Privacy Policy

1. Information We Collect

We collect user data. Some of it you give us, for example when you create an account, make a donation, create a campaign or listing, or contact us for support. Some of it comes from how you use OpenGiving.

• Personal information: name, email address, phone number
• If you set your account up as an organization (a business or a nonprofit): the organization's public name, its legal name, its website, and, if you tell us it is a 501(c)(3), its EIN, which we check against the IRS register before showing a 501(c)(3) badge. If an organization connects a Stripe account to be paid, Stripe collects the company's details and its representative's identity directly.
• Delivery addresses you save or enter at checkout. If you sell something that ships, it leaves from your default address, and the listing shows everyone that address's city and state. It never shows the street. Saved cities are also offered as suggestions when you create a listing or a campaign, and only what you publish is shown.
• Payment information: handled by our payment providers, Stripe and PayPal. We receive a record of the transaction, not your full card number or your bank details. If you withdraw money through PayPal, we keep the PayPal email address you give us.
• Campaign and donation information
• Photos, files and text you upload: campaign and listing photos, your profile picture, digital files you sell, and the messages you send in chat
• Your location, if you choose to share it: a city you pick, or your device's location when you allow it. We also estimate a rough city from your internet address to show nearby listings first. We make that estimate on our own servers, from a database we keep there.
• The internet address (IP address) you were using when you created your account, created a campaign, or started a contribution
• If you turn on notifications, a token that lets us send them to your phone or browser. For a browser, we also keep the description it gives of itself: its name and version, and your operating system.
• On the website, if you allow it: which pages you visit and how quickly they load. Our Cookie Policy explains this.
• Anonymous steps of contributing and buying, on the website and in the apps, such as opening the payment form or pressing Pay. We store no account, name, email or internet address with them, so they can't be linked to you.
• Communications and feedback

2. How We Use Your Information

We use the information we collect to:

• Process donations and transactions
• Communicate with you about your account and campaigns
• Send receipts and tax documentation
• Show you listings and campaigns near you
• Find out where people stop when contributing or buying, from the anonymous steps above
• Draft a listing or campaign for you with artificial intelligence, when you ask for it (section 3)
• Review campaign organizers before money is paid out to them, to catch fraud
• Improve our services and user experience
• Comply with legal obligations

3. Artificial Intelligence

OpenGiving uses artificial intelligence, a large language model from OpenAI, in two places:

• When you ask it to draft a listing or a campaign. The photos you choose and any description you type are sent to OpenAI, which suggests a title, description, category and condition, and a price or a goal. The suggestion fills in the form, and nothing is published until you publish it.
• When a campaign is imported from GoFundMe or GivenGain. We send OpenAI the public text of the campaign's page there, so it can pick out the campaign's details.

Nothing else you do on OpenGiving is sent to an AI model. OpenAI handles this data under its terms for business customers.

4. Information Sharing

We do not sell, trade, or rent your personal information. We may share your information:

• With campaign creators when you make a donation
• With service providers who assist in our operations, listed below
• When required by law or to protect rights and safety
• With your consent

These are the companies that run parts of OpenGiving for us, and what each one receives:

• Supabase stores our database and handles signing in, so it holds your account and the information in section 1 that we keep.
• Railway runs our servers, which receive every request you make, including your internet address.
• Vercel hosts the website and, if you allow it, counts page views and page speed.
• Amazon Web Services stores the photos and files you upload.
• Stripe and PayPal process payments, as described below for Stripe. When you withdraw through PayPal, PayPal receives your PayPal email address and the amount. If you connect a Stripe account to be paid, you give your identity and bank details to Stripe directly.
• Stream carries chat between buyers, sellers and organizers: your name, your profile picture and the messages you send.
• Resend sends our emails, so it receives your name, your email address and what each email says, such as a receipt. It also delivers job applications sent from our Careers page, including any résumé attached.
• OpenAI drafts listings and campaigns and reads imported campaign pages, as described in section 3.
• Google suggests and checks addresses through Google Maps (described below), delivers notifications to Android phones through Firebase Cloud Messaging, and signs you in if you choose to sign in with Google.
• Apple delivers notifications to iPhones and signs you in if you choose to sign in with Apple.
• Shippo quotes postage and buys shipping labels: it receives the seller's and the buyer's names and addresses and the size and weight of the parcel.
• Shopify: when a seller connects their own Shopify store, we tell it about each sale of their items here, so their stock stays right in both places. If the seller chose to get these orders in Shopify, it also receives the item, the price paid, and the delivery name and address, so they can pack it there. We don't send Shopify the buyer's email address or phone number. The seller's store keeps this information under Shopify's Privacy Policy.
• BigDataCloud: on the website, when you ask to use your current location, your device's coordinates are sent to BigDataCloud to find the name of your city.
• Your browser's push service, run by the company that makes your browser, delivers website notifications if you turn them on.

When you enter a delivery address, we send the text you type to Google Maps to fetch the suggestions you are offered. What we keep is the address you confirm: we do not store Google's identifier for the place, or coordinates for it. Google handles the text you type under its own Privacy Policy.

When you pay by card, to contribute or to buy something, we give Stripe your name and email address with the payment. Stripe uses them to process the payment and to check it for fraud, and it also collects information about the device you pay from for the same reasons. When your account is deleted, we delete the name and email we gave Stripe, but Stripe keeps its record of the payment. Stripe handles this information under its own Privacy Policy.

Before money is paid out to a campaign organizer, someone on our team reviews the organizer once. The review shows them the internet addresses described in section 1, for the organizer and for the people who contributed to the organizer's campaigns, and Stripe's fraud assessment of each card payment. We don't show these addresses to anyone outside our team. When your account is deleted, we delete the internet addresses we recorded for it.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

6. Your Rights

You have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Opt-out of certain communications

7. Data Deletion

You can request deletion of your personal data and account at any time. To request data deletion:

1. Log in to your account
2. Go to Profile Settings
3. Click on "Delete Account" at the bottom of the page
4. Follow the confirmation steps

Your request will be processed within 30 days. Some information may be retained for legal and tax compliance purposes but will be anonymized.

8. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Email: privacy@opengiving.us