Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect:

• Name and email address
• Organization name and details
• Charitable registration number
• Organization address

Donor Data

When you connect your donation management system (such as Spektrix), we sync:

• Donor names and contact information
• Donor addresses
• Donation history (amounts, dates, funds)
• Donation payment methods (type only, not card details)

Payment Information

Subscription payments are processed by Stripe. We do not store credit card numbers or banking details on our servers. Stripe's privacy policy governs their handling of payment information.

Usage Information

We automatically collect:

• Log data (IP address, browser type, pages visited)
• Device information
• Feature usage patterns

2. How We Use Information

We use the information we collect to:

• Generate documents: Process patron and donor data to create tax receipts, acknowledgment letters, and other official documents
• Deliver communications: Send documents and communications to patrons via email or other channels
• Operate the service: Manage your account and process subscription payments
• Improve the service: Analyze account and usage data to enhance features and performance. We do not use donor data for service improvement or analytics; donor data is processed solely to provide the Service to your organization, as described in our Data Processing Addendum
• Provide support: Respond to your questions and troubleshoot issues
• Communicate: Send service announcements, security alerts, and product updates
• Comply with legal obligations: Meet regulatory requirements and respond to legal requests

3. Data Sharing

Our Role for Donor Data

We process donor data solely on behalf of, and as a service provider to, the organization that uses PatronSend. Our obligations for donor data are set out in our Data Processing Addendum.

Third-Party Service Providers

We share data with trusted service providers who help us operate PatronSend:

• Amazon Web Services (AWS): Cloud hosting, file storage, and compute
• Clerk: Authentication and user management
• Datadog: Application monitoring and error tracking
• Inngest: Background job processing and workflow orchestration
• Neon: Serverless database hosting
• Resend: Transactional email delivery
• Spektrix: Integration for syncing donation data (when you connect your account)
• Stripe: Payment processing
• Upstash: Caching and rate limiting

We Do Not Sell Your Data

We do not sell, rent, or trade your personal information or your donors' information to third parties for marketing purposes.

Legal Requirements

We may disclose information if required by law, court order, or government request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers

If PatronSend Technologies Inc. is acquired or merged with another company, your information may be transferred. We will notify you of any such change and any choices you may have regarding your information.

4. Data Storage & Security

Where We Store Data

Your data is stored on secure servers hosted by Amazon Web Services (AWS). Primary processing occurs in the United States. For customers in New Zealand, a backup copy of issued receipt documents is replicated to the AWS Asia Pacific (New Zealand) Region (Auckland). A current list of our service providers and processing locations is set out in our Data Processing Addendum.

We use industry-standard security measures including:

• Encryption in transit (TLS/HTTPS)
• Encryption at rest
• Regular security audits
• Access controls and authentication
• Regular backups

Your Responsibility

You are responsible for maintaining the security of your account credentials and for any activity that occurs under your account. Please use a strong password and do not share your login information.

5. Data Retention

Official Document Records

We retain tax receipt records and other official documents for the period required by applicable law in your jurisdiction:

• Canada: Minimum seven (7) years per Canada Revenue Agency (CRA) requirements
• Australia: Minimum five (5) years per Australian Taxation Office (ATO) requirements
• New Zealand: Minimum seven (7) years per Inland Revenue (IRD) requirements
• United States: Minimum seven (7) years per IRS requirements
• United Kingdom: Minimum six (6) years per HMRC requirements

This includes issued document numbers, amounts, recipient information at time of issuance, and authorization records.

In practice, we retain issued documents and their associated records for a minimum of ten (10) years from issuance, and after your subscription ends they remain available to your organization through read-only archive access as described in our Terms of Service.

Account Data

We retain your account information for as long as your account is active, including any read-only archive period following cancellation. If you ask us to close and delete your account entirely, we will delete or anonymize personal information within 90 days, except for issued document records (which are retained as described above unless you instruct deletion consistent with your legal retention obligations) and information we are required to retain by law.

Audit Logs

System audit logs are retained for a minimum of two (2) years to maintain security and support compliance requirements.

6. Your Rights

You have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Export: Request a portable copy of your data
• Withdraw consent: Withdraw consent for optional data processing

To exercise these rights, contact us at support@patronsend.com. We will respond to your request within 30 days.

Donor Rights

Donors whose information is processed through PatronSend should contact the organization that issued their tax receipt to exercise their privacy rights. Organizations using PatronSend are responsible for responding to donor requests regarding their data.

7. Cookies & Tracking

Essential Cookies

We use essential cookies required for the service to function, including:

• Authentication cookies to keep you signed in
• Session cookies to maintain your preferences
• Security cookies to protect against threats

Analytics

We may use analytics services to understand how users interact with PatronSend. This helps us improve the service. You can opt out of analytics tracking through your browser settings or by contacting us.

Do Not Track

We respect browser Do Not Track (DNT) signals and do not track users who have enabled this setting.

8. Children's Privacy

PatronSend is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

9. International Data & Jurisdiction

Data Processing Locations

PatronSend operates globally and may process your data in different countries depending on your organization's location and the services you use. Our primary data processing occurs in the United States, and for New Zealand customers, a backup copy of issued receipt documents is stored in New Zealand.

Cross-Border Transfers

When we transfer personal data across borders, we ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

Jurisdiction-Specific Rights

Depending on your location, you may have additional rights under local privacy laws:

• Australia: Rights under the Privacy Act 1988 and Australian Privacy Principles (APPs)
• Canada: Rights under PIPEDA (Personal Information Protection and Electronic Documents Act) and applicable provincial privacy laws
• New Zealand: Rights under the Privacy Act 2020 and its Information Privacy Principles
• United Kingdom: Rights under UK GDPR and the Data Protection Act 2018
• European Union: Rights under the General Data Protection Regulation (GDPR)

To exercise jurisdiction-specific rights, please contact us at support@patronsend.com with details of your request and your location.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will also send you an email notification.

For material changes, we will provide at least 30 days' email notice before the changes take effect. Your continued use of PatronSend after a change takes effect constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: support@patronsend.com
• Mail: PatronSend Technologies Inc., Attention: Privacy Team