Privacy Policy

Last updated: [DATE]

GiveFlow (“we”, “us”) is operated by [LEGAL ENTITY NAME], [ADDRESS]. This policy explains what we collect when you use GiveFlow and how we handle it. Questions: .

Who this applies to

Organizations (“customers”) use GiveFlow to manage donated items. Customers decide what goes into their workspace and are responsible for having permission to store it. For information customers enter about their own volunteers and donors, we act as a service provider (processor) on the customer’s behalf.

What we collect

• Account details: your name, email address and a securely hashed password.
• Workspace data: items, donations, drives, packages, assemblies, distributions, volunteer names, hours and (optionally) volunteer email/phone and donor names/emails that your organization enters.
• Technical data: basic logs (IP address, browser type, timestamps) kept by our hosting providers for security and reliability.

GiveFlow is designed not to hold information about the people your organization serves. Distributions record the receiving institution only. Please do not enter names, health information or other personal details of patients, minors or other recipients.

How we use it

• To provide the service: signing you in, storing your records, sending emails you ask us to send (invitations, password resets, donor thank-you receipts).
• To keep the service secure and fix problems.
• To contact account owners about their account, billing and important changes.

We do not sell personal information, use it for advertising, or share it except with the providers below.

Service providers

• Supabase — database and sign-in.
• Cloudflare — website hosting.
• Resend — sending emails.
• [PAYMENT PROVIDER, e.g. Stripe — once billing is enabled]

Who can see your data

Each organization’s data is separated at the database level. Inside an organization, admins see everything; volunteers cannot see volunteer contact details. The optional public donor page shows only item names and quantities still needed for active drives.

Retention and deletion

We keep workspace data while your account is active. Admins can export or erase their organization’s records at any time from Settings. To delete your account entirely, email us and we will do so within [30] days, except where we must keep limited records by law.

Your rights

You can access, correct, export or delete your personal information. If your information was entered by an organization you volunteer with or donated to, please contact that organization first; we’ll help them respond.

Children

GiveFlow accounts are for adults acting on behalf of an organization. [If student volunteers under 18 will have accounts, add your school/parental-consent approach here.]

Security

Data is encrypted in transit, access is controlled by row-level security rules in the database, and passwords are never stored in plain text. No system is perfectly secure; we’ll notify affected customers promptly if a breach affects their data.

Changes

We’ll post updates here and email account owners about material changes.