How Fundraising Tracker collects, uses, protects, and discloses personal information.

Who is responsible for privacy

Fundraising Tracker is operated by Fundraising Tracker for organizations that use the service to manage fundraising, balances, trips, events, forms, documents, and related family communications.

Each organization remains responsible for deciding what information it enters into its workspace, confirming it has the required authority or consent to collect and use that information, and responding to organization-specific access or correction requests. Fundraising Tracker provides the service, safeguards the application, and supports organizations in handling privacy requests.

Information we collect

We collect personal information directly from visitors, account users, families, guardians, volunteers, and organization managers. Organizations may also enter or import information about participants, guardians, relationships, balances, fundraiser activity, event registrations, form submissions, documents, and payments.

• Contact details such as names, email addresses, optional mobile numbers, organization names, and support messages.
• Account and access details such as roles, organization membership, login codes, session activity, access requests, and audit-log metadata.
• Participant, guardian, and relationship information needed for roster, family portal, fundraiser, trip/event, balance, form, and reporting workflows.
• Financial and operational records such as ledger transactions, credits, transfers, payment records, fundraiser entries, signups, event expenses, statements, reports, imports, exports, and renewal information.
• Technical information such as IP address, browser details, timestamps, rate-limit records, delivery logs, security events, and cookie/session identifiers.

How we use information

We use personal information only for purposes that are reasonable for operating, protecting, supporting, and improving the service.

• Create and maintain organization workspaces, manager accounts, participant and guardian profiles, and family portal access.
• Run fundraising, balance, trip/event, form, document, payment, import, export, reporting, notification, and support workflows.
• Send passwordless login codes, operational emails, optional SMS messages, payment receipts, reminders, and other service notices.
• Prevent abuse, enforce tenant isolation and role access, investigate security issues, maintain audit logs, and comply with legal, accounting, dispute, and operational obligations.
• Respond to questions, support requests, demo requests, privacy requests, and service administration needs.

Consent and authority

By using Fundraising Tracker, visitors and account users provide information for the purposes described in this policy. Organizations are responsible for ensuring they have appropriate consent or legal authority before entering personal information about participants, guardians, volunteers, staff, or other individuals.

If an organization is a public body, school, school district, or similar entity, that organization remains responsible for its own obligations under the privacy laws and policies that apply to it.

Children, students, and families

Organizations may use Fundraising Tracker to manage information about students, youth participants, guardians, and family members. The service is designed for operational fundraising and activity management, not advertising or profiling.

• Participant information should be limited to what the organization needs for its fundraising, account, trip/event, form, and reporting workflows.
• Family portal access is controlled through organization-managed relationships and access requests.
• We do not sell participant information, and we do not use participant or child information for behavioural advertising.

When we disclose information

We disclose personal information only as needed to provide the service, follow organization instructions, protect the service, or meet legal obligations.

• Within the organization workspace, according to user roles, relationship links, family portal permissions, and platform support controls.
• To service providers that support hosting, email delivery, optional SMS delivery, storage, security, diagnostics, and operations.
• To comply with law, court orders, regulatory requests, legal claims, safety obligations, security investigations, or to protect the rights and property of Fundraising Tracker, organizations, users, and the public.
• With an organization or individual when needed to answer support, access, correction, deletion, billing, or account administration requests.

Service providers and location of processing

Production hosting is provided through Web Hosting Canada. Email is sent through the configured SMTP provider. Optional SMS features use VoIP.ms when enabled. Other operational providers may be used for support, security, and communications.

Some service providers may process or store information outside your province or country. When providers are used, information may be subject to the laws of the jurisdictions where those providers operate. We use administrative, technical, and contractual safeguards appropriate to the role of each provider.

Cookies and similar technologies

Fundraising Tracker uses cookies and related browser storage for necessary service functions such as sessions, passwordless login flow support, remember-login preferences when selected, CSRF protection, organization access, security, and user interface preferences such as theme selection.

The service does not rely on third-party behavioural advertising cookies.

Safeguards

We use layered safeguards intended to protect personal information against unauthorized access, use, disclosure, copying, modification, deletion, and loss.

• Encrypted personal fields and HMAC lookup hashes for searchable personal information.
• Tenant-scoped database access, centralized route access rules, manager role gates, and read-only tenant protections.
• Passwordless login, optional SMS OTP for verified mobile users, session security controls, CSRF protection, rate limits, and security headers.
• Audit logs for sensitive platform, support, import, export, finance, role, deletion, and access actions.
• Private upload handling for tenant documents where applicable, plus operational logging and deployment controls.

Retention and disposal

We retain personal information while an organization account is active and as needed for the purposes described in this policy, including support, legal, accounting, audit, security, backup, dispute, and operational requirements.

Organizations may request deletion or export support. Some records may need to be retained for legal, security, audit, or financial integrity reasons. When information is no longer required, it is deleted, anonymized, or securely disposed of using reasonable operational controls.

Access, correction, deletion, and complaints

Individuals may request access to their personal information, ask for corrections, ask about deletion, withdraw consent where applicable, or make a privacy complaint. Some requests may need to be handled by the organization that controls the workspace record.

Send privacy requests to privacy@fundraisingtracker.ca. Please include your name, contact information, the organization involved, and enough detail for us to understand the request. We may need to verify identity before responding.

Changes to this policy

We may update this policy as the product, providers, legal requirements, or safeguards change. The effective date at the top of this page shows when the policy was last updated. Material changes will be communicated through reasonable service notices or site updates.