Privacy Policy

1. Who we are

This Privacy Policy (version 2026-09-06, effective September 6, 2026) explains how the operator of 501 Compass ("Provider," "we") handles personal information in 501 Compass.

If you use a workspace, your organization is typically the controller of donor, volunteer, staff, and beneficiary records it uploads. We process that data as a service provider / processor to deliver the Service.

2. Information we collect

Account data: name, email, password hash, session tokens, organization membership and roles.

Customer Data you or your teammates upload: projects, finances, documents, messages, board records, and similar content, which may include personal information about third parties.

Billing data: handled by Stripe; we store customer and subscription identifiers and status, not full card numbers.

Technical data: IP address, user agent, timestamps, and logs needed to operate, secure, and debug the Service.

3. How we use information

To provide, secure, and improve the Service; authenticate users; isolate organization data; send transactional email (invites, password resets, notifications you enable); process subscriptions; prevent fraud and abuse; and comply with law.

We do not sell personal information. We do not use Customer Data to train general-purpose public AI models.

4. Sharing

We share information with subprocessors who host infrastructure, send email, or process payments, under contracts that require appropriate protection. We may disclose information if required by law, to protect rights and safety, or in a merger or sale of assets with notice where required.

If you connect Google, accounting, or other integrations, those providers receive the data you authorize.

5. Retention and security

We retain account and Customer Data while the workspace is active and for a reasonable period afterward, unless you export and we delete it, or law requires longer retention. Security includes encrypted transport, hashed passwords, session cookies, and organization access checks. No method of transmission or storage is 100% secure.

6. Your choices

You may update profile information in the app, request password reset, and ask your organization admin to remove your membership. Organization admins may export workspace data using the in-app export where available. You may contact us to request access, correction, or deletion of personal information we hold as controller, subject to legal exceptions.

If we act as processor, we will direct you to the organization that owns the workspace when appropriate.

7. Children

The Service is not directed to children under 13 (or under 16 in jurisdictions that require it). Do not create an account for a child. If you store information about minors (for example youth program participants), you are responsible for having appropriate consents and safeguards.

8. International; changes; contact

The Service is operated from the United States. If you access it from elsewhere, you consent to transfer of information to the U.S. We may update this policy; material changes will be posted with a new version date. Questions: use the contact options in the Service or the email on our website.