Privacy Policy

1. Who this covers

Two groups of people appear in the Service:

• Account users — the nonprofit staff who sign up and use Because of You.
• Donors — the people a nonprofit thanks, whose details the nonprofit adds so we can personalise an experience. Here the nonprofit is responsible for that data and we act on its instructions (see section 6).

2. Information we collect

• Account information — your name, email, and organisation details such as organisation name, website, tax/registration identifier (e.g. EIN) and brand assets.
• Content you provide — website material, impact reports (including uploaded PDFs), photos, and the donor information you add (such as donor names, gift amounts and any fields you choose to include in personalized links).
• Website addresses entered into our public demo — if you try the demo on our homepage, we keep the website address you entered, the organisation name we read from that public site, and whether the demo built successfully. We use this to fix demos that fail and to follow up with organisations who tried us. We do not ask for or store your email address to run the demo, and there is no account involved. If you’d rather we didn’t keep yours, email us and we’ll delete it.
• Usage and analytics — how experiences are opened: opens, completion, time on page and shares, plus basic device/browser information needed to serve pages and keep them secure. We also use Google Analytics on our marketing site and in the signed-in app to understand how people find and use us, such as which page someone landed on and which campaign referred them. Donor experience pages are excluded: if you are a donor reading a thank-you someone sent you, that page carries no Google Analytics, and the only measurement on it is the opens-and-shares reporting the nonprofit sees.
• Payment information — handled by Stripe. We receive billing status and limited details (such as plan and the last digits/brand of a card); we do not store full card numbers.
• Cookies — we use essential cookies to keep you signed in and to run the Service, and Google Analytics sets its own cookie to recognise a returning visit. We don’t use advertising cookies, we don’t run ads, and we haven’t turned on Google’s advertising-personalisation features.

3. How we use information

• to provide, personalise, host and improve the Service;
• to generate experiences from the content you give us;
• to process payments and manage subscriptions;
• to show you analytics about your own experiences;
• to provide support, keep the Service secure, and meet legal obligations.

We do not sell personal information, and we don’t use donor data for advertising.

4. Automated content extraction (AI)

To build an experience, content you provide — such as your website text and impact reports — is processed by AI and automation providers (see section 7) to extract your brand, key facts and imagery. This processing is used to deliver the Service to you, not to independently build advertising profiles. We take reasonable steps not to send donor personal information into this extraction step.

5. How experiences are shared

Donor experiences are unlisted: each has a long, random link, is marked “no-index” so search engines don’t list it, and the visible page does not display a donor’s email address. Anyone with the link can view that page, so treat the links as you would a private URL.

6. Donor information and the organisation’s role

When a nonprofit uploads donor information, the nonprofit decides what is collected and why, and we process it on the nonprofit’s behalf to provide the Service. If you are a donor and want to access, correct or remove your information, please contact the organisation that sent you the experience; we will help that organisation respond.

7. Service providers and where data is held

We share information with a small set of providers who help us run the Service, under agreements that limit their use of it. Because these providers (and our own hosting) operate outside Australia, using the Service involves disclosure of personal information overseas — principally to Japan and the United States:

• Supabase — database, authentication and file storage. Primary data is hosted in Tokyo, Japan (AWS ap-northeast-1).
• Vercel — application hosting and delivery, served from Sydney, Australia and a global edge network.
• Stripe — payment processing (United States / global).
• Resend — transactional email such as sign-in and notifications (United States).
• OpenRouter and Firecrawl — the AI extraction and website-reading described in section 4 (United States).
• Google Analytics — website measurement for our marketing site and the signed-in app, never for donor experience pages (United States).

We may also disclose information if required by law, to protect our rights or safety, or as part of a business sale or reorganisation (in which case this policy continues to apply).

8. Security

We protect information with encryption in transit, access controls, and database rules that isolate each organisation’s data. No system is perfectly secure, so we can’t guarantee absolute security, but we take reasonable steps to protect personal information and to respond to incidents.

9. How long we keep information

We keep account and content information while your account is active and as needed to provide the Service. When you delete an experience, its donor pages stop resolving; when you close your account, we delete or de-identify personal information within a reasonable period, except where we must keep records (for example, for tax or legal reasons).

10. Your privacy rights

Subject to the law, you can ask us to access or correct your personal information, or to delete it. Email hello@because-of-you.com and we’ll respond within a reasonable time. If you’re a donor, contact the organisation that sent your experience (see section 6).

11. Children

The Service is intended for organizations and their staff, not for children, and is not directed to anyone under 16. Where an organization’s content refers to a child, that organisation is responsible for having the right to use it.

12. Changes to this policy

We may update this policy from time to time. We’ll change the “last updated” date above and, for material changes, take reasonable steps to let account users know.

13. Contact us and complaints

For any privacy question or request, email hello@because-of-you.com. If you’re in Australia and aren’t satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.