Givebutter Privacy Policy

1. Introduction and Scope.

Givebutter, Inc. (“Givebutter,” “Company,” “we,” “us,” or “our”) operates the Site and Services (as defined in our Terms of Service). This Privacy Policy describes how we collect, use, disclose, and otherwise process personal information when you visit the Site, create an account, make a donation, use the Services, or otherwise interact with us. Any capitalized terms used but not separately defined in this Privacy Policy have the meanings given to them in the Terms of Service.

This Privacy Policy applies to personal information for which Givebutter acts as the controller (for which it determines the means and purposes of processing), including information collected from: (a) unregistered Users; and (b) registered Users with respect to their own personal data.

When Fundraisers upload or import third-party personal data into the Givebutter Services (for example, imported contacts or offline donation histories), the Fundraiser is the controller of that data and Givebutter processes it as a service provider under our Data Processing Addendum. This Privacy Policy does not govern such imported data.

These privacy practices should be read together with our Terms of Service, our Data Processing Addendum, and our AI Addendum, each of which is incorporated by reference. If you have questions, contact us at support@givebutter.com.

2. Changes to This Privacy Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will revise the “Effective Date” at the top of this Privacy Policy and post the updated version on the Site.

If we make material changes to this Privacy Policy, we will provide notice through reasonable means, which may include posting a prominent notice on the Site or, where we have your email address and it is appropriate under the circumstances, sending you an email notification prior to the changes taking effect.

Your continued use of the Services after the updated Privacy Policy becomes effective constitutes your acceptance of the revised Privacy Policy. If you do not agree with any changes, you should discontinue your use of the Services. We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your personal information.

3. Information We Collect and How We Use and Disclose It.

We collect personal information from and about you when you visit our Site, create an account, make a donation, use our Services, or otherwise interact with us. The table below summarizes the categories of personal information we collect, the sources, the purposes for processing, and the categories of third parties to whom we disclose it, and is accurate with respect to such practices over the preceding 12 months.

4. Cookies, Analytics, and Advertising Technologies.

When you visit or interact with our Site and Services, we and our third-party partners use cookies, pixels, web beacons, and similar tracking technologies to collect information about your browsing activity, preferences, and device. These technologies help us operate the Services, remember your preferences, analyze usage patterns, and deliver relevant advertising.

Our Site provides a cookie consent banner that allows you to accept or deny non-essential cookies when you first visit. You may also manage your cookie preferences at any time through your browser settings by disabling or deleting cookies. Please note that disabling certain cookies may affect the functionality of the Services.

We use analytics tools, including Google Analytics, to understand how Users interact with the Services. These tools collect information such as IP address, browser type, pages visited, and time spent on pages. You can learn more about Google Analytics and opt out by visiting Google’s opt-out page at https://tools.google.com/dlpage/gaoptout.

We work with third-party data partners who may use cookies, pixels, or similar technologies to connect information about you collected from our Site with information they have about you based on your online activities across other websites. This may include matching your personal information with your email or home address. We or our service providers may then use this combined information to send marketing communications to your email or home addresses. You may opt out of this by visiting https://app.retention.com/optout.

For information about opting out of targeted advertising and the sale or sharing of personal information, see Section 5 (Selling and Sharing of Personal Information).

Do Not Track & Global Privacy Controls

Your browser settings may allow you to transmit a “do not track” signal, “opt-out preference” signal, or other mechanism for exercising your choice regarding the collection of information about you when you visit various websites.

Our website recognizes the Global Privacy Control (GPC) signal which enables you to opt out of certain uses or disclosures of information about you. If you notify us of your preference through GPC, we will honor your request only for the browser or device that sends the GPC signal. When you log into your account, the opt out will extend to your account as well. If you do not have an account or are not logged into your account, your request to opt out through the GPC will not apply to any account information. To learn more about Global Privacy Control, you can visit https://globalprivacycontrol.org or https://innovation.consumerreports.org/data-rights-protocol-and-global-privacy-control/.

5. Selling and Sharing of Personal Information.

We do not sell your personal information in the traditional sense of exchanging it for money. However, certain data-sharing practices, such as sharing identifiers and internet activity information with advertising and marketing partners for targeted advertising purposes, may constitute a “sale” or “sharing” under the California Consumer Privacy Act (“CCPA”) and similar state privacy laws. You have the right to opt out of such selling and sharing under the CCPA and other U.S. privacy laws.

The following table describes the categories of personal information that have been sold or shared in the preceding 12 months under applicable law, or otherwise disclosed/processed for targeted advertising purposes.

We do not knowingly sell or share the personal information of individuals under 16 years of age.

You may opt out of the sale or sharing of your personal information through any of the following methods (i) by submitting your request to support@givebutter.com, (ii) by using the Global Privacy Control as noted in the Do Not Track & Global Privacy Controls section above or, (iii) via the following form: Do Not Sell or Share My Personal Information.

6. Artificial Intelligence and Automated Processing.

Givebutter uses artificial intelligence and machine learning in the following ways:

1. Homegrown Predictive Models: Givebutter develops its own predictive models using aggregated data derived from platform activity. Join keys such as account IDs may be used to assemble training datasets but are removed before model training and are not used by or accessible to the models. These models do not use donor names, emails, or other direct identifiers or personal information. No data is shared with third-party model providers for these features.
2. Commercial AI-Powered Features: Certain features (such as campaign content generation, contact summaries, smart filters, custom reports, receipt matching, and check acceptance) are powered by third-party AI model providers, including Anthropic, Google, and OpenAI. When you use these features, data related to the feature’s function (which may include personal information such as names, email addresses, giving history, and contact details) is transmitted to the applicable provider. Our agreements with these providers are designed to prohibit the use of data submitted through our platform for training their models.
3. AI Connectors (MCP Server): Fundraisers may connect their Givebutter account to external AI platforms (such as ChatGPT or Claude) using our MCP server. When enabled, data from the Fundraiser’s account (excluding banking data) may be accessed by the connected platform. The Fundraiser is solely responsible for reviewing the external platform’s terms and privacy practices. We collect metadata about these connections (such as which user connected and connection timestamps).
4. AI Infrastructure Services: We use AI infrastructure and observability tools (such as Braintrust) that log requests to and responses from AI model providers for quality monitoring and performance evaluation. These logs may contain personal information where applicable. We will take reasonable steps to seek contractual commitments from these service providers to restrict the use of your data for AI model training; however, in some cases, your data may be used for AI model training.
5. Internal AI Tools: We use internal tools with AI or machine learning capabilities (such as analytics platforms, customer support tools, and business intelligence software) that may process personal information in the course of platform operations, support, and analytics. We will take reasonable steps to seek contractual commitments from these service providers to restrict the use of your data for AI model training; however, in some cases, your data may be used for AI model training.
6. Fraud Prevention: We may use AI-based tools to review transactions, detect fraud, and assess risk. These reviews may process personal information but are not visible to end users. We will take reasonable steps to seek contractual commitments from these service providers to restrict the use of your data for AI model training; however, in some cases, your data may be used for AI model training

For more information about how AI features work, what data they use, and your choices, please refer to our AI Addendum, which is incorporated into our Terms of Service.

Givebutter does not collect, use, or sell personal data for the purpose of training large language models.

7. Retention of Personal Information.

We retain your personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy. When determining retention periods, we consider the following factors:

• Whether we need the information to continue providing the Services;
• Legal, regulatory, tax, accounting, and financial reporting obligations;
• Dispute resolution and the enforcement of our agreements;
• Fraud prevention and the safety and security of the platform.

8. Your Choices and Access.

You have several choices regarding the personal information we collect and how it is used.

8.1 Support. You may submit requests to access, correct, or delete your personal information by contacting support@givebutter.com. We will use commercially reasonable efforts to respond within the timeframes required by applicable law.

8.2 Fundraiser-Imported CRM Data. If your request concerns personal information that a Fundraiser imported into the Givebutter CRM, we will redirect your request to the applicable Fundraiser, as the Fundraiser is the controller of that data. We will assist the Fundraiser in responding to your request as required by our Data Processing Addendum.

8.3 Marketing Communications. You may opt out of promotional emails by clicking the “unsubscribe” link included in each message. Even after opting out, you will continue to receive transactional and service-related communications (such as donation receipts and account notifications). To opt out of text message marketing, reply STOP to any promotional message.

8.4 Stripe Identity Data. If you completed identity verification through Stripe Identity and wish to delete your verification data from Stripe’s servers, or to revoke any consent you gave Stripe to use your data to improve its biometric verification technology, you may contact Stripe directly at https://support.stripe.com. We will also redact the verification session on our end upon request.

9. Additional Information for California Residents.

This section applies to California residents and supplements the rest of this Privacy Policy. Terms used in this section have the meanings given to them in the CCPA.

We only use and disclose sensitive personal information for the purposes permitted under the CCPA.

Categories of Personal Information Collected, Disclosed, Sold, and Shared in the Preceding 12 Months:

Your Rights Under the CCPA. Subject to applicable exceptions, California residents have the right to:

1. Know what personal information we have collected, used, disclosed, sold, or shared about you in the preceding 12 months and the third parties to whom we generally disclose personal information to.
2. Delete personal information we have collected from you, subject to certain exceptions.
3. Receive a copy of personal information we process about you in a structured, commonly used, and machine-readable format, and request that we transmit it to a third party where technically feasible.
4. Correct inaccurate personal information we maintain about you.
5. Opt out of the sale or sharing of your personal information for targeted advertising purposes.
6. Non-discrimination for exercising any of these rights.

Verification. When you submit a request to know, delete, or correct, we will verify your identity by matching information you provide with information we already maintain. We may ask you to confirm your email address or provide other identifying details.

Authorized Agents. You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide written authorization from you and may still verify your identity directly.

Appeals. If we deny your request, you may appeal by contacting us at support@givebutter.com. We will respond to appeals within the timeframes required by applicable law.

Additional California Privacy Rights

In addition to those rights set forth in the your California privacy rights described above (as applicable), California law also permits residents to request certain details about how their “personal information” (as defined in California Civil Code Section 1798.83) is shared with third parties for their direct marketing purposes. We may from time to time elect to share certain personal information about you with third parties for those third parties’ direct marketing purposes. Residents may, under certain circumstances, obtain the categories of personal information shared and the names and addresses of all third parties that received personal information for their direct marketing purposes during the immediately prior calendar year. To make such a request, please contact us using the information listed below. Please note that we are only required to respond to one request per resident each year.

10. Additional Information for Residents of Other U.S. States.

If you are a resident of Colorado, Connecticut, Montana, Oregon, Texas, Virginia, Utah, or another state with an applicable consumer data protection law, you may have rights regarding your personal information. Depending on your state of residence, these rights may include:

1. The right to confirm whether we are processing your personal information.
2. The right to access your personal information.
3. The right to correct inaccuracies in your personal information.
4. The right to delete your personal information.
5. The right to obtain a portable copy of your personal information.
6. The right to opt out of targeted advertising.
7. The right to opt out of the sale of your personal information.
8. The right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise any of these rights, please see the Your Choices and Access section above. We will respond within the timeframes required by applicable law. If we decline your request, you may appeal that decision by submitting an appeal to support@givebutter.com.

Where required by applicable law, we obtain consent before collecting, processing, disclosing or selling sensitive personal data.

Nevada Residents: Under Nevada Revised Statutes Chapter 603A, Nevada residents may opt out of the sale of certain covered information that we have collected or will collect. To submit such a request, please contact us at support@givebutter.com.

11. Additional Information for Individuals in the EEA and United Kingdom.

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), the following information applies to you.

Legal Bases for Processing. We process your personal information only where we have a valid legal basis, including: (a) your consent; (b) performance of a contract to which you are a party or to take steps at your request prior to entering into a contract; (c) compliance with a legal obligation to which we are subject; and (d) our legitimate interests, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include operating and improving the Services, fraud prevention, platform security, and direct marketing.

Your Rights. Subject to applicable law, you may have the right to access, rectify, erase, restrict processing of, or port your personal information, as well as the right to object to processing and to withdraw consent at any time. To exercise any of these rights, contact us at support@givebutter.com.

Data Transfers. Givebutter’s servers are located in the United States. If you are located in the EEA or UK, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Services, you consent to this transfer and processing. We take reasonable steps to ensure your personal information receives an adequate level of protection in the jurisdictions in which we process it.

Complaints. If you believe we have not adequately addressed a concern, you have the right to lodge a complaint with your local data protection supervisory authority.

12. Accuracy, Information Security, and Children’s Privacy.

12.1 Accuracy of Personal Information. We take reasonable steps to keep the personal information we hold accurate, complete, and up to date. If you believe that any personal information we maintain about you is inaccurate or incomplete, please contact us at support@givebutter.com or update your information through your account settings. We will make commercially reasonable efforts to correct verified inaccuracies in a timely manner.

12.2 Information Security. We maintain administrative, technical, and organizational security measures designed to protect personal information against unauthorized access, destruction, loss, alteration, and misuse. These measures include encryption of data in transit, access controls, and regular security assessments. No method of transmission over the Internet or method of electronic storage is completely secure, however, and we cannot guarantee absolute security. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at support@givebutter.com.

12.3 Children’s Privacy. The Services are not directed at children under the age of 18, and we do not knowingly collect personal information from children under 18. Users must be at least 18 years of age to register an account. If we learn that we have collected personal information from a child under 18, we will promptly delete that information. If you believe that a child under 18 has provided personal information to us, please contact us at support@givebutter.com so that we can take appropriate action.

13. Third-Party Websites and Services.

The Services may contain links to websites, applications, and services operated by third parties, including but not limited to Stripe (a Payment Processor), AI model providers such as Anthropic, Google, and OpenAI, Fundraiser websites, and other external platforms. This Privacy Policy does not apply to any third-party websites, applications, or services, and Givebutter is not responsible for the privacy practices, content, or security of any third party.

When you click a link to a third-party website or interact with a third-party service through the Services, you are subject to that third party’s own privacy policy and terms of use. We encourage you to review the privacy policies of any third-party websites or services before providing personal information to them or enabling any integration that permits data sharing with them.

The inclusion of a link to a third-party website or service within the Services does not imply endorsement, sponsorship, or affiliation by Givebutter. We do not control and assume no liability for the actions, policies, or practices of any third party.

14. Cross-Border Data Transfers.

Givebutter’s servers and operations are located in the United States. If you access or use the Services from outside the United States, your personal information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

By accessing or using the Services, or by providing personal information to us, you consent to the transfer and processing of your personal information in the United States as described in this Privacy Policy. If you do not consent to this transfer, you should not use the Services.

Certain third-party service providers we use (including AI model providers, cloud infrastructure providers, and Payment Processors) may process personal information in jurisdictions outside of your country of residence. We will take reasonable steps to require that these providers maintain appropriate safeguards for the protection of personal information in accordance with applicable law, however we cannot control third-party practices.

15. Contact Us.

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us using the information below.