report something, we would rather you tell a trusted adult or a lawyer who can act for you. If a parent or guardian believes a child has given us information, email us and we will delete it promptly. Nothing here prevents us from documenting harm to a minor in a jail, or from meeting a mandatory reporting duty.

23.International Visitors and Data Transfers

We operate in the United States, and our infrastructure and staff are located there. If you contact us from outside the United States, your information will be transferred to and processed in the United States, where privacy laws differ from those in your country and where government authorities may have access rights that differ from your own. Where a transfer of EEA or UK data requires a safeguard, we rely on your explicit consent or on standard contractual clauses with the relevant provider. By submitting information to us, you understand and accept this transfer.

24.If Something Goes Wrong

If we discover a security incident affecting personal information, we will:

• Contain it and assess what was exposed, immediately.
• Notify affected individuals we can reach without undue delay — and where a source cannot be safely contacted, publish a prominent notice on this site.
• Notify regulators where legally required, including within 72 hours where GDPR applies.
• Publish a public post-mortem describing what happened, what we got wrong, and what we changed. We hold institutions to that standard; we accept it for ourselves.

If you find a vulnerability in this site, please report it to the address in Section 27. We will not pursue legal action against good-faith security researchers who act proportionately, avoid accessing or exfiltrating others' data, and give us reasonable time to fix the issue before disclosure.

25.Accessibility of This Policy

Privacy protection that only lawyers can read is not protection. If any part of this document is unclear, email us and we will explain it in plain language, provide a large-print or plain-text version, mail a printed copy to someone in custody, or walk through it with you by phone. Tell us what format works for you.

26.Changes to This Policy

We will update this policy when our practices change. When we do:

• We revise the "Last updated" date and version number at the top.
• For material changes — new categories of collection, new recipients, or a weakening of any commitment in Section 2, 5, or 11 — we will post a prominent notice on the homepage and, where we have a way to reach affected sources, contact them.
• We will maintain a change log below so you can see what moved.
• A material change will never be applied retroactively to information you already gave us under a stronger promise without your consent.

27.Contact Us

Postal mail can be arranged on request; email us and we will provide a mailing address. If you are inside a facility and cannot email, a family member or advocate may contact us on your behalf.

28.Legal Disclaimer

This policy describes our data practices. It is not legal advice, and it does not create an attorney-client relationship, a confidential relationship recognized by any court, a contract, or a guarantee of any outcome. Uncage RRJ is an advocacy organization, not a law firm. The operational guidance in Section 16 is general information, not a security guarantee for your specific circumstances.

If you are considering reporting misconduct and you face any risk of retaliation, criminal exposure, or loss of employment, consult a licensed attorney before you act. We are glad to discuss referrals.

If any provision of this policy is found unenforceable, the remainder continues in effect. Where this policy conflicts with a mandatory legal obligation, the law controls — and we will say so publicly to the extent we are permitted.