Givealong Privacy Policy (Pilot)
DRAFT: requires review by a Canadian lawyer before use. Placeholders in [BRACKETS]. Written for about a Grade 8 reading level. Built on PIPEDA's fair information principles. [LAWYER: confirm which law applies. PIPEDA may not fully apply to a nonprofit that isn't doing commercial activity. BC/Alberta PIPA, or Quebec Law 25, may apply depending on where members live. We follow PIPEDA-level practices either way.]
Last updated: [DATE]
Your privacy matters to us. This page explains what we collect, why, and what you can do about it, in plain words.
1. Who is responsible
[LEGAL ENTITY NAME] ("Givealong", "we") runs Givealong. Our privacy contact is [PRIVACY OFFICER NAME], at [SUPPORT EMAIL] or [ADDRESS].
2. What we collect
| What | Why |
|---|---|
| Phone number | To text you and know it's you |
| Name (first name is fine) | To talk to you like a person |
| City | To suggest local charities |
| Income range (optional, e.g. "$50k–$75k") | To help you pick a giving amount that fits. You can skip this. |
| Your giving plan | The causes, charities and amounts you choose |
| Giving records | Gifts you tell us about: charity, amount, date |
| Receipts you forward (by text or email) | To confirm gifts and track your progress |
| Your messages with our AI assistant | To reply to you and improve the service |
| Email address (only if you email us) | To reply and to read forwarded receipts |
| Consent records | Proof that you said yes to texts, and when you said stop |
What we don't want:
- No health or patient information. Givealong is not connected to any clinic's patient records. Please never send us patient details. If we get them by mistake, we delete them.
- No payment details. We never need your card or bank info. Forwarded receipts may show part of a card number. If they do, we hide or delete it.
3. How we use it
We use your info only to:
- build and track your giving plan;
- send your plan reminders and your monthly Giving Day check-in;
- confirm gifts and arrange sponsor gifts and matches to charities;
- answer your questions;
- keep Givealong safe and working, and learn what helps (using totals that don't identify you).
We don't sell your info. We don't use it for ads.
4. Our AI assistant
Givealong's messages come from an AI assistant, not a person. To write replies, we send your messages and the parts of your profile needed for the reply to an AI model provider, [AI PROVIDER NAME]. Under our contract, the provider may use this data only to give us the service. It may not use your data to train its models. [LAWYER/ENG: confirm the provider's terms.] The AI's suggestions are not financial or tax advice.
Our team may read conversations to fix problems and check quality.
5. Who we share with
We share only what's needed, and only with:
- Service providers who work for us: Twilio (texting), [AI PROVIDER NAME] (AI replies), [HOSTING/DATABASE PROVIDER] (storage), [EMAIL PROVIDER] (email). They must protect your info and can only use it for our service.
- Charities, only when a sponsor gift or match is sent, and only if needed (e.g. "a gift made on behalf of a Givealong member"). We don't give charities your contact info unless you ask us to.
- Our sponsor, [SPONSOR LEGAL NAME] (Otto): it only gets totals that don't identify anyone (for example, "82 members gave C$4,100"). It does not get your name, phone, income or giving details. Your clinic or employer does not see your info either.
- The law: if we're legally required to share it.
Text messaging: we don't sell, rent or share your mobile phone number or text-messaging opt-in data and consent with any third party for marketing purposes. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.
6. Where your info is stored
Some of our providers store or process data outside Canada, including in the United States. While it's there, foreign laws apply and foreign authorities may be able to access it. [LAWYER: Quebec members may need a privacy impact assessment before transfer.]
7. How long we keep it
| Info | How long |
|---|---|
| Account, plan, giving records, receipts | While you're a member, plus 12 months after you leave, then deleted |
| Chat messages | [24] months, then deleted or made anonymous |
| Consent and STOP records | 3 years after you stop, to prove we followed the anti-spam law |
| "Do not text" list | As long as needed to keep honouring your STOP |
If you ask us to delete your info, we'll do it within 30 days. We only keep the consent and STOP records above.
8. Keeping it safe
We use encryption, access controls, and limit who on our team can see your info. No system is perfect. If a breach could seriously harm you, we'll tell you and the Privacy Commissioner, as the law requires.
9. Your choices and rights
You can:
- See the info we have about you;
- Fix anything that's wrong;
- Delete your account and info;
- Skip optional questions (like income);
- Stop texts at any time: text STOP;
- Withdraw consent at any time. (Some features may stop working.)
Email [SUPPORT EMAIL] to make a request. We'll reply within 30 days. If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or to your provincial privacy commissioner.
10. Age
Givealong is for adults 18 and older. We don't knowingly collect info from anyone younger. If we find out we have, we delete it.
11. Changes
If we change this policy in a big way, we'll text or email you before it takes effect.
12. Contact
[PRIVACY OFFICER NAME], [LEGAL ENTITY NAME], [ADDRESS] · [SUPPORT EMAIL] · [WEBSITE]
Reference (not part of the published policy)
- OPC, PIPEDA fair information principles: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/p_principle/
- OPC, How PIPEDA applies to charitable and non-profit organizations: https://priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/02_05_d_19
- OPC, Guidelines for obtaining meaningful consent: https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/
- OPC, Guidelines for processing personal data across borders (2009): https://www.priv.gc.ca/en/privacy-topics/airports-and-borders/gl_dab_090127/
- Twilio, required SMS privacy clause (errors 30520/30521 and the TFV checklist): https://help.twilio.com/articles/13264118705051
- Income range is sensitive financial info. Keep it optional, and ask for clear express consent when collecting it (OPC meaningful-consent guidance).