Privacy Policy

1. Our Two Roles

We handle information in two different capacities:

• Controller— For information about our account holders, their staff users, website visitors, and prospective customers, we act as a “controller” (we decide how and why it is used). This Policy governs that information.
• Processor / Service Provider— For information that an organization (a nonprofit or other customer) uploads about its children, staff, and sponsors (“Customer Data”), we act as a “processor” or “service provider” and handle it only on that organization’s behalf and instructions. If you are a child, guardian, staff member, or sponsor of an organization that uses the Service, that organization is responsible for its own privacy practices; please direct privacy requests to them.

2. Information We Collect

Information you provide

• Account and contact details (name, email, organization name, role);
• Billing information — payment card details are collected and processed directly by our payment processor (Stripe); we do not store full card numbers;
• Communications you send us (support requests, feedback);
• Enquiries. When you fill in our “Get started” or contact form, we keep what you enter (such as your name, email address, organization, country, program size and message) to reply to you and follow up about KidsCircle.
• Customer Data that organizations upload, which may include names, photos, videos, letters, birthdays, school and sponsorship details, and other information about children, staff, and sponsors.

Sensitive information collected through optional components

Two optional components collect categories of information we treat as sensitive. They are collected only where an organization enables that component, only from people who choose to take part, and only for the purpose described below.

• KidsCircle Journey (mission trips) — passport name, number and expiry; date of birth, gender and marital status; allergies, medical conditions, medications, physical limitations and immunizations; travel insurance details; emergency contacts; personal references; self-disclosed responses about criminal history and substance use; and written responses about faith and reasons for travelling.
• KidsCircle Story (profiles and development tracking) — narrative and biographical information about a sponsored child, family, or staff member, which may include health notes, family and guardian details, and prayer requests.
• Electronic signature records — where someone signs a policy or agreement, we record the typed name or initials, the policy version, the date and time, and the IP address and browser used, so that the agreement can be shown to be valid.

We do not obtain criminal-history reports from any third party; those responses are disclosed by the applicant. We are not a covered entity or business associate under HIPAA, and the health information described above is not protected health information under that law.

Information collected automatically

• Usage and device data (IP address, browser type, pages viewed, actions taken);
• Cookies and similar technologies used to keep you logged in, remember preferences, understand how the Service is used, and — on our public website only, and only if you accept advertising cookies — measure our advertising (see Section 10).
• When you first visit our public website, which website or advertising campaign referred you (for example, the “utm” campaign tags in a link and the referring site’s domain) and the page you arrived on. We keep this with any enquiry you send us or account you open, so we can tell which of our marketing works.

3. How We Use Information

• To provide, operate, secure, and improve the Service;
• To authenticate users and manage accounts and subscriptions;
• To process payments and send transactional and service-related emails;
• To provide customer support and respond to requests;
• To detect, prevent, and address fraud, abuse, and security issues; and
• To comply with legal obligations.
• To understand and improve our marketing — for example, to see which websites and advertising campaigns bring visitors who enquire, start a trial, or subscribe — and, if you accept advertising cookies, to measure and improve our ads on Google, Meta (Facebook and Instagram), Reddit and LinkedIn.

We do not sell personal information, and we do not use Customer Data for advertising or to build advertising profiles.

4. Children’s Information

The Service is a business tool for organizations; it is not directed to children and children do not create accounts or use it. Organizations may upload information about the children they serve. When they do, they act as the controller of that information and are responsible for obtaining any required consents (including parental or guardian consent) and for complying with applicable children’s-privacy and data-protection laws. We process children’s information only to provide the Service to the organization, do not use it for any independent purpose, apply retention limits, and delete or return it in accordance with our agreement with the organization and applicable law. We take the protection of children’s information seriously and maintain a written information security program.

Many of the children our customers serve are orphans in the care of the organization itself, which acts as their guardian. Where an organization enables KidsCircle Story, the information it records about a child may include health notes and details of that child’s family, siblings, or guardians — including family members who are not themselves part of the Service. All of this is Customer Data: the organization decides what to record and remains responsible for the lawful basis for recording it, and we process it only on that organization’s instructions. Where an organization enables the optional video feature, its staff may record or upload short videos of the children it serves, with an optional caption. Before any video of a child can be uploaded, the organization must confirm in the Service that it has permission from the child’s parent or legal guardian (or, where the organization is the child’s guardian, its own documented permission). A guardian may withdraw permission through the organization, after which that child’s videos are deleted. Location information that phones embed in video files is removed from the copies stored for viewing. Videos are shown only to the organization’s authorized users and to that child’s sponsors, through short-lived private links, and cannot be downloaded through the Service.

5. How We Share Information

We share information only as described here:

• Service providers / sub-processors — trusted vendors that help us run the Service, such as cloud hosting and application infrastructure (e.g., Vercel, Supabase), file/photo storage (e.g., Cloudflare R2), video hosting and streaming (e.g., Mux), email delivery (e.g., Resend), text messaging (e.g., Twilio), printing and mailing of letters and cards (e.g., PostcardMania), merchandise order fulfillment (e.g., Prodigi), and payment processing (e.g., Stripe). A current list is maintained on our Sub-processors page. They may access information only to perform services for us and are bound by confidentiality and data-protection obligations.
• At an organization’s direction — for Customer Data, we share as the organization instructs (for example, sending letters or emails to the sponsors it designates).
• Legal and safety — when required by law, legal process, or to protect rights, safety, and security.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, or the formation of the KidsCatalyst entity, subject to this Policy.

Advertising partners. If you accept advertising cookies on our public website, Google, Meta, Reddit and LinkedIn may receive information about your visit through their tags (pixels) — such as the pages you view on our public website, your browser and device, your IP address, and their own cookie identifiers — and, when you send us an enquiry, start a free trial or subscribe, a notice that this happened together with a scrambled (hashed) copy of your email address so they can match it to their own users. They use this to measure and improve our advertising and may also use it under their own privacy policies. These tags never run inside the KidsCircle application, the sponsor portal or the trip portal, and no Customer Data — including any information about children or sponsors — is ever shared with them.

We do not sell personal information for money. Under some U.S. state laws, letting advertising partners collect information through these tags can be considered “sharing” for cross-context behavioral advertising. We do this only if you accept advertising cookies, you can withdraw at any time through “Cookie choices” at the bottom of our website, and we treat a Global Privacy Control signal from your browser as an opt-out.

6. International Data Transfers

We are based in the United States, and information may be processed in the United States and other countries. Organizations that use the Service may be located in, or may serve children and sponsors located in, other countries (for example, in Africa or Europe). Where required, transfers of personal data across borders are made using appropriate safeguards. Organizations are responsible for ensuring they have a lawful basis to transfer the personal data they upload.

7. Data Retention

We retain personal information only for as long as reasonably necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Customer Data is retained according to our agreement with the organization; after termination, and following any export window, we delete or de-identify it in the ordinary course, subject to legal retention requirements. Videos are kept according to the organization’s settings. They are deleted when the organization removes them, when a guardian withdraws permission, fourteen days after the organization’s video subscription ends, and in any case twelve months after a child leaves the organization’s program. Videos uploaded but never matched to a child are deleted after fourteen days.

8. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect information, including access controls, encryption in transit, and a written information security program. Videos are delivered only through short-lived signed links. No system is completely secure, and we cannot guarantee absolute security.

9. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, to opt out of certain processing, and to appeal a decision. Residents of U.S. states with privacy laws (such as Texas) and individuals protected by the EU/UK GDPR may have these and additional rights. To exercise rights regarding information for which we are the controller, contact us using the details below. If your request concerns Customer Data held on behalf of an organization, please contact that organization; we will assist them as their processor. We will not discriminate against you for exercising your rights.

10. Cookies

We use three kinds of cookies and similar technologies:

• Necessary — to keep you logged in, keep the Service secure and remember your choices, including your cookie choice.
• Analytics — our own, first-party website analytics. We record which public pages are visited, the referring website’s domain and campaign tags, using a code that changes every day so that visits cannot be linked across days. We also set one first-party cookie, for 30 days, that remembers which website or campaign first brought you to us; it contains no identifier. No outside analytics company receives this information.
• Advertising — only on our public website and only if you click “Accept”: the Google Ads tag, the Meta Pixel, the Reddit Pixel and the LinkedIn Insight Tag. If you click “Decline”, or your browser sends a Global Privacy Control signal, none of them load.

You can change your choice at any time with “Cookie choices” at the bottom of our website, and you can also control cookies through your browser settings; disabling some cookies may affect functionality. To learn how these partners use information, see the privacy policies of Google (policies.google.com/privacy), Meta (facebook.com/privacy/policy), Reddit (reddit.com/policies/privacy-policy) and LinkedIn (linkedin.com/legal/privacy-policy).

11. Third-Party Links

The Service may link to third-party sites or services we do not control. Their privacy practices are governed by their own policies.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice (for example, by email or through the Service) and update the effective date above.

13. Contact Us

For privacy questions or to exercise your rights, contact us at hello@kidscircle.net.