Privacy Policy

1. Our Two Roles

We handle information in two different capacities:

• Controller— For information about our account holders, their staff users, website visitors, and prospective customers, we act as a “controller” (we decide how and why it is used). This Policy governs that information.
• Processor / Service Provider— For information that an organization (a nonprofit or other customer) uploads about its children, staff, and sponsors (“Customer Data”), we act as a “processor” or “service provider” and handle it only on that organization’s behalf and instructions. If you are a child, guardian, staff member, or sponsor of an organization that uses the Service, that organization is responsible for its own privacy practices; please direct privacy requests to them.

2. Information We Collect

Information you provide

• Account and contact details (name, email, organization name, role);
• Billing information — payment card details are collected and processed directly by our payment processor (Stripe); we do not store full card numbers;
• Communications you send us (support requests, feedback);
• Customer Data that organizations upload, which may include names, photos, letters, birthdays, school and sponsorship details, and other information about children, staff, and sponsors.

Information collected automatically

• Usage and device data (IP address, browser type, pages viewed, actions taken);
• Cookies and similar technologies used to keep you logged in, remember preferences, and understand how the Service is used.

3. How We Use Information

• To provide, operate, secure, and improve the Service;
• To authenticate users and manage accounts and subscriptions;
• To process payments and send transactional and service-related emails;
• To provide customer support and respond to requests;
• To detect, prevent, and address fraud, abuse, and security issues; and
• To comply with legal obligations.

We do not sell personal information, and we do not use Customer Data for advertising or to build advertising profiles.

4. Children’s Information

The Service is a business tool for organizations; it is not directed to children and children do not create accounts or use it. Organizations may upload information about the children they serve. When they do, they act as the controller of that information and are responsible for obtaining any required consents (including parental or guardian consent) and for complying with applicable children’s-privacy and data-protection laws. We process children’s information only to provide the Service to the organization, do not use it for any independent purpose, apply retention limits, and delete or return it in accordance with our agreement with the organization and applicable law. We take the protection of children’s information seriously and maintain a written information security program.

5. How We Share Information

We share information only as described here:

• Service providers / sub-processors — trusted vendors that help us run the Service, such as cloud hosting and application infrastructure (e.g., Vercel, Supabase), file/photo storage (e.g., Cloudflare R2), email delivery (e.g., Resend), and payment processing (e.g., Stripe). They may access information only to perform services for us and are bound by confidentiality and data-protection obligations.
• At an organization’s direction — for Customer Data, we share as the organization instructs (for example, sending letters or emails to the sponsors it designates).
• Legal and safety — when required by law, legal process, or to protect rights, safety, and security.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, or the formation of the KidsCatalyst entity, subject to this Policy.

We do not sell personal information or share it for cross-context behavioral advertising.

6. International Data Transfers

We are based in the United States, and information may be processed in the United States and other countries. Organizations that use the Service may be located in, or may serve children and sponsors located in, other countries (for example, in Africa or Europe). Where required, transfers of personal data across borders are made using appropriate safeguards. Organizations are responsible for ensuring they have a lawful basis to transfer the personal data they upload.

7. Data Retention

We retain personal information only for as long as reasonably necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Customer Data is retained according to our agreement with the organization; after termination, and following any export window, we delete or de-identify it in the ordinary course, subject to legal retention requirements.

8. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect information, including access controls, encryption in transit, and a written information security program. No system is completely secure, and we cannot guarantee absolute security.

9. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, to opt out of certain processing, and to appeal a decision. Residents of U.S. states with privacy laws (such as Texas) and individuals protected by the EU/UK GDPR may have these and additional rights. To exercise rights regarding information for which we are the controller, contact us using the details below. If your request concerns Customer Data held on behalf of an organization, please contact that organization; we will assist them as their processor. We will not discriminate against you for exercising your rights.

10. Cookies

We use necessary cookies to operate the Service and may use limited analytics cookies to understand usage. You can control cookies through your browser settings; disabling some cookies may affect functionality.

11. Third-Party Links

The Service may link to third-party sites or services we do not control. Their privacy practices are governed by their own policies.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice (for example, by email or through the Service) and update the effective date above.

13. Contact Us

For privacy questions or to exercise your rights, contact us at hello@kidscircle.net.