Privacy Policy: Givable

This Privacy Policy describes how Givable LLC (“Givable,” “we,” “us,” or “our”) collects, uses, stores, and protects information in connection with the use of our fundraising platform, websites, and related services (collectively, the “Services”). This Policy applies to nonprofit organizations, their staff and administrators, donors and supporters, and visitors who interact with the Services.

1. Roles Under Data Protection Laws

For purposes of applicable data protection laws, nonprofit organizations using Givable are the “data controllers” (or “businesses” under California law) responsible for determining the purposes and means of processing supporter data. Givable acts as a “data processor” (or “service provider”), processing personal data on behalf of organizations and under their instructions. When Givable processes supporter data for an organization, that organization’s own privacy policy also applies, and Givable’s commitments to the organization are set out in our Data Processing Addendum. Donors and supporters who wish to exercise their rights may do so through the organization they supported, and Givable will assist organizations in fulfilling such requests.

Where Givable collects information directly for its own purposes, for example from visitors to our websites, from people who contact us or request a demo, or from the staff of organizations that hold a Givable account, Givable acts as a controller for that information.

2. Information We Collect

We may collect the following categories of personal data:

Donors and supporters: name, email address, phone number, mailing address, payment details, donation and giving history, recurring giving schedules, event registrations and ticket purchases, peer-to-peer fundraising activity, communication preferences, profile photos, supporter portal login credentials, and responses to custom questions created by organizations.
Organization administrators and staff: name, email, phone number, login credentials (encrypted and stored using secure industry-standard algorithms), role and permission assignments, account activity logs, login history, and how they use features of the Services. Where an organization enables single sign-on, we also receive the name, email address, and group or role information that its identity provider shares with us.
Content and media: images, video, documents, and written updates uploaded by organizations or their supporters, including media published through Stories and peer-to-peer fundraising pages, together with any personal data contained in that content.
Website visitors and prospective customers: information you submit through our websites, such as demo requests, newsletter signups, contact requests, and job applications (including any resume you provide); which parts of our recorded demo you watch; the details of any meeting you book with us; and what you enter into our pricing calculator.
Technical information: IP addresses, approximate location derived from IP address, time and date of access, device and browser information, and cookies or similar technologies, as described in Section 12.

3. How We Use Information

We use personal data only as necessary to provide, secure, and improve the Services. This includes:

Processing donations and delivering fundraising tools, including recurring giving, events, and peer-to-peer campaigns.
Sending receipts, confirmations, and communications on behalf of organizations.
Providing donors and supporters with access to giving history, recurring schedules, and account preferences.
Authenticating users, including two-factor authentication and single sign-on, and supporting fraud prevention and security monitoring.
Completing addresses as they are typed into address fields.
Reviewing content posted through the Services. Content may be analyzed automatically to detect material that may violate our Acceptable Use Policy. Automated analysis only decides whether content waits for a person to review it; a person decides whether content is removed.
Improving platform performance and features, using aggregated information and information about how staff use the Services.
Responding to demo requests, inquiries, and job applications, and sending service, security, and product communications to organization administrators, with the ability to opt out of non-essential messages.

4. Legal Bases for Processing

Where the EU or UK General Data Protection Regulation applies to information Givable processes as a controller, we rely on the following legal bases:

Contract: to provide the Services to organizations and their staff, and to respond to requests you make of us.
Legitimate interests: to secure the Services and prevent fraud and abuse, to understand and improve how the Services and our websites are used, and to communicate with organizations about Givable. We balance these interests against your rights, and you may object at any time.
Consent: for marketing communications where the law requires consent, and for text messages you choose to receive. You may withdraw consent at any time.
Legal obligation: to keep financial and receipting records and to respond to lawful requests from authorities.

Where Givable processes supporter data as a processor, the organization determines the legal basis for that processing.

5. Communications

Email

We send transactional messages (receipts, confirmations, security and account notices) that are necessary to provide the Services, and, where you have opted in, product and marketing updates. You may opt out of marketing email at any time using the unsubscribe link in the message. Transactional and security messages cannot be opted out of while your account is active.

Text messaging (SMS)

Messages we send you. We use SMS for security and account messages: most importantly, one-time passcodes for two-factor authentication, and account or security alerts. You provide your mobile number when you enable two-factor authentication or add it to your profile, and doing so is your consent to receive these messages. Message frequency varies with your account activity. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. Opting out will disable SMS-based two-factor authentication on your account.

We do not share your mobile information. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. This includes your mobile phone number and your opt-in or consent to receive text messages, which will not be shared, sold, rented, or otherwise provided to any third party, affiliate, or lead generator. Mobile numbers are disclosed only to the telecommunications providers strictly necessary to deliver messages you have requested, and those providers may not use that information for their own marketing.

Messages organizations send to their supporters. Organizations using Givable may send their own text messages to supporters through the platform. Those organizations are responsible for obtaining the required consent and for complying with applicable messaging laws; Givable processes those messages on the organization’s behalf.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

We share data only with service providers who help us deliver the Services, and only to the extent necessary to do so. These providers perform functions such as:

hosting, databases, file storage, and content delivery
payment processing
email and text message delivery
AI model processing, and automated detection of personal data in text
automated review of posted content for policy violations
address completion and place lookups
product usage analytics for staff using the Services
background processing, security, and bot protection
scheduling demo meetings and delivering web fonts

Providers acting on our behalf are contractually obligated to protect the confidentiality and security of the data and may not use it for their own purposes. Some providers, such as payment processors, text message carriers, and mapping services, process certain data under their own terms and privacy policies, for example to bill, secure, and prevent fraud on their own services. For example, text typed into an address field is sent to a mapping service to suggest matching addresses. Organizations may request the current list of Givable’s subprocessors, and Givable will notify organizations before adding or replacing one.

Bot and spam protection. Our public websites use Cloudflare Turnstile, a bot-detection service from Cloudflare, Inc., to protect our forms from spam and automated abuse. Turnstile runs in the background and processes limited technical information, such as your IP address and browser and device signals, to distinguish real visitors from bots. According to Cloudflare, Turnstile does not use this information for advertising and does not use cookies to collect or store information. Cloudflare processes this data as our service provider; for details, see Cloudflare’s Turnstile Privacy Addendum.

The categories above exclude text messaging originator opt-in data and consent; this information is not shared with any third parties.

We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets, in which case we will provide notice before personal data becomes subject to a different privacy policy.

7. Integrations You Enable

Organizations may connect Givable to other systems they use, such as CRM, accounting, marketing, or analytics platforms. When an organization enables an integration, data flows between Givable and that system at the organization’s direction and configuration. Once data reaches a connected system, it is governed by that provider’s terms and privacy policy, and the organization is responsible for its use there. Organizations may disconnect an integration at any time.

8. Content and Media

Organizations and their supporters may upload images, video, and written updates, for example through Stories or peer-to-peer fundraising pages. Organizations control whether that content is published and who can see it, and are responsible for obtaining any releases or permissions required from people appearing in it, including where a media release is collected through the Services.

We store and process this content to provide the Services, including the automated review described in Section 3. We do not share, sell, or license uploaded media to third parties, and we do not use it for advertising.

9. Givable AI

Givable AI lets authorized users ask questions about their organization’s data and prepare drafts and reports. It works with the permissions of the user making the request, so it can only use data that user is already allowed to see. Organization administrators can turn Givable AI off, control which team members may use it, exclude specific fields, and set usage limits.

Placeholders before transmission. Before any content is sent to an AI model provider, we replace personal data such as names, email addresses, phone numbers, postal addresses, and payment details with placeholders. We use automated detection to find personal data in free text so that it can be replaced too. AI model providers do not receive those details.
Distance searches. When a user asks a distance-based question, we send only a coarse place name, such as a city, a state or province, or a postal code, to a mapping service. We do not send street addresses.
No model training. Content sent to AI model providers is not used to train their models.
Storage. We keep conversations with placeholders in place of personal data. We delete the information that links placeholders to individual records 180 days after a conversation’s last activity, or sooner if the organization sets a shorter period. After that, the stored conversation no longer identifies anyone. When we act on an erasure request, we remove that person’s placeholder links immediately.
Review. Givable personnel may review stored conversations to operate, secure, support, and improve the Services. They see placeholders rather than personal data, only with a specific access grant, and each access is logged.

10. Recommended Gift Amounts

On giving forms run by organizations that use Givable and have turned on recommended amounts, we estimate which gift amounts to suggest for your visit. This is automated profiling: it changes only the amounts suggested to you.

On the organization’s behalf. Choosing and showing the suggested amounts on your visit is done for the organization you are giving to, as its service provider. The organization’s privacy policy describes its own use of your information.
What we use. To choose the amounts we use: information about your visit, such as the type of device and browser, the time of day, and how you reached the page (for example, from an email or a social media post); your general area as estimated from your internet connection, never your street address or precise location; public statistics about areas, such as published census income statistics, never information about you as an individual; and, only if you are signed in to the organization’s supporter account, your past gifts to that organization. We never use your gifts to other organizations. We do not use your name, email address, postal address, race, ethnicity, religion, health, age, or gender.
What it can and cannot do. Suggested amounts are only ever raised from the amounts the organization set, the organization’s lowest amount is always among the amounts shown, and you can enter any amount you choose. Where the organization has set a fixed amount or a fixed price, the amounts are not adjusted.
Your choices. If your browser sends a Global Privacy Control or Do Not Track signal, you are shown the organization’s standard amounts, your past gifts are not read, and your visit is not used to improve recommendations. To access or delete information about your visits, contact the organization you gave to, or contact us as described in Section 18.
How we improve recommendations, on our own behalf. With the organization’s authorization, we convert information about visits and gifts into de-identified information that cannot reasonably be linked to you or your household, and use it, combined across the organizations that use Givable, to learn which suggestions work. We keep it de-identified, we do not attempt to re-identify it, and anyone we share it with must agree to the same. We do not sell or share your personal information for recommended amounts.
Retention. The organization’s record of what was suggested on your visit is deleted after 13 months; after that, a gift keeps only which suggested amount was chosen. De-identified information is kept as a rolling window of recent activity, no longer than five years, and after that only as totals.
Where this applies. Recommended amounts are used only for visitors in the United States.

11. Data Retention

We keep personal data for as long as an organization’s account is active and as needed to provide the Services. Within an account, the following periods apply by default:

Donations and transactions are kept for the life of the account, because they are the organization’s financial and receipting records.
Deleted records stay in a recycle bin for 365 days, and archived media for 30 days, before they are permanently deleted.
Record change history is kept for 2 years for supporter, lead, and account details, and 7 years for gift and payment details.
Email conversations stored in the Services are kept for 90 days if they are not linked to a record, and 2 years if they are.
Search history is kept for 180 days.
Data export files are deleted within 24 hours of being created.
Givable AI conversations are kept as described in Section 9.

When an account is closed, the organization may export its data for 30 days. After that, we delete or de-identify it, except where we must keep it to meet legal, regulatory, or tax obligations, generally up to seven years for financial and receipting records.

Donors and supporters may ask the organization they supported to delete their personal data, including through the supporter portal, subject to applicable law and to the retention obligations above. We keep information from our websites, such as demo requests and job applications, for as long as needed for the purpose it was collected, and then delete it. Aggregated information that no longer identifies anyone may be kept indefinitely.

12. Cookies and Similar Technologies

We use cookies and similar technologies that are necessary to keep you signed in, remember your preferences, and secure the Services. Inside the Services, we also use analytics to understand how staff use features, so we can improve them. On our websites, we use analytics to measure aggregate traffic. We do not use cookies for advertising, and we honor Global Privacy Control signals as described in Section 15. You can control cookies through your browser settings, although turning off necessary cookies may prevent you from signing in.

13. International Data Transfers

Givable is based in the United States. Our databases are hosted in the United States unless an organization has a dedicated database in another region. Files and media are stored and delivered through a global network, and some of our service providers, such as AI model providers and email delivery services, process data in the United States. If you are located outside the United States, including in Canada, your data may be transferred to and processed in the United States, where it may be accessible to courts, law enforcement, and national security authorities under the laws of that country. Where required, we use safeguards such as Standard Contractual Clauses to protect cross-border transfers.

14. Security

We take reasonable and appropriate measures to protect personal data from unauthorized access, use, or disclosure. This includes encryption of data at rest and in transit (AES-256, TLS), secure password hashing, role-based access controls, and continuous monitoring of our systems.

Givable personnel access an organization’s data only to provide support, to maintain and secure the Services, or as required by law. When personnel sign in to an account to provide support, the session is logged.

If we become aware of a security incident that affects personal data, we will notify affected organizations without undue delay, and notify individuals and regulators where the law requires.

Card payments are processed by a PCI-DSS Level 1 certified payment processor. Full card numbers are never stored on Givable’s systems.

Givable is built to SOC 2 standards and our SOC 2 audit is in progress; we are also working toward ISO 27001 as our security program matures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. Your Rights

Depending on your location, you may have rights under the GDPR, California law (CCPA/CPRA), Canadian privacy law including PIPEDA and Québec’s privacy law, or other applicable laws, including:

Right to access, correct, or update your personal information.
Right to request deletion of your personal information.
Right to restrict or object to the processing of your data.
Right to data portability.
Right to withdraw consent, and to opt out of marketing communications.
Right to know what categories of personal information we collect and how they are used.

Because Givable does not sell personal information or share it for cross-context behavioral advertising, there is no such activity to opt out of. We honor recognized opt-out preference signals, including Global Privacy Control, where required.

Donors and supporters should direct requests to the organization they supported, and Givable will support organizations in fulfilling those requests. You may also contact Givable directly at privacy@givable.com. We may need to verify your identity before acting on a request. We respond within 30 days, or within the time the law where you live allows. We will not discriminate against you for exercising any of these rights.

If you are not satisfied with our response, you may complain to the data protection authority where you live, such as a supervisory authority in the EU or UK, the Office of the Privacy Commissioner of Canada, or the Commission d’accès à l’information du Québec.

16. Children’s Privacy

The Services are not intended for children under 13 years of age, and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 13 without appropriate consent, we will delete it promptly.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on our website with an updated effective date, and we will notify organization administrators of material changes. We encourage you to review this Policy periodically to stay informed about how we protect your information.

18. Contact Us

Givable has designated a Privacy Officer who is responsible for our compliance with this Policy and with applicable privacy laws. If you have questions about this Privacy Policy or our data practices, or wish to make a request or complaint, please contact our Privacy Officer:

Givable LLC, Attn: Privacy Officer
9864 Cherry Valley Ave SE
Caledonia, MI 49316, USA
privacy@givable.com

Privacy Policy