This policy explains how Auradonors, LLC ("Auradonors", "we") handles personal information through auradonors.com, the Auradonors application, the public event pages organizations publish with it, and our documentation sites.

1. Who is responsible for what

Your account and our website. We are responsible for the information about the people who use Auradonors, and about visitors to our website.
Donor data. The organization that uses Auradonors is responsible for the information it keeps about its donors, contacts, event registrants and guests. We process that information on the organization's behalf and only on its instructions, under our agreement with it. If you are a donor, contact the organization about your information; we will help it answer you.

2. What we collect

Account information: your name, email address, organization and role, and security records of sign-ins and two-factor verification, which include the IP address and browser used.
Records your organization keeps: contacts, gifts, orders, recurring gifts, events, notes and files, as entered or imported by your organization.
Event registrations: what a person enters when registering on an organization's public event page: name, email, phone, the answers the organization asks for, and guests' names. Card and bank details are entered in the payment processor's own secure fields and never reach our servers; we keep only the last four digits, card brand, expiry date and the processor's reference.
Agreements signed with us: when a customer's representative signs an agreement with Auradonors on our signing page, their name, title and email address, the IP address and browser used, and the time of each step: opening the link, confirming a one-time code, opening each document and signing. We keep the documents as they were sent and as they were signed.
Website forms: the name, email, organization and message you send through our contact or referral form. They are emailed to our team, not stored in a database.
Technical information: a record of when each user was last active, and error reports when something goes wrong. Error reports can include the signed-in user's id, the page address and short log lines, which occasionally contain an email address. They never include passwords, integration keys or the contents of a form. We do not track the pages you visit and use no analytics or advertising tools.

3. How we use it

To provide the service, keep it secure, and give support when you ask for it.
To send account email: sign-in codes, password resets, invitations and alerts you set up.
To send product announcements to users, which each person can turn off.
To reply to messages from our website forms.
To keep a record of agreements signed with us, as evidence of what was signed, by whom and when.

We do not sell or share personal information, including for advertising. We do not use donor data for any purpose other than providing the service to the organization it belongs to. We do not send customer data to artificial intelligence services, and we do not use it to train any model.

4. Where data is stored

Data is stored in the United States, in our hosting provider's data centers in New York. An organization that chooses to host its own database keeps its data on its own server; our application, which runs in the United States, connects to it.

5. How we protect it

Each organization's data is kept in its own database, separate from every other organization's.
Every connection is encrypted in transit. Data at rest is encrypted by our hosting provider, and two-factor secrets and registration links are also encrypted by the application.
Integration keys, such as an organization's payment processor key, are restricted to its administrators and are never shown in full, even to them.
Two-factor sign-in is required for every user. Access within an organization is controlled by role-based permissions.
Changes to records are kept in an audit history the organization's administrators can read.
Our staff sign in as one of your users only to give support you ask for, or to keep the service running. Every such session is recorded and visible to your administrators.
Our hosting provider backs up databases automatically. An organization that hosts its own database is responsible for its own backups.

If we become aware of a security incident affecting personal information, we investigate, contain it, and notify affected organizations without undue delay. We do not hold SOC 2, ISO 27001, HIPAA or similar certifications, and we do not claim to.

6. Service providers

We use a small number of providers to run the service, such as hosting, email delivery and error monitoring. They are listed, with what each receives, on our sub-processors page.

Organizations can also connect their own accounts with other services, such as a payment processor (Stripe or Authorize.Net), shipping (ShipStation), sales tax (Avalara), an email list (Mailchimp) or their own systems. When they do, we send those services the information each needs, on the organization's instruction, and the organization's agreement with that service governs it.

7. How long we keep it

For as long as an organization's subscription is active.
After a subscription ends, we provide a complete export on request for 90 days, delete the organization's data within 30 days after that, and confirm the deletion with a certificate. Copies in our providers' backups, logs and email records expire within 90 days of the deletion.
Stored copies of emails sent to donors are kept for 24 months by default; each organization can change this.
Emails from our website forms are kept in our support mailbox for as long as we need them to reply and for our records.
The record of an agreement signed with us — the documents and the record of how they were signed — is kept for the life of the agreement and seven years after it ends. It can't be changed in that time.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict how we use it, and to withdraw consent. Users can turn off product announcements at any time. Email [email protected] to make a request; we confirm who you are, then answer within 30 days. Donors should contact the organization that holds their information, as in section 1.

If you are in the European Union or the United Kingdom, we rely on our contract with your organization to provide the service, on our legitimate interest in keeping it secure and telling users about it, and on consent where we ask for it. You may also complain to your data protection authority. Residents of Canada may contact us at the same address.

9. Cookies and browser storage

We use only what the service needs to work:

A sign-in cookie, and short-lived cookies used during two-factor sign-in.
A trusted-device cookie that lasts up to 90 days, only if you choose to remember a device.
A security cookie that protects forms, and a cookie and browser setting that remember dark mode.
On the door check-in page, the check-in link is kept in that browser tab's storage.

Our public event pages set no cookies of their own. On their checkout, the payment processor's secure fields set the processor's own cookies to prevent fraud, and a bot check from Cloudflare may run on our forms. We use no tracking or advertising cookies.

10. Children

Auradonors is for organizations and is not directed to children. Organizations may keep information about minors, such as a child registered as an event guest, and are responsible for obtaining any consent required.

11. Changes to this policy

We update this policy when what we do changes, and change the date at the top. We email organizations about material changes before they take effect.

12. Contact

Auradonors, LLC, [email protected].

Privacy policy