Privacy Policy — Givonit

Givonit ("we," "us," or "our") operates the Givonit donation marketplace. This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, and the choices you have.

1. Information We Collect

Information you provide directly

Account registration: your name, email address, and password when you create an account.
Nonprofit onboarding: organization name, EIN (Employer Identification Number), contact name, phone number, and shipping address(es). EINs, phone numbers, and address fields are encrypted at rest.
Payment details: we do not store card numbers. Payment information is processed directly by Stripe; we receive only a tokenized reference and transaction metadata (amount, timestamp, last-four digits).
Communications: messages you send to nonprofits or to our support team.
Self-reported confirmations: when you report that a purchase was made or an item was received.

Information collected automatically

Click history: when you follow an outbound link to a retailer we log a click record that includes the need you funded, the retailer, the timestamp, and a hashed device identifier. This enables affiliate-commission attribution.
Log data: IP address, browser type, pages visited, referrer URL, and session identifiers, collected through our server logs and Sentry error-monitoring service.
Product analytics: we record which pages you view and a small, fixed set of actions — viewing a need, pressing "Fund this need", being shown the tip prompt, skipping or completing a tip, and searching with no results. These records carry only identifiers that already appear in the page URL (the need and organization), never your name, email address, phone number, postal address, or EIN, and never a hash of any of them. We instruct our analytics provider to discard your IP address rather than store or geolocate it.
Cookies and similar technologies: session cookies (required for authentication) and an analytics cookie used to recognise a browser across pages. If you are not signed in, no analytics profile is created for you. You may block or clear these through your browser settings; blocking the analytics cookie does not affect your ability to use the site.

2. How We Use Your Information

Operate the platform and facilitate funding flows between donors and nonprofits.
Process tips and cash donations, generate IRS-compliant tax receipts, and issue refunds.
Attribute affiliate commissions from Amazon, Walmart, and Target to the correct click records.
Send transactional emails: account confirmation, receipt delivery, need-status updates, and security alerts.
Send SMS notifications if you have opted in (notifications only; no marketing).
Detect fraud, enforce our Terms of Service, and maintain security.
Improve the platform through aggregated, de-identified analytics.
Comply with legal obligations, including IRS record-keeping requirements for charitable receipts.

3. Information Sharing

We do not sell your personal information. We share it only as described below.

Stripe — payment processing for tips and cash donations. Stripe's privacy policy governs their handling of card data.
Resend — transactional email delivery (receipts, account emails).
Twilio — SMS notification delivery for opted-in users.
Sentry — error and performance monitoring. Sentry receives anonymized stack traces and may receive IP addresses in error payloads; we configure it to scrub PII from logs.
Cloudflare — CDN, DDoS protection, and R2 object storage for uploaded files (e.g., org logos). Cloudflare sees traffic metadata but not decrypted PII fields.
PostHog — product analytics. Receives the events described above and their identifiers. We disable automatic capture of clicks and form input and disable session recording, so PostHog does not receive the contents of anything you type. We send instructions to discard your IP address. If you are signed in, events are associated with your account identifier so we can understand a single person's journey; if you are not, no profile is created.
Vercel — hosting, and aggregate traffic and page-performance measurement. Vercel's analytics is cookieless and does not identify individual visitors or track them across sites.
Amazon, Walmart, and Target (affiliate programs) — when you follow a funded-need link, the retailer receives standard web-referral data (referrer URL, affiliate tag). The retailer's own privacy policy governs what they collect after you arrive on their site.
Law enforcement or legal process — we may disclose information when required by law, subpoena, or court order.
Business transfers — if Givonit is acquired or merges, personal data may transfer to the successor entity; we will notify you before that occurs.

4. Data Retention

We retain account data for as long as your account is active. Financial records (transactions, receipts, commission ledger entries) are retained for seven years to comply with IRS and accounting requirements. Click records are retained for 18 months for affiliate-commission dispute resolution. Server logs are retained for 90 days.

Anonymized, aggregated analytics data (not linked to any individual) may be retained indefinitely.

5. Your Rights

Access and portability: you may request a copy of the personal data we hold about you.
Correction: you may update your name and email in account settings at any time.
Deletion: you may request account deletion by emailing support@givonit.com. We will delete your account and associated PII within 30 days, subject to retention obligations for financial records described above.
Opt-out of SMS: reply STOP to any text message or update your notification preferences in account settings.
California residents (CCPA): you have the right to know, delete, and opt out of sale of personal information. We do not sell personal information.

6. Security

We use AES-256-GCM encryption for sensitive fields stored in our database (EINs, phone numbers, addresses). All data in transit is protected by TLS 1.2+. We enforce multi-factor authentication for all organization administrators and platform staff. Despite these measures, no system is completely secure; please use a strong, unique password and enable MFA on your account.

7. Children

Givonit is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

8. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date above and, for material changes, notify you by email or prominent in-app notice.

9. Contact Us

Questions or requests regarding this policy: support@givonit.com