Privacy Policy

1. Overview

Fundraiser (“the Application”, fundraiser.express) is a donor management system used by nonprofit fundraising organizations. Each organization is a separate tenant with its own data, which is not accessible to any other organization.

The Application has two kinds of users. Staff members sign in to manage donors, donations, meetings and reports. Donors are not required to sign in; they may reach a public donation page belonging to a specific organization in order to make a donation.

2. Data We Collect

• Staff account information (name, email address, phone number)
• Donor contact details and donation records entered by authorized staff
• Meeting notes, visit records and internal notes entered by staff
• Donation details submitted through a public donation page, including the donor’s name, contact details and the payment information required to process the donation
• Uber ride booking details (pickup and dropoff addresses, ride status) when the Uber integration is used

Payment card data submitted on a donation page is transmitted to our payment processor and is not retained by the Application beyond what is required to identify the transaction.

3. Google Account Data

Google integrations are optional. Nothing below happens unless a staff member explicitly connects a Google Account through Google’s own consent screen, and each item is used only for the purpose stated next to it.

• Sign in with Google (openid, email, profile) — used solely to authenticate a staff member and to match them to an existing account in the Application. We store the Google account identifier, email address and display name.
• Sending email (gmail.send) — used to send the organization’s own outgoing messages, such as donation receipts and internal notifications, from the organization’s Gmail address rather than from a generic one. The Application only sends messages that the organization itself generates.
• Reading donation notifications (gmail.readonly) — used to read incoming notification emails sent by payment processors and banks (for example deposit and transfer notices), so that the donations they describe are recorded automatically instead of being typed in by hand. The Application reads messages in order to extract donation details; it does not modify, label, delete or send anything in the connected mailbox, and it does not read mail for any other purpose.
• Mailbox identity (userinfo.email) — used to record and display which Gmail address the organization connected, so staff can tell which mailbox is in use.
• Contacts import (contacts.readonly) — used only when a staff member chooses to import contacts, to copy names, phone numbers and email addresses into that organization’s donor list.

OAuth refresh tokens are encrypted at rest and are used only to perform the actions above on behalf of the organization that granted them. Content extracted from email is stored as donation records within that organization’s own data.

A staff member may disconnect a Google Account at any time from within the Application, or revoke access directly at myaccount.google.com/permissions. Revoking access stops all future use immediately.

4. How We Use Data

• To record and manage donations, donors and receipts
• To coordinate donor visits, meetings and rides for fundraising staff
• To send email and SMS notifications to staff and to donors of that organization
• Internal reporting and record-keeping for the organization that owns the data

We do not sell personal data, and we do not share it with advertisers or data brokers. Data is shared only with the service providers required to operate the Application (hosting, database, payment processing, email and SMS delivery), and only to the extent needed to perform those functions.

5. Limited Use of Google User Data

Fundraiser’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained through Google APIs is:

• used only to provide or improve the user-facing features described in section 3;
• not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition;
• not used or transferred for advertising, ad targeting, marketing, or to build advertising profiles;
• not sold to anyone;
• not used to train, fine-tune or otherwise develop generalized artificial intelligence or machine learning models, and not made available to any third party for that purpose;
• not read by humans, except with the affected user’s explicit consent for a specific request, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized.

6. Data Security

All sensitive credentials (API keys, OAuth tokens, payment credentials) are encrypted at rest using AES-256. Access to the Application requires authentication, and optional two-factor authentication is available. Data is stored in a private managed database that is reachable only over an authenticated, TLS-encrypted connection, and backups are encrypted with a separate key.

7. Data Retention and Deletion

Donation and donor records are retained for as long as the organization needs them for its operational and record-keeping obligations. Data obtained from a connected Google Account is deleted when the connection is removed, other than donation records that the organization has chosen to keep as part of its own books.

A staff member or a donor may request deletion of their personal data by contacting the organization that holds it, or by writing to the address in section 8. Requests are answered within 30 days.

8. Contact

For privacy-related inquiries, including access and deletion requests, contact privacy@fundraiser.express.