Privacy Policy

Last updated October 28, 2026

Draft. This policy is pending legal review and may change before launch.

This policy explains how DonorSecure, LLC ("DonorSecure", "we") collects and uses personal information when organizations, their staff, donors and supporters use DonorSecure.

1. Two kinds of data

• Organization staff. When you sign up to run an organization, we're responsible for your account information.
• Donors and supporters. When you give to or fundraise for an organization, we process your information on that organization's behalf. The organization decides how it uses your information, and its own privacy policy applies too.

2. What we collect

• Staff accounts: name, email address, password (stored only as a secure hash), organization details such as name, logo, website and EIN, and settings.
• Donors: name, email address, mailing address when the organization asks for it, gift amount, tip, frequency, campaign, comment and whether the gift is anonymous.
• Payment details: card and bank details are entered into Stripe's secure form and go directly to Stripe. We never see or store full card numbers.
• Supporters: name, email address and the content of fundraising pages you create.
• Usage: server logs, and counts of donation page visits. Visit counts don't use cookies and store IP addresses only in masked form.

3. How we use it

• To run the Service: process gifts through Stripe, send receipts and account emails, show organizations their gifts, and let donors manage monthly gifts and see their giving history.
• To keep the Service secure, prevent fraud and abuse, and fix problems.
• To understand overall usage and improve the Service.
• To meet legal obligations.

We don't sell personal information, and we don't use donor information for advertising.

4. Who we share it with

• The organization you give to. Organizations see the donor and gift information for gifts made to them, and can export it or send it to their own systems.
• Service providers who help us run the Service, under contracts that limit their use of the data: Stripe (payments), Heroku (hosting), Cloudflare (network and custom domains), Resend (email) and Sentry (error monitoring).
• Legal reasons: when required by law, or to protect the rights and safety of donors, organizations or the Service.
• Business transfers: if DonorSecure, LLC is involved in a merger or acquisition, under this policy.

5. Cookies

We use cookies only to keep you signed in, remember your selected organization, and protect forms against forgery. We don't use advertising or cross-site tracking cookies.

6. Retention

We keep account and gift records while an organization uses the Service and as long as needed for legal, tax and accounting purposes. Webhook delivery logs are deleted after 30 days. Organizations can ask us to delete their data when they leave, subject to those obligations.

7. Your choices and rights

• Staff can update their account and organization details in the app.
• Donors can see their giving history in the donor portal. To correct or delete donor information, contact the organization you gave to, or us and we'll pass the request along.
• Depending on where you live, you may have rights to access, correct, delete or port your information. Contact us at support@donorsecure.com.

8. Security

We use encryption in transit, encrypt sensitive secrets at rest, limit staff access to what's needed, and rely on Stripe for payment data. No system is perfectly secure, and we'll notify affected users of a breach as required by law.

9. Children

The Service isn't directed to children under 13, and we don't knowingly collect their information.

10. Changes

We may update this policy. If a change is material, we'll notify account owners before it takes effect and update the date above.

11. Contact

DonorSecure, LLC, Atlanta, GA. support@donorsecure.com.