Privacy Policy

1. Introduction

DonorFlow AI, Inc. ("we," "us," or "our") respects your privacy and is committed to protecting the personal information of our users and their donors. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Account Information: Name, email address, organization name, role, and password.

Donor Data: Contact information, giving history, communication preferences, and engagement data that you voluntarily upload or sync from integrated systems.

Usage Data: Log data, device information, IP address, browser type, and how you interact with the Service.

Payment Information: Billing details processed by our payment provider. We do not store full credit card numbers.

3. How We Use Your Information

We use your information to: provide and maintain the Service; process transactions; send transactional emails and updates; improve our AI models and recommendations; provide customer support; ensure security and prevent fraud; and comply with legal obligations.

4. How We Protect Donor Data

Donor data is encrypted in transit (TLS 1.3) and at rest (AES-256). We implement strict access controls, regular security audits, and SOC 2 Type II controls. Donor data is never used to train general-purpose AI models or shared with third parties for advertising purposes.

5. Data Sharing

We share information only with: (a) service providers who help us operate the Service (cloud hosting, payment processing, email delivery); (b) when required by law or to protect our rights; (c) with your explicit consent. All service providers are bound by confidentiality and data protection agreements.

6. Your Rights

Depending on your location, you may have the right to: access, correct, or delete your personal data; export your data; object to certain processing; and withdraw consent. To exercise these rights, contact us at privacy@donorflowai.com. We will respond within 30 days.

7. GDPR & International Transfers

For users in the European Economic Area (EEA), we process data under the lawful basis of contract performance and legitimate interest. We use Standard Contractual Clauses for international data transfers. You may choose EU data residency during account setup.

8. Data Retention

We retain your account data for as long as your account is active. After account deletion, we retain data for 30 days to allow recovery, then permanently delete it, except where longer retention is required by law. Backups are purged within 90 days.

9. Cookies & Tracking

We use cookies and similar technologies to operate the Service, remember preferences, and analyze usage. See our Cookie Notice for details on the specific cookies we use and how to manage your preferences.

10. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child, contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or in-app notification at least 30 days before taking effect.

12. Contact Us

For privacy-related questions or requests, contact us at privacy@donorflowai.com or by mail at: DonorFlow AI, Inc., 123 Innovation Drive, Suite 400, Wilmington, DE 19801, USA.