Bylaws of the National Albanian Registry, Inc.

Preamble

The National Albanian Registry was built between January and April 2026 by the following eight Albanian Americans, who served as the initial managing board and ratified these bylaws at the founding governance call:

• —Ervin Toro — Founder & President
• —Erold Merko — Treasurer (Michigan)
• —Nalvi Duro — Secretary (Florida)
• —Iliriana Sela — Director of Community Outreach (New York)
• —Marsel Alickolli — Operations
• —Esti Gajda — Operations
• —Leart Ulaj — Operations
• —Enri Zhulati — Product & Web

Article I — Purpose

The National Albanian Registry is a 501(c)(3) nonprofit operating a community-led census of Albanian Americans in the United States. We hold registrant data in trust, on behalf of the community, for two purposes only: aggregate community statistics published in our annual Impact Report, and (with explicit opt-in) connecting community members to regional ambassadors and partner organizations. The data is never sold, never shared with any government agency, never used for advertising targeting, never matched against political campaign databases.

Article II — Member tiers

There are two governance tiers:

1. Admin (managing board). Standard operating authority. Removable by a 2-of-N managing-board vote with documented cause. The eight people named in the Preamble and any future admins hold this tier.
2. Observer (advisory board). Read-only access plus voting rights on data-usage policy changes, bylaws amendments, and dissolution. Held by advisory-board members who participate in policy decisions but do not operate the platform.

There are no special tiers, no founder seats, and no lifetime appointments. Officers and operations members hold equal admin tier — one vote per action, identical removal threshold. Any admin may be removed for documented cause; no admin may be removed without it.

Article III — Officers + self-resignation

The 501(c)(3) requires elected officers with fiduciary responsibility. NAR maintains four:

• —President — public face, signs contracts, calls meetings
• —Treasurer — financial oversight, files Form 990
• —Secretary — keeps the audit log, ratifies decision records
• —Director of Community Outreach — ambassador program, regional chapters

Officers serve two-year terms. Elections are held by managing-board majority. Officer status is independent of the admin tier — every officer is also an admin, but not every admin is an officer. An officer can be removed early via gov_action with managing-board majority + documented cause.

The Secretary's procedural role: may flag a decision as "requires re-vote" if procedural requirements weren't met (missing rationale, missing required signers, expired window). This is a procedural check, not a substantive veto — the original decision can be re-filed with the procedural defect cured.

Self-resignation: any admin may self-resign at any time by filing a self-resignation gov_action. Self-resignation auto-executes without 2-of-N approval, but is logged with notification to all admins. No one can be blocked from quitting. Officer status is shed automatically on self-resignation; the role becomes vacant until the next election.

Article IV — Decision rules + quorum

Sensitive operations require multiple signatures, recorded in software with timestamps and signers. No admin can execute the following actions unilaterally; the thresholds are:

Quorum and definitions:

• —"N" = the count of admin-tier members whose status='active' at the moment the gov_action is filed. Disabled or pending rows don't count.
• —"Majority" = strictly more than half. With 8 admins, majority = 5; with 4 admins, majority = 3.
• —"Advisory percentages" (51%, 75%, 80%) refer to seated and voting advisory members, with a 50% participation floor — at least half of seated advisory must vote on the action for the result to bind. If participation is below 50%, the vote is treated as inconclusive and the action expires.
• —The proposer of an action cannot count as one of the required signers on their own proposal. "2 of N" means 2 admins besides the proposer.
• —Actions expire after 14 days if not approved or rejected. Expired actions can be re-filed.

Audit log immutability: the audit log is append-only at the database layer. Historical entries cannot be edited or deleted via the application or via direct database access; corrections are added as new entries that supersede prior ones. Changing this property requires a schema migration, which is itself audit-logged.

Emergency-action clause: when an active incident threatens registrant data — a security breach, an in-progress unauthorized email send, a compromised admin account — any single admin may take unilateral defensive action (revoke a session, freeze sending, rotate credentials, disable a compromised account). Such actions are logged immediately and must be ratified by 2 of N within 72 hours, or they auto-revert.

Article V — Cause + whistleblower

When a removal action requires "documented cause," the rationale field on the gov_action must reference at least one of the following, with evidence:

• —Conviction of a felony involving fraud, theft, or breach of fiduciary duty
• —Documented misuse of registrant data (sharing without authorization, secondary commercial use, etc.)
• —Sustained absence — six consecutive months without communication or response, with no documented health emergency or sabbatical leave
• —Material breach of code of conduct, with documented evidence (e.g., harassment finding from a third-party investigator)
• —Conflict of interest the member has declined to recuse from after being asked, where that conflict has resulted in tangible harm to the organization (see Article VI)

Personal disagreement, divergence of opinion on strategy, or interpersonal friction are not valid cause for removal. These bylaws are written to make removal on those grounds procedurally impossible.

Whistleblower protection: reporting in good faith — suspected fraud, data misuse, financial irregularity, conflict of interest, code-of-conduct violation — cannot itself be valid cause for removal. Retaliation against good-faith reporters is itself valid cause for removal of the retaliator. A "good-faith" report means the reporter genuinely believed the concern was real at the time of reporting; subsequent investigation finding the concern unfounded does not retroactively make the report "bad faith."

Reports may be filed via gov_action with action_type=whistleblower_report (audit-logged but not surfaced to the subject of the report until investigation completes), or directly to [email protected].

Article VI — Conflict-of-interest policy

Every admin discloses any conflict of interest at the time of joining and annually thereafter. Conflict types we recognize:

• —Financial — material ownership in any vendor, sponsor, partner, or potential donor. "Material" = ≥1% equity or ≥$10,000 in expected income/value.
• —Familial — immediate family relationship with another admin, vendor principal, or named beneficiary. Disclose; recuse from votes affecting that party.
• —Business — operating role in another organization that could be benefited or harmed by NAR decisions (competitor, partner, supplier, customer).
• —Political — active candidacy or paid position in a political campaign, party, or PAC. Doesn't disqualify from being an admin, but requires recusal from any decision touching political activity.

Recusal procedure: when a gov_action touches a disclosed conflict, the conflicted admin recuses — does not propose, does not vote, does not lobby other voters. Recusal is logged with the action.

Annual disclosure: every admin files a one-page COI disclosure on January 31 each year. New disclosures (e.g., taking a new outside role) must be filed within 30 days of the change. Failure to disclose is itself documented cause for removal under Article V.

"Tangible harm" definition: when Article V references "tangible harm" from an undisclosed or un-recused conflict, harm means a measurable adverse outcome to the organization — financial loss, reputational damage caused by media coverage, loss of partnership or grant, or a consent-decree or regulatory action. Hypothetical or potential harm is not "tangible."

Article VII — Data is held in trust

Registrant data belongs to the community, not to the organization or any officer. The plain-English data promise is at /privacy#our-promise. The technical guarantees:

• —Encrypted at rest (AES-256) in U.S. data centers
• —Self-service export, edit, and deletion via /account
• —Certificates remain independently verifiable via /.well-known/did.json regardless of whether NAR's servers are running. See /certificate#verification.

Compelled disclosure (court order or subpoena):

• —NAR will seek to narrow the scope of any compelled disclosure to the minimum required by law.
• —NAR will notify affected registrants before any disclosure when not legally prohibited (e.g., a non-disclosure clause in the order). When prohibited, NAR will publish notification once the prohibition lifts.
• —NAR will publish a transparency report annotating any compelled disclosure within 30 days of the disclosure, in aggregate form (number of requests, broad nature, scope).
• —This commitment binds future leadership. Changing it requires a bylaws amendment under Article X.

Article VIII — Intellectual property + infrastructure

All code, infrastructure accounts, domain registrations, brand assets, and intellectual property created in the service of NAR are the property of the 501(c)(3) entity, not any individual admin. As of the founding governance call, the following accounts are held by personal credentials and are subject to fiduciary transfer to the 501(c)(3) within 90 days of IRS confirmation of tax-exempt status:

• —GitHub organization (currently ezhulati)
• —Vercel project, Supabase project, Resend domain, Stripe account, Cloudflare zone, domain registrar
• —Codebase copyright (held by individual contributors, licensed/assigned to NAR upon transfer)
• —Brand marks ("Count Me Albanian", "National Albanian Registry")

Fiduciary custodian duty: until transfer is complete, holders of personal accounts act as fiduciary custodians on NAR's behalf. They cannot:

• —Block other admins' access to NAR-related repos, projects, or accounts without 2-of-N approval and documented cause
• —Delete, archive, or transfer NAR-related code or data outside NAR without 2-of-N approval
• —Use NAR credentials, brand, or relationships for personal commercial benefit

Violation of fiduciary custodian duty is documented cause for removal under Article V.

Continuity: the Treasurer maintains a current "infrastructure access list" — names of accounts, custodians, and emergency-access procedures — reviewed quarterly. The list itself is not public (security), but the existence and review cadence are.

Article IX — Dissolution

If the 501(c)(3) winds down (loss of tax-exempt status, board decision, court order, etc.):

• —Registrant data is deleted as part of dissolution. Never sold, never transferred to a successor entity, never made available to advertisers or governments.
• —Donations remain on file for IRS reconciliation as required by law.
• —Certificates remain independently verifiable via the public did:web key — the math doesn't depend on us continuing.
• —Remaining assets are distributed per IRS 501(c)(3) dissolution rules to a like-purpose 501(c)(3). The Form 1023 designates a primary successor (decision pending the founding governance call); if the named successor is unavailable or has changed mission, the managing board selects an alternate by majority vote, subject to advisory-board majority approval.
• —The codebase, in its final state at dissolution, is released under an open-source license (MIT or AGPL-3.0, decision deferred to advisory board) so the technical work survives the org.

Article X — Amendments to these bylaws

Standard amendment threshold: 2 of N managing-board approvals + 75% advisory-board majority.

Bootstrap clause: until the national advisory board reaches twelve (12) seated and active members, bylaws may be amended by six of the eight original board members (75% of the original cohort) plus documented cause for the amendment. This bootstrap path expires automatically once advisory reaches 12 and is replaced by the standard threshold above. The bootstrap path does not apply to sticky provisions enumerated below; sticky provisions require 100% of seated admins plus a 60-day public comment period regardless of bootstrap status. The point: an emergency-onboarding shortcut cannot quietly weaken the constitutional commitments it was meant to protect.

Amendments are filed as gov_actions with the diff visible in the rationale field. The decision log at /admin/governance records every amendment with a timestamp and the approval roster.

Provisions that cannot be amended away:

• —The data-trust commitments in Article VII (registrant data is deleted, not transferred, on dissolution; subpoena disclosure procedure)
• —The whistleblower protection in Article V
• —The audit-log immutability in Article IV

These three are foundational to the trust premise of the registry. Amending them away would require 100% of seated admins (managing + advisory) plus a 60-day public comment period.

Article XI — Records retention

NAR maintains records to satisfy IRS Form 990 Part VI line 14 and operational continuity. Retention schedule:

• —Permanent: Articles of Incorporation, Bylaws, Board minutes, audit-log entries, Form 990 filings, Form 1023 + IRS determination letter, dissolution records.
• —Seven (7) years: financial statements, donor records, payroll records (if applicable), grant agreements.
• —Five (5) years: tax-deductible-contribution acknowledgments, expense reports, executed contracts after termination.
• —Three (3) years: routine email correspondence, ad-hoc internal memos, drafts (unless they document a board decision — in which case the final ratified document is permanent).

Records destruction follows the same schedule. The Treasurer or designate reviews records-retention compliance annually.

Litigation-hold supersedes the schedule: if NAR is on notice of pending litigation, regulatory inquiry, or compelled-disclosure request, ALL potentially responsive records are preserved indefinitely until the hold is lifted in writing.

This article cannot be reduced below the IRS-required minimum without an Article X bylaws amendment.

Article XII — Code of ethics

All NAR admins (managing board + advisory) commit to:

1. Mission first. Decisions advance NAR's mission as defined in Article I — never personal interest, partisan agenda, or commercial benefit.
2. Honest communication. No deception in public statements, fundraising, donor relations, registrant communications, or board deliberations.
3. Confidentiality where the bylaws require it. Whistleblower reports (Article V), compelled disclosures under gag order (Article VII), and confidential personnel matters are not discussed outside authorized contexts.
4. No personal benefit from NAR transactions. No admin, family member, or business connected to an admin profits from NAR funds, contracts, or in-kind support — except for IRS-permitted reimbursements transparently disclosed.
5. No personal use of registry data. No admin — or family member or business connected to an admin — uses registrant data (names, emails, demographics, business listings, donor records, household-member information) for personal, business, or political purposes outside NAR's stated mission. This includes solicitation for personal businesses, partisan outreach, fundraising for unrelated causes, and any bulk export other than a registrant's own request. Aggregate statistics published in the annual Impact Report are exempt because they carry no individual identification. Violation is documented cause for immediate removal under Article V, confirmed by an Article XIV investigator panel.
6. Full participation. Active engagement in board meetings; abstention or recusal where conflicts apply.
7. Respectful conduct. No harassment, no retaliation against good-faith reporters, no discriminatory conduct against admins, registrants, partners, or the public.
8. Speak up. When you observe a violation by another admin, file a confidential whistleblower report (Article V) or address the matter through governance.

Violations are documented cause for removal under Article V. The board reviews this code annually as part of the COI re-attestation cycle (Article VI).

Article XIII — Continuity + receivership

If the managing board can no longer make decisions, an independent professional pair takes custody for the narrow purpose of either restoring quorum or winding the org down cleanly. Stewardship is not governance.

Trigger conditions. Stewardship begins automatically when either is true:

• —Active managing-board count drops below 4 (the Article IV quorum threshold), or
• —The board fails to reach quorum on any properly-noticed governance call for 60 consecutive days.

Emergency steward. Named in advance via a gov_action of type emergency_steward_designate requiring unanimous active managing-board approval (during the Article X bootstrap window: 6-of-8 + 60-day public comment, because Article XIII is itself a sticky provision). The steward is a two-person professional pair: licensed counsel + CPA, neither connected to any seated admin. Steward authority is strictly limited to:

• —Ministerial filings (CHAR500, Form 990, state registrations)
• —Petitioning the NY Attorney General for receivership if recovery fails within 180 days
• —Executing the Article VII data-deletion procedure if dissolution becomes inevitable

The steward CANNOT govern programmatically, transfer assets to anyone except a court-supervised receiver, edit registrant data, or speak publicly on NAR's behalf except to confirm stewardship status. Steward submits a time invoice at standard professional rates upon stand-down.

Annual dead-man's-switch ping. Every admin receives a once-yearly ping with the timestamp recorded. A 60-day non-response flips admin_users.status to presumed_inactive, which excludes the row from quorum counting but does not remove the admin and does not strip voting rights. The admin self-restores by signing in and acknowledging.

Board-emeritus pool. Former admins who departed in good standing — voluntary resignation, term-expired without removal-for-cause, or self-resignation under the Article III anti-prison clause — are maintained as a read-only roster (gov_emeritus_admins). Only the emergency steward may summon the pool. Their summoned authority is narrow: constitute an emergency quorum of 3 emeritus + 1 active = 4, for the sole purpose of approving admin_invite actions to seat replacement admins. Once active count returns to ≥4, emeritus are released and the emergency quorum dissolves. Emeritus cannot vote on substantive policy, cannot remove anyone, cannot execute amendments.

Recovery + stand-down. When active managing-board count returns to ≥4, the steward submits a stand-down report to the audit committee (Article XV) and to the NY Charities Bureau, returns custody, and stands down. Stand-down is itself a gov_action of type stewardship_end, ratified by the now-restored quorum.

If recovery fails after 365 days of stewardship, dissolution under Article IX is triggered automatically by the steward (no further board approval is available). Article VII data-deletion executes. The codebase is published open-source. The final audit_log entry is the steward's stand-down report.

Cost. Stewardship invoices are paid from NAR's reserves. The Treasurer maintains a continuity reserve of at least 6 months of estimated stewardship invoices; the Article XV audit committee reviews adequacy annually.

Sticky. Article XIII cannot be reduced by amendment via the Article X bootstrap clause. Amending Article XIII requires 100% of seated admins + a 60-day public comment period, regardless of advisory-board status. An emergency procedure cannot be quietly weakened by the same actors who would benefit from its absence.

Article XIV — Removal due process

Removing a colleague is the highest-stakes decision the board can take. Article IV's "2 of N + cause" line is the floor; this article is the ceiling. It applies to every admin_remove action except those grounded in a felony conviction (where a court has already adjudicated the cause).

Cure period (30 days). When an admin_remove action cites any cause from the Article V enum other than a felony conviction, no vote may be cast for 30 days from filing. During the cure window:

• —The target receives full notice of the cause cited and every piece of supporting evidence the proposer relies on.
• —The target may file a written rebuttal of up to 5,000 words, plus exhibits.
• —The target may request the investigator-panel review described below.
• —If the target satisfies the cure (files the missed COI, resumes communication, produces exculpatory evidence, etc.), the proposer may withdraw — or the action expires at day 30 with no vote held.

Felony-conviction cause skips the cure window. The criminal proceeding is its equivalent.

Independent investigator panel. If the action is not cured by the end of the 30-day window, a panel of three designated investigators (Article V) reviews the cause before any vote is held. Each panel member must:

• —Sign a per-action recusal attestation confirming no familial, financial, business, or political conflict (Article VI) with either target or proposer.
• —Not be the proposer or any seconding admin on the action.
• —Not themselves be the subject of any then-pending whistleblower report.

If fewer than three conflict-free investigators are available, the audit committee (Article XV) selects one or two external independent reviewers — New York-licensed nonprofit counsel or a CPA — to fill the panel. The panel issues a written finding within 14 days of the cure window closing: cause supported, cause not supported, or insufficient evidence. The finding is logged with the gov_action and visible to all admins before any vote opens.

Vote threshold (non-felony cause). The Article IV floor of "2 of N + cause" is replaced for non-felony admin_remove actions by all four of the following:

• —The 30-day cure window has run and the cure was not satisfied.
• —Investigator-panel finding of "cause supported," or "insufficient evidence" with concurrence of a majority of the panel.
• —A majority of the active managing board (excluding the target from both numerator and denominator) votes to remove.
• —Article VI recusal rules apply to every voter — disclosed conflicts disqualify a voter from this vote.

Felony cause retains the Article IV threshold of 2 of N plus cause. The criminal court has already done the adjudicating work.

One-time appeal (14 days). The removed admin may, within 14 days of the removal vote, file a single appeal to:

• —The advisory board, if seated and at or above the twelve-member bootstrap threshold (Article X); or
• —During bootstrap, a three-person panel of New York-licensed nonprofit counsel selected by the audit committee.

The appeal panel reviews three questions only: was the process followed, was the cause genuine, and was the evidence adequate. The panel cannot substitute its judgment for the board on close calls; it can overturn only for a clear procedural violation or absence of cause. The appeal decision is final. Filing an appeal does not stay the removal — but if the panel reinstates, back-status (tier, officer title, term dates, audit-log access) is restored as of the vote date.

Whistleblower-investigator recusal. An investigator handling a confidential whistleblower report under Article V must sign a per-report recusal attestation confirming no Article VI conflict with any named subject. An investigator is automatically disqualified from any report that names the investigator as a subject, and from any report naming an admin with whom the investigator has a disclosed conflict. The recusal log is itself audit-logged and reviewed annually by the audit committee.

Bad-faith filing penalty. If the investigator panel finds cause "not supported" and further finds that the proposer knew, or should have known, that the cause was unsupported at the time of filing, the proposer's filing is itself documented cause for removal of the proposer under Article V — sub-clause "weaponizing the removal procedure in bad faith." A removal action grounded in this clause follows the full Article XIV process, including cure window and panel review, applied to the original proposer.

Sticky. Article XIV is a sticky provision (joining Articles V, VII, and the Article IV audit-log immutability clause). Amending or weakening any part of it requires 100% of seated admins (managing + advisory) plus a 60-day public comment period, regardless of bootstrap status.

Cross-reference to Article IV. The "Schedule of Approval Thresholds" line for "Remove an admin" is read together with this article as: "Felony cause: 2 of N + cause. All other cause: see Article XIV (cure + panel + majority + appeal)." Article IV is the floor; Article XIV is the operative rule for non-felony removals.

Article XV — Audit committee

A standing audit committee provides independent review of NAR's finances, governance, and disclosures. The committee is a check on the board, not an arm of it. It cannot decide governance matters; its work product is recommendations to the full board, formalized as gov_actions when board action is required.

Composition (3 members):

• —(a) Internal financially-literate seat. One managing-board admin who is not the Treasurer. "Financially literate" means the ability to read and understand financial statements; CPA, CFE, MBA-finance, or 5+ years of substantive accounting/finance experience qualifies. Demonstrated competence is acceptable in lieu of credential.
• —(b) Advisory seat. One advisory-board member, once advisory has at least one active observer. During the Article X bootstrap window, this seat is held by an emeritus admin (Article XIII) or by a recruited external volunteer with a nonprofit-finance background.
• —(c) Fully independent seat. One person with no admin or advisory status, recruited externally, paid a stipend within Form 990 Schedule J disclosure rules. Preferred: a CPA licensed in NY or NJ; alternate: counsel licensed with a nonprofit specialization. This seat is non-rotating: 3-year terms with one renewal allowed; thereafter mandatory rotation to a new external person.

Charter: the committee operates under a written audit-committee charter, codified as a gov_action of type committee_charter proposed at the first call and reviewed annually. The charter cannot be substantively amended without an Article X bylaws-amendment process.

Authority — the committee:

1. (i)Reviews and recommends the annual independent CPA financial-statement audit engagement, when one is required by NY Executive Law §172-b or undertaken voluntarily.
2. (ii)Reviews this annual governance audit (the engagement that produced this article) and any subsequent governance audits.
3. (iii)Reviews Form 990 prior to filing (Form 990 Part VI line 11b governance disclosure).
4. (iv)Receives the auditor's management letter and management responses; tracks remediation status of all open audit findings.
5. (v)Reviews the recusal-attestation logs of designated investigators (Article XIV §5) and the whistleblower-report investigation summaries (statistical summary only — no name detail).
6. (vi)Reviews the continuity-reserve adequacy (Article XIII §7).
7. (vii)Selects external members of any independent investigator panel under Article XIV §2 when fewer than three conflict-free designated investigators exist.
8. (viii)Recommends material related-party transactions to the full board for pre-approval (Form 990 Schedule L matters; see Article VI).

Independence requirements: the chair is the external independent member (seat c). The Treasurer cannot be chair, vice-chair, or a voting member of this committee. No member of this committee may be the proposer or seconder of any admin_remove action against another committee member during their term plus 12 months after.

Quorum and voting: quorum is 2 of 3 members; a majority of present members carries. The committee cannot decide governance matters on its own; outputs are recommendations to the full board, formalized as gov_action proposals when board action is required.

Reporting: the committee files an annual report to the full managing board, the advisory board (when seated), and a one-page public summary posted at /governance#audit (Article VII transparency commitment). The report is filed alongside the previous year's Form 990 and posted publicly within 30 days of Form 990 filing.

Compensation: internal members serve uncompensated. The external independent member receives a per-meeting stipend within Form 990 Schedule J safe-harbor. The stipend rate is set annually by the full board and disclosed on Form 990. Reasonable expense reimbursement is available to all members under the existing expense policy.

Sticky: Article XV is sticky. Amending it requires 100% of seated admins plus a 60-day public-comment period regardless of bootstrap status. The audit committee is a structural check on the board; it cannot be weakened by the board it audits.

Cross-references: works with Article VI (related-party transactions), Article XI (records-retention compliance review), Article XIII (continuity reserve and emeritus seat), and Article XIV (investigator-panel external members).