Privacy Policy

Last updated: June 1, 2026

DonorSpark (“DonorSpark,” “we,” “us”), a product of Hall Pass Digital, LLC, provides software that helps nonprofit organizations turn their websites and program data into shareable, AI-generated “story decks.” This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the rights you have over it.

1. Our two roles — please read this first

DonorSpark handles personal information in two different capacities, and your rights differ depending on which applies:

• As a controller — for information about our customers (the nonprofit staff who create accounts), website visitors, and prospective customers. This Privacy Policy governs that information.
• As a processor (service provider) — for donor and supporter information that our nonprofit customers upload or collect through DonorSpark (for example, a donor’s name, email, and gift amount used to personalize a thank-you deck). For this information, the nonprofit customer is the controller.We process it only on the customer’s documented instructions.

If you are a donor or supporter and want to access or delete your information, please contact the nonprofit you interacted with. They direct us, and we will assist them in fulfilling your request. See Section 9.3.

2. Information we collect

2.1 Information you give us (customers)

• Account & identity: name, email, password (managed by our authentication provider, Clerk — we never see your raw password), and organization name.
• Onboarding & profile: role/title, organization size, primary goals, and similar details.
• Billing: if you subscribe, our payment processor (Stripe) collects your billing contact and card details. We do not receive or store your full card number.
• Communications: messages you send us and your marketing email preferences.

2.2 Information our customers provide about donors and supporters (we process this)

When a nonprofit customer uses DonorSpark, they may upload or collect information about their donors and supporters, which we process on their behalf: name, email, gift amount; free-text stories or responses submitted through a collection form; and uploaded photos or videos. We use this only to provide the service to the customer. We do not use it for our own purposes, sell it, or use it to train AI models.

We do not collect payment-card data, government IDs, Social Security numbers, dates of birth, or postal addresses from donors.

2.3 Information we collect automatically

• Usage & device data — pages viewed, actions taken, browser/device, and approximate location from IP, via our analytics provider (PostHog).
• Error/diagnostic data — technical error reports via Sentry. We scrub donor and contact personal information from these reports before they are sent.
• Cookies and similar technologies — see Section 6.

3. How we use information

• Provide, operate, and secure the Service and generate decks;
• Create and manage your account and process your subscription and payments;
• Provide support and respond to your requests;
• Send service and transactional messages (verification, billing, deck-ready, account);
• Send marketing emails where you have consented or where permitted by law — you can opt out at any time;
• Understand and improve how the product is used;
• Detect, prevent, and investigate fraud, abuse, and security incidents;
• Comply with legal obligations and enforce our Terms of Service.

4. Legal bases for processing (EU/UK GDPR)

5. How we share information

We do not sell personal information, and we do not shareit for cross-context behavioral advertising (as defined under the CCPA/CPRA). We share information only with:

• Service providers / subprocessors who help us run DonorSpark, each bound by contract. Our current subprocessors are listed at donorspark.app/subprocessors.
• AI processing:to generate personalized deck copy, limited content (which may include a donor’s name when a customer supplies a personalized note) is sent to our AI provider, Anthropic (Claude API). This data is not used to train models and is retained only for limited abuse-detection windows.
• Legal and safety — when required by law or to protect rights, safety, and property.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

6. Cookies and tracking technologies

• Strictly necessary — for authentication and security (set by our auth provider, Clerk). Required for the service to function.
• Analytics — PostHog, to understand product usage. We do not use advertising cookies or third-party ad trackers, and we do not build advertising profiles.

For visitors in the EU/UK/EEA: where required by law, we will not set non-essential (analytics) cookies without your consent, and you can withdraw consent at any time. You can also control cookies through your browser settings.

7. International data transfers

DonorSpark is operated from the United States, and our subprocessors may process data in the United States and other countries. Where we transfer personal information of individuals in the EU/UK/EEA outside their region, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable). You may request a copy using the contact in Section 11.

8. Data retention

• Customer account data — retained while your account is active and for a reasonable period afterward to meet legal, tax, and accounting obligations, then deleted or anonymized.
• Donor/supporter information— retained while the customer’s account is active or until the customer instructs deletion. Anonymous decks expire automatically after 48 hours.
• Analytics and error logs — retained for limited periods (error logs ~90 days, with personal information scrubbed before storage).

9. Your privacy rights

9.1 EU / UK / EEA (GDPR)

If you are in the EU, UK, or EEA, you have the right to:

• Access the personal information we hold about you;
• Rectify inaccurate or incomplete information;
• Erase your information (“right to be forgotten”);
• Restrict or object to certain processing;
• Data portability — receive your information in a portable format;
• Withdraw consent at any time;
• Lodge a complaint with your local data protection authority.

To exercise these rights, contact privacy@donorspark.app. We respond within the timeframes required by law (generally within one month under the GDPR).

9.2 California (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know / Access the categories and specific pieces of personal information we have collected, the sources, purposes, and categories of third parties we disclose to;
• Delete personal information we collected from you;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information;
• Limit the use of sensitive personal information;
• Non-discrimination for exercising these rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.We have not done so in the preceding 12 months. Because we do not sell or share personal information, no “Do Not Sell or Share My Personal Information” opt-out is required; if this changes, we will provide one. We do not collect or use sensitive personal information in a way that triggers the right to limit.

Categories of personal information collected in the past 12 months:

To exercise California rights, contact privacy@donorspark.app. We will verify your request before fulfilling it and respond within 45 days (extendable to 90 where permitted). You may use an authorized agent; we may require proof of authorization. We do not disclose personal information to third parties for their own direct marketing purposes (California “Shine the Light”).

9.3 Donors and supporters

If your information was uploaded to DonorSpark by a nonprofit, that nonprofit is the controller. Please direct access, correction, and deletion requests to the nonprofit. When they instruct us, we will help fulfill your request. If you contact us directly, we will refer you to the relevant nonprofit or forward your request to them.

10. Children’s privacy

DonorSpark is a business tool intended for nonprofit staff and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

11. Security

We use technical and organizational measures including encryption in transit, access controls, scoped credentials, an enforced Content Security Policy, and PII scrubbing in our error logs. No method of transmission or storage is 100% secure, but we work to protect your information and to notify you and authorities of breaches as required by law.

12. Changes to this Policy

We may update this Policy. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you.

13. Contact us

Hall Pass Digital, LLC (DonorSpark)
Privacy contact: privacy@donorspark.app