Privacy Policy

This policy applies to:

• Donors: individuals who link bank accounts and make micro-donations
• Organization administrators: staff who manage a charitable organization account on MicroGive
• Visitors: anyone who browses our website

Information You Provide Directly

• Account information: first name, last name, email address, phone number, and password (stored as a one-way hash; it is never readable by us)
• Organization information: organization name, EIN (tax ID), website, address, contact email and phone

Financial Information (via Plaid)

When you connect a bank account, our bank-linking partner Plaid provides us with your bank account's transaction history (merchant name, amount, date) and a Plaid access token used to retrieve ongoing transactions.

We do not see or store your bank account number, routing number, or login credentials. Your bank credentials are entered directly into Plaid's interface and never pass through our servers. Your Plaid access token is stored encrypted using AES-256-GCM encryption.

Payment Information (via Stripe)

Donation disbursements to organizations are processed via Stripe Connect. We store your Stripe account ID but do not store raw payment card data. All payment data is handled directly by Stripe.

Transaction Data

We store records of transactions used to calculate donation amounts, donation amounts and dates, destination organizations, and donation batch history. This data is retained to support donor tax records and organizational reporting.

Communications

• Email: if you opt in to email marketing, we collect your email address for that purpose
• SMS: if you opt in to text message communications from an organization you support, your phone number is used to send infrequent service-related or organizational updates. Message and data rates may apply. You may opt out at any time by replying STOP.

Automatically Collected Information

When you visit our website, we may collect browser type, device type, IP address, pages visited and time spent (via Google Analytics), and referral source.

We do not sell your personal information.

We share data only with the following third parties, solely to operate the Service:

We may disclose your information if required by law, court order, or to protect the rights and safety of our users or the public.

Why 3 years for donors? Donation records may be needed for tax purposes. Donors may reference transaction history when filing charitable deduction claims, and IRS audit windows typically extend 3 years. We retain this data to protect both donors and the organizations they support.

After the applicable retention period, your data is permanently deleted from our systems.

Regardless of where you live, you may:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated data (subject to retention periods above)
• Withdraw consent for marketing emails or SMS at any time
• Opt out of SMS by replying STOP to any text message

To exercise any of these rights, contact us at privacy@microgive.co.

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following additional rights:

• Right to Know: you may request a list of the personal information we have collected about you in the past 12 months, the categories of sources, and the purposes for collection
• Right to Delete: you may request deletion of your personal information, subject to legal retention requirements
• Right to Opt Out of Sale: we do not sell personal information
• Right to Non-Discrimination: we will not discriminate against you for exercising any CCPA right

Categories of personal information collected:

• Identifiers (name, email, phone, IP address)
• Financial information (transaction history, donation amounts via Plaid)
• Commercial information (donation records)
• Internet activity (usage data via Google Analytics)

To submit a CCPA request, contact us at privacy@microgive.co. We will respond within 45 days.

We implement industry-standard security measures including:

• AES-256-GCM encryption for stored Plaid access tokens
• Bcrypt hashing for passwords (never stored in plaintext)
• HTTPS for all data in transit
• Access controls limiting who can access production data

No method of transmission or storage is 100% secure. In the event of a data breach affecting your rights, we will notify you as required by applicable law.

The Service is not directed to individuals under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us data, contact us and we will delete it promptly.

We may update this policy as our practices evolve. We will notify you of material changes via email or a notice on the platform. The "Last Updated" date at the top reflects the most recent revision. Continued use of the Service after changes constitutes acceptance.

This policy is governed by the laws of the State of Texas, United States, without regard to conflict-of-law principles.

For privacy questions, data requests, or to exercise your rights:

Christian Esqueda, dba MicroGive
Email: privacy@microgive.co