Privacy Policy

1. Our Two Roles

We handle information in two different capacities:

• Controller— For information about our account holders, their staff users, website visitors, and prospective customers, we act as a “controller” (we decide how and why it is used). This Policy governs that information.
• Processor / Service Provider— For information that an organization (a nonprofit or other customer) uploads about its children, staff, and sponsors (“Customer Data”), we act as a “processor” or “service provider” and handle it only on that organization’s behalf and instructions. If you are a child, guardian, staff member, or sponsor of an organization that uses the Service, that organization is responsible for its own privacy practices; please direct privacy requests to them.

2. Information We Collect

Information you provide

• Account and contact details (name, email, organization name, role);
• Billing information — payment card details are collected and processed directly by our payment processor (Stripe); we do not store full card numbers;
• Communications you send us (support requests, feedback);
• Customer Data that organizations upload, which may include names, photos, letters, birthdays, school and sponsorship details, and other information about children, staff, and sponsors.

Sensitive information collected through optional components

Two optional components collect categories of information we treat as sensitive. They are collected only where an organization enables that component, only from people who choose to take part, and only for the purpose described below.

• KidsCircle Journey (mission trips) — passport name, number and expiry; date of birth, gender and marital status; allergies, medical conditions, medications, physical limitations and immunizations; travel insurance details; emergency contacts; personal references; self-disclosed responses about criminal history and substance use; and written responses about faith and reasons for travelling.
• KidsCircle Story (profiles and development tracking) — narrative and biographical information about a sponsored child, family, or staff member, which may include health notes, family and guardian details, and prayer requests.
• Electronic signature records — where someone signs a policy or agreement, we record the typed name or initials, the policy version, the date and time, and the IP address and browser used, so that the agreement can be shown to be valid.

We do not obtain criminal-history reports from any third party; those responses are disclosed by the applicant. We are not a covered entity or business associate under HIPAA, and the health information described above is not protected health information under that law.

Information collected automatically

• Usage and device data (IP address, browser type, pages viewed, actions taken);
• Cookies and similar technologies used to keep you logged in, remember preferences, and understand how the Service is used.

3. How We Use Information

• To provide, operate, secure, and improve the Service;
• To authenticate users and manage accounts and subscriptions;
• To process payments and send transactional and service-related emails;
• To provide customer support and respond to requests;
• To detect, prevent, and address fraud, abuse, and security issues; and
• To comply with legal obligations.

We do not sell personal information, and we do not use Customer Data for advertising or to build advertising profiles.

4. Children’s Information

The Service is a business tool for organizations; it is not directed to children and children do not create accounts or use it. Organizations may upload information about the children they serve. When they do, they act as the controller of that information and are responsible for obtaining any required consents (including parental or guardian consent) and for complying with applicable children’s-privacy and data-protection laws. We process children’s information only to provide the Service to the organization, do not use it for any independent purpose, apply retention limits, and delete or return it in accordance with our agreement with the organization and applicable law. We take the protection of children’s information seriously and maintain a written information security program.

Many of the children our customers serve are orphans in the care of the organization itself, which acts as their guardian. Where an organization enables KidsCircle Story, the information it records about a child may include health notes and details of that child’s family, siblings, or guardians — including family members who are not themselves part of the Service. All of this is Customer Data: the organization decides what to record and remains responsible for the lawful basis for recording it, and we process it only on that organization’s instructions.

5. How We Share Information

We share information only as described here:

• Service providers / sub-processors — trusted vendors that help us run the Service, such as cloud hosting and application infrastructure (e.g., Vercel, Supabase), file/photo storage (e.g., Cloudflare R2), email delivery (e.g., Resend), and payment processing (e.g., Stripe). They may access information only to perform services for us and are bound by confidentiality and data-protection obligations.
• At an organization’s direction — for Customer Data, we share as the organization instructs (for example, sending letters or emails to the sponsors it designates).
• Legal and safety — when required by law, legal process, or to protect rights, safety, and security.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, or the formation of the KidsCatalyst entity, subject to this Policy.

We do not sell personal information or share it for cross-context behavioral advertising.

6. International Data Transfers

We are based in the United States, and information may be processed in the United States and other countries. Organizations that use the Service may be located in, or may serve children and sponsors located in, other countries (for example, in Africa or Europe). Where required, transfers of personal data across borders are made using appropriate safeguards. Organizations are responsible for ensuring they have a lawful basis to transfer the personal data they upload.

7. Data Retention

We retain personal information only for as long as reasonably necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Customer Data is retained according to our agreement with the organization; after termination, and following any export window, we delete or de-identify it in the ordinary course, subject to legal retention requirements.

8. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect information, including access controls, encryption in transit, and a written information security program. No system is completely secure, and we cannot guarantee absolute security.

9. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, to opt out of certain processing, and to appeal a decision. Residents of U.S. states with privacy laws (such as Texas) and individuals protected by the EU/UK GDPR may have these and additional rights. To exercise rights regarding information for which we are the controller, contact us using the details below. If your request concerns Customer Data held on behalf of an organization, please contact that organization; we will assist them as their processor. We will not discriminate against you for exercising your rights.

10. Cookies

We use necessary cookies to operate the Service and may use limited analytics cookies to understand usage. You can control cookies through your browser settings; disabling some cookies may affect functionality.

11. Third-Party Links

The Service may link to third-party sites or services we do not control. Their privacy practices are governed by their own policies.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice (for example, by email or through the Service) and update the effective date above.

13. Contact Us

For privacy questions or to exercise your rights, contact us at hello@kidscircle.net.