Privacy Policy

1. Who we are and what this covers

Donorframe ("we") operates donorframe.com and hosts websites for nonprofit organizations ("organizations"). This policy covers two audiences: visitors to donorframe.com itself, and donors, ticket buyers, and shoppers on sites we host for organizations.

2. Donorframe as a processor for organizations

On a hosted site, the organization is the party collecting information from its donors and supporters; Donorframe stores and processes that information on the organization's behalf to operate the service. Each organization is responsible for its own privacy commitments to the people it collects information from.

3. Information collected on donorframe.com

• Contact form: name, email address, organization name, and the message, stored in our database and emailed to our team.
• Server logs: IP address, browser, and pages requested, retained for 90 days.
• Analytics: donorframe.com uses Google Analytics to count visits and see which pages are read. If you are in the EU, the UK, or California, it only runs after you accept analytics cookies, and you can change that choice any time from "Cookie settings" in the footer. Elsewhere it runs unless your browser sends a Global Privacy Control or Do Not Track signal. No advertising cookies are set.

4. Information collected on hosted organization sites

• Donors: name, email, gift amounts and dates, recurring gift status, receipt records.
• Event registrants: name, email, ticket tier and quantity, check-in status.
• Shoppers: name, email, shipping address, order contents, shipping tracking.
• Payment card details are entered directly into Stripe and are never stored by Donorframe.

5. Third parties we rely on

• Stripe (payments, on each organization's own connected account). When you provide personal data in connection with a payment on Donorframe, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.
• EasyPost (shipping rates and labels for merch orders)
• Amazon Web Services (email delivery via SES, hosted in the US East (Ohio) region)
• Cloudflare (DNS, TLS certificates for custom domains, and Turnstile, which checks that public forms are submitted by a person rather than a bot)
• Bugsnag, by SmartBear (error monitoring: when something breaks, the error report can include the page requested and, if you were signed in, your name and email address)
• Google Analytics (visit statistics on donorframe.com only, subject to the cookie choice described above)
• Google Fonts (typefaces loaded on donorframe.com and hosted sites; visitors' IP addresses are sent to Google as part of loading these)

6. How information is used

Information is used to deliver the service: process gifts and orders, send receipts and confirmations, let organizations manage their donors and events, and respond to inquiries. We do not use collected information for marketing purposes.

7. Retention and deletion

Tax receipts and payment records are retained for at least seven years to meet standard recordkeeping requirements for charitable donation receipts. Other information is retained for as long as an organization's account is active, and is made available for export before deletion after an organization's account is terminated.

8. Your rights

You may request access to, correction of, or deletion of your information. If you're a donor, registrant, or buyer on a hosted site, that request should go to the organization first, since it owns that relationship; Donorframe will assist the organization in fulfilling it. To reach Donorframe directly, including about a donorframe.com visit or a request an organization hasn't resolved, use the contact form or email [email protected].

9. Children

Hosted sites are not directed at children under 13, and we do not knowingly collect personal information from children under 13.

10. Security

All traffic to donorframe.com and every hosted site is encrypted in transit. Each organization's data is isolated from every other organization's within the platform, and access to it is restricted to authorized staff of that organization and to Donorframe personnel who need it to operate the service.

11. Changes and contact

We may update this policy from time to time; the date at the top of this page reflects the most recent change. Questions about this policy can be sent through the contact form or to [email protected].