Privacy Policy

Who we are and our roles

Causefolk, at causefolk.com, is provided by Causefolk LLC (“we”, “us”). This policy explains what personal data the service handles, why, who we share it with and the choices you have.

Organizations use the service to manage their volunteers. For the data an organization and its volunteers enter, the organization is the controller: it decides what to collect and why. We are its processor and handle that data only on its instructions.

We are the controller for platform accounts (the staff who sign in to run an organization), for billing, and for the “My volunteering” page, which shows a volunteer their activity with each organization they volunteer with.

What we collect

About organization staff:

• their email address;
• their sign-in account and the one-time sign-in codes we send them;
• their notification preferences;
• a mobile number, if they verify one to receive texts.

About volunteers, what they or the organization enter:

• name, email address and phone number;
• a mobile number for texts, with the record of their consent;
• answers to application questions, the documents they upload, the agreements they accept, and the organization’s decision and notes on their application;
• signups, attendance and hours, including the names of any guests a volunteer brings, who may not be volunteers themselves;
• background-check status, result, adjudication and assessment, where the organization uses background checks;
• their date of birth, when a waiver needs to know whether a parent or guardian must sign too;
• the details a volunteer may add to their profile, each optional: an emergency contact (name, relationship and phone number), a postal address, their skills and the times they are usually free;
• the organization’s own records about a volunteer, which the volunteer does not see: the notes its staff write, the tags they add and the status they set (active, inactive or archived);
• the waivers they sign, the trainings they complete and the certifications they upload, each with its evidence: the name they typed, the time, the IP address and the browser;
• for a minor, the consent of a parent or guardian: the guardian’s name, email address and relationship, and the guardian’s signature with the same evidence;
• their preferred language;
• if they sign in, a sign-in account keyed by their email address and the one-time codes we send them, and the private link of their calendar feed if they use one.

From the device:

• the IP address, used for rate limiting and to prevent abuse;
• when a page shows a form protected against bots, the browser contacts Cloudflare, and the IP address is sent to Cloudflare when the form is verified;
• the browser’s location, only when a volunteer taps “I’m here” to check in: it is compared once with the check-in point and never stored;
• when a volunteer turns on notifications on a device, that device’s push subscription: the address the browser’s push service gives for it (the endpoint) and its encryption keys, with a short summary of the device, such as “Chrome on Mac”; it is removed when they turn notifications off on that device, or when the browser or its push service reports that the device is gone;
• cookies: the sign-in session and the “lang” cookie that remembers the chosen language for 365 days; on a page with a protected form, Cloudflare may set its own cookie.

Message logs: the emails and texts we send, with their addresses and content, kept as part of the organization’s records.

About the platform:

• billing records, through Stripe; we never see card numbers;
• for webhooks, the ids and statuses of deliveries and a short excerpt of the receiver’s reply, and when each API key was last used; never the payloads we send;
• rate-limit counters, keyed by an IP address, email address, phone number or account id;
• a platform-wide list of mobile numbers that replied STOP, so that no organization texts them until they reply START.

How we use it

We use personal data to:

• run the service: publish opportunities, take signups and applications, schedule shifts and record attendance and hours;
• send the emails and texts that organizations, staff and volunteers expect, such as confirmations, reminders and waitlist offers;
• sign people in and keep accounts secure;
• prevent spam, abuse and fraud, including through rate limits and bot protection;
• bill organizations and keep billing records;
• deliver the webhooks and answer the API requests an organization sets up;
• support organizations, and fix and improve the service.

We do not sell personal data, and we do not use it for advertising.

Legal bases

Where the law requires a legal basis for the data we handle as controller, we rely on:

• contract: to provide the service to organizations and their staff;
• legitimate interests: to keep the service secure, prevent abuse and improve it;
• consent: for texts, and for the use of a browser’s location at check-in;
• legal obligation: to keep billing records for tax and accounting.

For the volunteer data an organization enters, the organization chooses its own legal basis and is responsible for it.

Sharing and subprocessors

We share personal data with the providers that run the service for us, as much as each one needs:

• Supabase: database, authentication and file storage;
• Vercel: hosting;
• Resend: email delivery.

When these features are enabled for the service:

• Stripe: billing;
• Twilio: text messages;
• Cloudflare: bot protection on forms;
• Checkr: background checks; Checkr acts for the organization, which connects its own Checkr account;
• the push services of the browser makers (Apple, Google and Mozilla): when a volunteer has turned on notifications on a device, each notification goes to that browser through its maker’s push service, encrypted so that the push service cannot read it.

An organization can also send its data to its own systems through the webhook receivers and API consumers it chooses. How those systems handle the data is the organization’s responsibility.

We do not sell personal data and we do not share it for advertising. We may disclose data when the law requires it.

Retention

We keep:

• organization data, including volunteer records, guests’ names, applications with their documents, decisions and accepted agreements, and message logs, while the organization exists: until an owner deletes the organization in Settings → Data, it asks us to delete the data, or we delete the organization;
• background-check records, with their status, result, adjudication and assessment, as long as the volunteer record they belong to;
• sign-in accounts and calendar-feed links, which may span several organizations, until their holder deletes the account in “My volunteering” or asks us to delete them (an organization can ask us to remove its volunteers’ access to it);
• a volunteer record the organization deletes: the volunteer’s personal details are erased at once, while the shifts they attended, their hours, and the waivers and consents they signed stay with the organization’s records, without their name on the shifts and hours;
• records of volunteer activity used for staff notifications, 30 days;
• webhook events and deliveries, 30 days;
• rate-limit counters, keyed by an IP address, email address, phone number or account id, about 24 hours;
• an uploaded document that is not attached to an application, 24 hours;
• a data export an organization’s owner creates, 7 days after it is ready, or until the organization is deleted if that comes first;
• an organization whose owner asks us to delete it, 14 days after the request, unless an owner cancels before then; its data, uploaded documents and exports are then deleted;
• a record that an organization was deleted (its name and web address, its owners’ email addresses, its member and volunteer counts and its billing customer reference), 7 years;
• the language cookie, 365 days;
• a number on the text opt-out list, until it replies START, even after the organization that texted it is deleted;
• billing records, as long as the law requires;
• sign-in and authentication logs, as long as our authentication provider, Supabase, keeps them by default.

A link that opens an uploaded document is valid for 600 seconds.

After data is deleted, copies of it remain in our hosting provider’s backups for a limited period, until those backups expire.

Security

We protect personal data with:

• HTTPS for all traffic;
• API keys stored only as a hash;
• Checkr keys and webhook signing secrets encrypted at rest;
• row-level isolation in the database, so one organization cannot read another’s data;
• private uploaded documents, opened only through short-lived signed links;
• access to production data limited to the few of our staff who need it.

No method of transmission or storage is completely secure, but we work to protect the data we hold.

Your rights

If you volunteer with an organization, ask that organization first about your data: it is the controller, and we help it answer.

You can also download your data from your profile in its portal (“Your data”) and ask it to delete your record there; the organization decides. When it deletes your record, your name, contact details, applications and messages are erased; the shifts you attended and your hours stay as “Deleted volunteer”, and the waivers and consents you signed stay with the organization’s records. Copies the organization already sent to its own systems, such as a CRM, or that a background-check provider holds, are the organization’s to handle.

If you hold a sign-in account for “My volunteering”, you can delete your sign-in account yourself in “My volunteering” (“Your account”); your volunteer records stay with each organization.

If you hold a platform account, write to us at support@causefolk.com. If you hold a sign-in account for “My volunteering”, you can also write to us directly at that address about that account.

Depending on where you live, you may have the right to:

• access your data;
• correct it;
• delete it;
• receive it in a portable form;
• object to some uses of it.

An organization’s owners can download a full export of its data, including application answers, uploaded documents and message logs, and delete the organization, in Settings → Data. While an organization is open, it can also export its records through the API: volunteers, opportunities, shifts, signups, application status, hours and background-check status. Application answers, uploaded documents and message logs are not included in the API, and a closed organization’s API keys stop working; an organization that cannot use Settings → Data can ask us at support@causefolk.com.

You may also complain to a supervisory authority where one exists for you.

Children

The service is not directed at children under 13.

Each organization decides whether minors may volunteer with it, and is responsible for obtaining any consent from a parent or guardian that the law requires.

International transfers

The service is hosted in the United States. An organization outside the United States that uses the service accepts that its data, and its volunteers’ data, are transferred to and processed in the United States.

Changes to this policy

We may update this policy. When we do, we change the date at the top of this page. The updated policy applies from that date.

Contact

For questions about this policy or your data, write to support@causefolk.com.

Our postal address is Causefolk LLC, TBD.