Privacy Policy

1. Information We Collect

We collect this information:

• Contact Information: Your email address. We use it to sign you in and to send the emails that section 3 lists. When our email provider tells us that mail to an address bounced or was marked as spam, we record this. After that, we send that address only the sign-in links that are asked for, until its owner signs in with one of them. For an address that has no account, we keep the address for this purpose only as a one-way code.
• Organization Information: Your organization's EIN (Employer Identification Number), legal name, mailing address, phone number, revenue, contributions, assets, fiscal year end, formation date, organization type, state of incorporation, activity code (NTEE), state registration numbers, the status that the California charity registry shows, and your answers about activities such as raffles. Some of these come from public records (section 2).
• State Registration Data: The states where your organization asks for donations, your registration dates and answers, your filing marks (with the date, fee, confirmation number and notes you enter), and the Attorney General inquiries you record.
• People in your organization: The email addresses of the people you invite, and who accepted.
• Account Preferences: Your reminder settings, your choice about the monthly summary, and a record of each reminder and summary we send.
• Sign-in: A passkey's public key and credential ID. For sign-in with Google, your Google account ID. We do not store passwords.
• Saved calendar (before an account): If you ask us to save a calendar we computed for you, we keep a short-lived copy of the inputs — EIN, organization name, organization type, revenue, contributions, assets, fiscal year end, the states you selected, what the EIN check found, and whether you asked for a trial — keyed to the email you give us. We do this so the magic link can restore that calendar instead of asking you the same questions again. We delete the copy when it expires, whether or not you opened the link, and we do not keep the computed deadline list itself.
• Calendar and report requests: When you give us your email address to get a calendar or a report, we keep a record of the request: your email address, the organization name, revenue range, fiscal year end month and states you gave us, and a summary of the result (the number of filings, the total fees and the number of states that need registration). We keep this record until you delete your account or ask us to delete it.
• EIN checks: When anyone checks an EIN on our site, we record the EIN, what we found about the organization (or why the check failed), the page where the check ran, and the time. If you are signed in, we also record your account. These records do not keep your IP address or browser. We use these records to see which organizations use the check and to find faults. When you delete your account, we delete the records made while you were signed in. We keep the other records with no end date.
• Trial ledger: If you take the fourteen-day National trial, we record the organization EIN, the email that used it, and the trial window so we can keep the one-trial-per-organization rule.
• Acceptance records. When you check a box to accept our Terms of Service or Privacy Policy and we can link that check to your account, we record which version you accepted, when, on which page, your IP address and browser, and your organization's EIN. When you pay through our online checkout or change your plan on our pricing page, the same record also keeps your agreement to automatic renewal. We keep these records after an account is deleted, keyed by a one-way code of your email address instead of the address, so we can show what was agreed.
• Notice records. When we email an account notice, we record its text, when we sent it, whether our mail provider accepted it, and whether the provider later told us that it bounced. We keep these records after an account is deleted, keyed by a one-way code of your email address instead of the address, so we can show what we sent.
• Form delivery records. When you download a pre-filled form, we record that you ticked the confirmation, when, which form and which version of its template we used, the information we filled in (such as your organization's name, EIN, address, phone number, revenue and fiscal year), and a fingerprint of the file. We keep these records after an account is deleted, so we can show what we sent. They keep your email address, and any email address on the form, only as a one-way code. We do not keep a copy of the file.
• Payment records. When your organization pays for a plan, we record the date, the amount, how it was paid (online checkout or invoice) and the payment or invoice reference. When we refund a whole payment, we record the date and the reference of the refund. Stripe or Wise (section 9) keeps the record of a partial refund, and of a refund that we make after the account was deleted. We keep our records after an account is deleted, with the organization's EIN, so that the refund of the first payment is given once per organization.
• Support records. When you email our support address, we record the sender, the subject, the date and how we routed the email. Our staff can also keep notes of a conversation with your organization, with the text of the emails we exchange.
• Server logs. Our web server records each request: the IP address, the browser, the page address, the page that sent you, and the time. Our programs also record the email address that some emails went to. We use these logs to protect the service and to find faults. We delete each of these log files within 30 days after we stop writing to it.

2. Public Data Sources

We use public records for two purposes.

• Your organization's details: When you check an EIN or open an account, we look the EIN up in ProPublica Nonprofit Explorer (public IRS Form 990 data), in the IRS exempt-organization files and, for California, in the Attorney General's charity registry. We use what we find to fill in and check your organization's details and to pre-fill forms.
• Nonprofits we may contact: We keep public records about many nonprofits, to find the ones that CharityFile can help. For each one we keep the name, address and in-care-of name that the IRS lists, its mission, its IRS classification, its website and what its home page shows about online giving, its finances, its state registrations, the professional fundraisers it names, and the officers that its Form 990 names, with their titles and pay. This data comes from IRS files, Form 990 returns, ProPublica and state registry lists. We keep data taken from Form 990 returns, not copies of the returns. We also keep our estimate of its state filings and fees, and a record of each step of our review of it and our contact with it, with our staff's notes.

Public data never replaces information you entered. When a public record disagrees with it, we keep your entry and show the public value in Settings.

3. How We Use Your Information

We use your information to:

• Track your charitable solicitation deadlines
• Calculate state-specific registration fees
• Send email reminders before filing deadlines. You can stop those reminders from the unsubscribe link in the email footer, and turn them back on in Settings → Reminders.
• Send a monthly summary of your filing calendar when you opt in. You can stop it from the unsubscribe link in that email, and turn it back on in Settings → Reminders.
• Send account notices: after each online purchase, a confirmation with the plan, the renewal date, the amount, how to cancel and the refund rule; a receipt for each payment; a confirmation of each refund, except a partial refund by bank transfer, which our staff confirm by email; a notice when a renewal or a plan change cannot be charged to your payment method; an email before each automatic renewal of your plan; an email when your plan will not renew because we could not email the renewal notice to any member in time; notice of a new price for your plan before it applies; notice before we remove a feature that your paid plan includes; and notice of a change to our Terms of Service or Privacy Policy that reduces your rights or adds to your obligations. We send each of these emails to every member we can email. They are part of the service, so no unsubscribe link stops them.
• Send the emails that your actions call for: sign-in links, the trial emails, one reminder to finish setting up, invitations from your team, a notice when the EIN you enter already has an account, the confirmation of an invoice request, and the confirmation that an account was deleted.
• Tell you when the IRS lists your organization as revoked, and when we fill in a field from public records.
• Send the calendar or report you ask for. If you do not open an account, we also send you up to 3 emails about CharityFile. You can stop these emails from the unsubscribe link in each one.
• Pre-fill compliance forms where available
• Fill in and check your organization's details from public records (section 2)
• Mark your organization as a customer in our list of nonprofits (section 2), so that we do not treat it as a prospect
• Tell our staff about new accounts, invoice requests and support email
• Provide customer support
• Protect the service, find faults, and improve the service

4. Information We Do Not Sell

We do not sell, rent, or trade your personal information or organization data to third parties. We use your data only for the purposes in section 3.

We do not share your email address with marketing partners. We do not sell donor lists or nonprofit contact information.

5. Payment Processing

We take payments in two ways:

• Online payments go through Stripe. Your payment details go directly to Stripe, and Stripe follows the PCI-DSS rules. We receive a confirmation of each payment and refund, with its date, amount and reference. We keep your organization's Stripe customer ID and the ID of each checkout, to match later Stripe events and refunds.
• Payment by invoice: you pay us directly by ACH or wire to our Wise account, and Stripe does not process that payment. We record the date, the amount and the invoice reference.

We do not store card numbers or bank account numbers.

For information about how Stripe handles your payment data, please review Stripe's Privacy Policy.

6. Data Security

We protect your data in these ways:

• Our website uses HTTPS only.
• We send email to our mail provider over an encrypted connection. Email between mail servers is not always encrypted.
• Only our staff, and the AI assistants they use (section 9), have access to the server and the database.
• Our server installs operating-system security updates automatically every day.
• The nightly backups that we store in Google Drive are encrypted.

Support access to your account. Our support staff can open a session in your account to diagnose a problem, and may act inside it only when you have asked us to. Every such session is recorded — who opened it, when, and why — and listed in your Settings under Access by CharityFile staff.

While we take reasonable steps to protect your information, no internet transmission is completely secure. We cannot guarantee the absolute security of data transmitted to or from our service.

7. Data Retention and Deletion

You can delete your account from Settings. When the person who created your organization's account deletes their account, the organization's access and billing end that day, and we delete its calendar, filing marks, registration dates and registration answers, and the account of every member, with their sign-in, passkeys and reminder settings. If that person can no longer sign in, a member can ask support@charityfile.com to close the organization's account. When another member deletes their account, we delete only that member's account, with its sign-in, passkeys and reminder settings, and the organization's plan, billing and records stay. A person whose account is not part of an organization deletes it from Setup.

What stays after deletion: Stripe's and Wise's own records, which include each partial refund and each refund made after the account was deleted; if your organization used a free trial, the trial ledger keyed by EIN, so that the EIN cannot start a second free trial; the dated record of any staff access, without your address; a dated record that the account was deleted, with the organization's EIN and its Stripe customer ID if it has one, keyed by a one-way code of your address so support can confirm a request; the records of which Terms of Service and Privacy Policy versions were accepted, and of each agreement to automatic renewal, keyed the same way; the records of the account notices we sent (section 3), and of the notices about your plan that we send to our own staff, with the text of each, keyed the same way; the records of each pre-filled form we sent, with the information we filled in and without any email address; the records of the date and amount of each payment we received and of the date of each refund of a whole payment, with your organization's EIN and without the email address of any person in your organization, so that the refund of the first payment is given once per organization; our records about your organization in our list of nonprofits (section 2); the records of EIN checks made while you were not signed in; the support records (section 1) of email that reached our support address from an address that had no account at that time; the mail we already sent or received, at our email provider and in our staff mailbox; the records of our staff's work with AI assistants (section 9), which can hold data those assistants read; earlier versions of our source code and project notes on GitHub (section 9), which can hold a customer's email address; our server logs, each deleted within 30 days after we stop writing to it; and our backups for up to 30 days, and a few pre-deployment snapshots kept for rollback, which can be older. Support still answers deletion requests by mail at support@charityfile.com.

The copies of our database on our staff's computers, which they use to build and test CharityFile, hold only state rules, their sources and our change log. They hold no data about a person or an organization.

If you cancel your subscription without deleting the account, the account and calendar stay. We keep the billing identifiers needed to match later Stripe events and refunds. There is no separate retention period for a cancelled seat: the account and its calendar stay until you delete them.

8. Cookies and Analytics

We use essential cookies for sign-in and to record what you agreed to. Our cookie page lists each one and how long it lasts. We count how visitors move through our pages, for example how many start and finish an EIN check. These counts hold no name, email address, EIN or IP address. We do not use third-party analytics.

9. Third-Party Services

These outside services receive or keep some of your data for us:

• Stripe: takes online payments (section 5).
• Wise: holds the account that receives payments by invoice, and sends our invoices. It receives the name, address and email address on each invoice and the details of each transfer.
• Resend: sends our email, and receives the email sent to our support address.
• Hetzner Online: hosts our server in a US data center.
• Google: sign-in with Google; storage of our encrypted backups in Google Drive; and the mailbox where our staff read support email and our notices about accounts.
• ProPublica Nonprofit Explorer and the California Attorney General's charity registry: we send them an EIN to get the organization's public records.
• Anthropic: our staff use Claude, Anthropic's AI assistant, to build and run CharityFile. When public records leave a field of your organization empty, we give Claude the organization's name, its EIN and the names of the empty fields, and Claude looks for the values in public sources. While Claude helps us with our systems, it can read the data they hold, your account included.
• xAI: our staff also use Grok, xAI's AI assistant, to build CharityFile. While Grok helps us with our systems, it can read the data they hold, your account included.
• GitHub: keeps our source code and our project notes, with every earlier version of them.

Each third-party service has its own privacy policy governing how they handle data.

10. Changes to This Policy

Each version of this Privacy Policy has an effective date and is kept in our public archive at charityfile.com/privacy/archive. Section 17 of our Terms of Service also applies to changes to this Privacy Policy.

A change that reduces your rights or adds to your obligations applies to your organization when a member accepts it on the page where we ask for it, and never before its effective date. We do not ask your organization to accept it until 30 days after we email it to the members of your organization's account. If we email members on different days, the 30 days count from the last of those emails. After that, a member must accept the new version before your organization can use the dashboard again. Billing and account deletion stay open. Until a member accepts the new version, the version your organization accepted before continues to apply. If your organization ends its paid plan instead of accepting the change, by cancelling it, by closing its account or, for a plan paid by invoice, by telling support@charityfile.com, its paid access ends that day, and we refund the unused part of its paid period, in proportion to the time left in it. This also applies to a paid period that renewed automatically while the change waited for acceptance.

Any other change takes effect on the effective date shown on the new version, which is never before we publish it. Whether a change reduces your rights or adds to your obligations depends on what it does, not on what we call it. If a law requires a change sooner than this section allows, that change takes effect when the law requires, and only as far as the law requires.

11. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us at support@charityfile.com.