GiveForms Privacy Policy

GiveForms, Inc. ("GiveForms," "we," "us," or "our") operates a donation infrastructure platform for enterprise nonprofits. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our platform, website at giveforms.com, and related services (collectively, the "Services").

By using our Services, you agree to the collection and use of information as described here. If you're a nonprofit using GiveForms to collect donations, you are also subject to our Data Processing Agreement, which governs your obligations to your donors.

1. Information We Collect

From nonprofit customers (organizations)

When you create an account or request access, we collect:

• Organization name, address, EIN/tax ID, and contact information
• Account credentials and billing information (processed via Stripe; we do not store raw card data)
• Usage data, including login history, feature usage, and API activity
• Configuration data, donation form content, and campaign settings

From donors (individuals making donations)

When a donor completes a transaction through a GiveForms-powered form, we collect on behalf of the nonprofit:

• Name, email address, phone number, and mailing address
• Payment information (processed by Stripe or PayPal; PCI-DSS Level 1 compliant)
• Donation amount, frequency, designation, and transaction history
• Dedications, tribute information, and custom form responses
• Browser type, device, IP address, and session metadata for fraud detection

Automatically collected data

• Cookies, local storage, and session tokens for authentication and session management
• UTM parameters, referral sources, and Google Analytics events (form views, donation completions)
• Performance telemetry, error logs, and load times

2. How We Use Information

We use the information we collect to

• Operate, maintain, and improve the GiveForms platform
• Process and settle donations on behalf of nonprofit customers
• Generate receipts, tax acknowledgment emails, and donor communications
• Provide insights dashboards, conversion analytics, and A/B test reporting
• Detect and prevent fraud, chargebacks, and unauthorized transactions
• Sync donor data to connected integrations (Salesforce, Zapier, API) as configured by the nonprofit
• Send transactional and product communications to nonprofit account holders
• Comply with legal obligations, including financial reporting and tax regulations

We do not sell donor personal information. We do not use donor data to serve advertising. Donor data collected through GiveForms-powered forms belongs to the nonprofit, not to GiveForms.

3. Data Sharing & Disclosure

With your authorization. Nonprofits configure integrations (Salesforce, Zapier, REST API, 360MatchPro). Data is shared with those services only as directed by the nonprofit's configuration.

Service providers

We engage subprocessors to operate the platform, including:

• Stripe and PayPal — payment processing
• Postmark — transactional email delivery
• Plaid — ACH bank account verification
• 360MatchPro / Double the Donation — corporate gift matching
• AWS — cloud infrastructure and data storage

All subprocessors are bound by data processing agreements and are prohibited from using your data for their own purposes.

Legal requirements. We may disclose information if required by law, subpoena, court order, or to protect the rights, property, or safety of GiveForms, our customers, or the public.

Business transfers. In the event of a merger, acquisition, or sale of assets, data may be transferred as part of that transaction. We will provide notice before donor or customer data becomes subject to a different privacy policy.

4. Data Retention

We retain nonprofit customer data for the duration of the contract and for a period of 7 years thereafter, consistent with financial record-keeping requirements.

Donor transaction records are retained for 7 years from the date of transaction to support nonprofit tax and audit obligations. Donors may request deletion of non-transactional personal data (e.g., email address, mailing address) by contacting the nonprofit directly or emailing privacy@giveforms.com.

Abandoned form data (partially completed donation sessions) is retained for 90 days and used solely for donor recovery communications authorized by the nonprofit.

5. Security

GiveForms maintains enterprise-grade security infrastructure:

• SOC 2 Type II (in progress) — controls for security, availability, and confidentiality
• PCI-DSS Level 1 compliant — the highest tier of payment card industry compliance
• TLS 1.2+ encryption in transit; AES-256 encryption at rest
• Role-based access controls, audit logging, and multi-factor authentication
• Continuous monitoring and automated fraud detection

No system is impenetrable. In the event of a data breach affecting your data, we will notify you in accordance with applicable law and our security incident response procedures.

6. Cookies & Tracking

We use cookies and similar tracking technologies to authenticate sessions, remember preferences, and analyze platform performance. Donation forms use session storage to preserve form state and reduce abandonment.

Third-party analytics (e.g., Google Analytics) may be enabled by nonprofits on their own donation pages. In that case, data is subject to Google's privacy policy. We pass only anonymized event data (form views, donation completions) to analytics providers.

You may disable cookies in your browser settings. Disabling cookies may impact platform functionality for nonprofit administrators.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate information
• Request deletion of non-transactional personal data
• Object to or restrict certain processing
• Data portability in a machine-readable format

Nonprofit customers may exercise these rights through their account settings or by contacting privacy@giveforms.com. Donors should contact the nonprofit directly; GiveForms will assist the nonprofit in responding to such requests.

California residents: GiveForms does not sell personal information as defined under the California Consumer Privacy Act (CCPA). For CCPA inquiries, contact privacy@giveforms.com.

8. Children’s Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal information, we will delete it promptly.

9. International Data Transfers

GiveForms operates in the United States. If you are located outside the United States, your data may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Services, you consent to this transfer.

For European customers, we rely on Standard Contractual Clauses (SCCs) as the legal mechanism for international data transfers.

10. Changes To This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify nonprofit account holders by email and update the effective date at the top of this page. Continued use of the Services after the effective date constitutes acceptance of the updated policy.