CharityPack Privacy Policy

Effective Date: March 21, 2026  |  Last Updated: March 21, 2026

CharityPack Inc. ("CharityPack," "we," "us," or "our") is committed to protecting the privacy of personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), Canada's Anti-Spam Legislation (CASL), the US CAN-SPAM Act, the US Federal Trade Commission Act, and all other applicable Canadian and US privacy laws.

This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with the CharityPack platform — a cloud-based nonprofit CRM and fundraising management application ("Services").

This Policy applies to two distinct categories of personal information:

  • Account Holder Data: Personal information collected directly from individuals who register for, access, or administer the CharityPack platform on behalf of their organization ("Account Holders").
  • Customer Data: Personal information uploaded to or processed through the platform by CharityPack's customers — charitable and nonprofit organizations ("Customers"). This includes information about donors, volunteers, beneficiaries, and other individuals ("Constituents") that Customers manage using the Services.

Important distinction regarding roles:

For Account Holder Data, CharityPack acts as a data controller — we determine the purposes and means of processing.

For Customer Data (Constituent data uploaded by nonprofits), CharityPack acts as a data processor — we process that data solely on behalf of and under the direction of the Customer organization, which is the data controller. Customers are responsible for the lawfulness of their own data collection, for obtaining all required consents from their Constituents, and for ensuring their use of the Services complies with applicable privacy laws.

CharityPack's privacy practices are consistent with the US Federal Trade Commission Act's prohibition on unfair or deceptive trade practices.

CharityPack Inc.

PO BOX 99900 WX 325 212, RPO Brittany Glen, Mississauga ON L5M 0T6, Canada
Website: charitypack.app

Designated Privacy Officer

Philip Manzano
Email: privacy@charitypack.app
Mailing Address: CharityPack Inc., PO BOX 99900 WX 325 212, RPO Brittany Glen, Mississauga ON L5M 0T6, Canada

All privacy inquiries, access requests, correction requests, or complaints should be directed to the Privacy Officer above. We will acknowledge receipt within 5 business days and respond substantively within 30 days.

Regulatory Bodies

If you are not satisfied with our response to a privacy inquiry, you may escalate your complaint to:

  • Office of the Privacy Commissioner of Canada: www.priv.gc.ca | 1-800-282-1376
  • Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca (for Quebec residents)
  • US Federal Trade Commission: www.ftc.gov (for US-based individuals or organizations)

3.1 Account Holder Data

When an individual registers for or uses the CharityPack platform on behalf of their organization, we may collect:

  • Identity Information: First name, last name, job title
  • Contact Information: Email address, phone number
  • Organization Information: Charity/nonprofit name, registered charity or tax-exempt number, website
  • Account Credentials: Username, hashed password (we do not store plaintext passwords)
  • Billing & Payment Information: Name on card, billing address, last four digits of payment card (full payment card details are processed by our payment processor Stripe and are not stored on our servers)
  • Communications: Support tickets, feedback, and correspondence with CharityPack

3.2 Usage & Technical Data

When Account Holders use the Services, we automatically collect:

  • Log Data: IP address, browser type and version, operating system, referring URLs, pages visited, time and date of access
  • Device Information: Device type, screen resolution, hardware model
  • Usage Analytics: Feature interactions, session duration, click patterns (collected via Base44's native platform analytics to improve the platform)
  • Cookies and Tracking Technologies: See Section 11 for details

3.3 Customer Data (Constituent Data — Processor Role)

When Customer organizations use the Services to manage their operations, they may upload personal information about their Constituents, which may include:

  • Donor names, contact information, and giving history
  • Volunteer names, contact details, and availability records
  • Beneficiary or program participant information
  • Event attendance records
  • Communications history

CharityPack does not control the content of Customer Data. We process it solely on the Customer's instructions and as described in this Policy. We do not access Customer Data except as necessary to provide the Services, respond to support requests, or as required by law.

We collect personal information through the following means:

  • Directly from you: When you register, complete forms, contact support, or otherwise provide information voluntarily
  • Through the platform: When you or your Authorized Users use the Services (usage and log data)
  • From your organization: When your organization's administrators configure accounts or upload data
  • From third-party integrations: When you connect the platform to third-party services (e.g., Stripe for payments), subject to those services' own privacy policies
  • Automatically via cookies and similar technologies: As described in Section 11

We collect only the personal information that is necessary for the identified purposes. We do not collect personal information indiscriminately.

CharityPack collects and uses personal information for the following specific, identified purposes only:

PurposeTypes of Data Used
Service Delivery — To provide, operate, and maintain the CharityPack platformAccount data, Customer Data
Account Management — To create, manage, and administer your accountAccount data
Billing & Payments — To process subscription fees, issue invoices, manage renewalsBilling data
Customer Support — To respond to inquiries, troubleshoot technical issuesAccount data, communications data
Security & Fraud Prevention — To detect, investigate, and prevent unauthorized access, abuse, and fraudLog data, usage data
Legal Compliance — To comply with applicable laws, regulations, and court ordersAs required
Product Improvement — Using only aggregated, anonymized, de-identified data that cannot reasonably identify any individual or organizationAnonymized analytics
Communications — To send service notices, product updates, and (with consent) marketing communicationsContact information

We will not use personal information for any purpose beyond those listed above without first obtaining your express consent, or as otherwise required or permitted by applicable law.

AI and Automated Processing: CharityPack does not use Customer Data or Constituent Data to train machine learning or AI models. Any AI-assisted features within the platform operate solely on your own organization's data and do not share or pool data across customers.

CharityPack processes personal information on the following lawful bases under PIPEDA and applicable Canadian and US law:

  • Consent: Where you have provided express consent (e.g., for marketing communications)
  • Contractual Necessity: Where processing is necessary to perform our agreement with you or your organization
  • Legitimate Interest: Where processing is necessary for our legitimate business interests (e.g., security, fraud prevention, platform analytics) and those interests are not overridden by your privacy rights
  • Legal Obligation: Where processing is required to comply with applicable law

For Quebec residents, we rely on free, informed, and specific consent for any processing beyond what is strictly necessary to deliver the Services, consistent with Law 25.

CharityPack does not sell, rent, trade, or share personal information with third parties for their own marketing or commercial purposes. This applies to all users, including California residents under the California Consumer Privacy Act (CCPA/CPRA).

We may share personal information with the following trusted subprocessors who assist us in delivering the Services:

SubprocessorPurpose
Render (via Base44) — United StatesCloud hosting and data storage
Cloudflare — United StatesContent delivery network and network security
Base44 — United StatesApplication platform infrastructure and native usage analytics
StripeSubscription billing and payment processing
ResendTransactional and notification email delivery

All subprocessors are contractually required to:

  • Protect personal information to a standard at least equivalent to this Policy
  • Process data only for the specific purposes CharityPack authorizes
  • Implement appropriate technical and organizational security measures
  • Delete or return data upon termination

Subprocessor Updates: We will provide at least 30 days' advance notice to Customers before adding new subprocessors that process Customer Data or Constituent Data.

Other Permitted Disclosures

  • Legal Requirements: We may disclose personal information if required to do so by law, regulation, court order, or governmental authority
  • Protection of Rights: To protect the rights, property, or safety of CharityPack, our Customers, or others
  • Business Transactions: In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, with advance notice provided to affected users

CharityPack's platform infrastructure is hosted exclusively on servers located in the United States, operated by our infrastructure provider Render and delivered via Cloudflare's content delivery network. CharityPack does not currently offer Canadian or regional data residency options. All personal information processed through the Services — including personal information of Canadian and Quebec residents — is transferred to and stored in the United States.

When personal information is transferred outside Canada, CharityPack ensures it receives protection comparable to that required under PIPEDA through:

  • Contractual data processing agreements with all subprocessors
  • Review of each subprocessor's privacy and security practices
  • Ongoing monitoring of subprocessor compliance

For Quebec residents: Because all data is processed on servers located in the United States, every use of the Services by a Quebec-based organization constitutes a cross-border transfer under Quebec Law 25. CharityPack conducts Privacy Impact Assessments (PIAs) for these transfers as required by Law 25. Customers may request information about cross-border transfer protections by contacting our Privacy Officer at privacy@charitypack.app.

CharityPack retains personal information only for as long as necessary to fulfill the purposes identified in this Policy, or as required by law. The following retention schedule applies:

Data TypeRetention PeriodBasis
Account & Profile DataDuration of active subscription + 30 days post-terminationService delivery
Billing & Financial Records7 years from transaction dateCRA requirements (Canada) / IRS requirements (US)
Usage Logs & Analytics12–24 months from creationProduct analytics and security
Support & Communication Records3 years from closure of ticketDispute resolution
Customer / Constituent DataDeleted within 30 days of account termination, or upon written requestData minimization (processor role)
Security & Audit Logs12 monthsFraud prevention and incident response
Backup CopiesUp to 90 days from active deletion, then permanently destroyedBusiness continuity

Upon account termination, Customers may request a data export of their Constituent Data before deletion. CharityPack will make data available for export for 30 days following termination.

Under PIPEDA and applicable Canadian and US law, individuals have the following rights with respect to their personal information. Quebec residents have additional rights under Law 25.

Rights available to all individuals

  • Right of Access: Request a copy of the personal information we hold about you, along with information about how it is being used
  • Right of Correction: Request correction of inaccurate, incomplete, or outdated personal information
  • Right to Withdraw Consent: Withdraw consent for any processing activity that relies on consent, at any time, without penalty (subject to legal or contractual limitations)
  • Right to Lodge a Complaint: File a complaint with the Office of the Privacy Commissioner of Canada, a relevant provincial regulator, or the US Federal Trade Commission

Additional rights for Quebec residents (Law 25)

  • Right of Deletion (Erasure): Request deletion of personal information where it is no longer necessary for the purposes for which it was collected
  • Right of Portability: Receive your personal information in a structured, commonly used, machine-readable format
  • Right to De-Indexation: Request that we cease disseminating your personal information or de-index it where continued use causes you harm
  • Right to Object to Automated Decision-Making: Object to decisions made solely through automated means that produce legal or significant effects on you

Additional rights for California residents (CCPA/CPRA)

  • Right to Know: Request disclosure of the categories and specific pieces of personal information collected about you, the sources, the purposes, and the third parties with whom it is shared
  • Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions
  • Right to Correct: Request correction of inaccurate personal information
  • Right to Opt-Out of Sale or Sharing: CharityPack does not sell or share personal information as defined under CCPA/CPRA. No opt-out action is required
  • Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your CCPA rights

How to exercise your rights

Submit a written request to privacy@charitypack.app with sufficient information to verify your identity. We will:

  • Acknowledge your request within 5 business days
  • Respond substantively within 30 days (or notify you of an extension if the request is complex)
  • Explain clearly if we cannot fulfill the request and why

You will not face any discrimination, service degradation, or adverse consequences for exercising your privacy rights.

CharityPack uses cookies and similar tracking technologies to operate and improve the Services.

Cookie TypePurposeRetention
Strictly NecessaryAuthentication, security, session managementSession / short-term
FunctionalRemembering preferences and settingsUp to 12 months
AnalyticsUnderstanding how the platform is used via Base44's native analytics (anonymized)Up to 24 months
Marketing(Only with consent) Targeted communicationsAs consented

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impact the functionality of the Services. For Quebec residents, consent for non-essential cookies is obtained in accordance with Law 25.

CharityPack implements technical and organizational security measures appropriate to the sensitivity of the personal information we process. These measures include:

  • Encryption in Transit: All data transmitted between your browser/app and our servers is encrypted using TLS 1.2 or higher (HTTPS)
  • Encryption at Rest: Sensitive data stored on our servers is encrypted
  • Access Controls: Role-based access controls (RBAC) limit data access to authorized CharityPack personnel on a need-to-know basis
  • Authentication: Multi-factor authentication (MFA) is available and recommended for all account administrators
  • Vulnerability Management: Regular security assessments and timely security patching
  • Incident Response: Documented procedures for detecting, containing, and responding to security incidents
  • Employee Training: Regular privacy and security training for all personnel with access to personal information
  • Subprocessor Oversight: Contractual security obligations and periodic review of all subprocessors

No system is 100% secure. If you have reason to believe your account or information has been compromised, contact us immediately at info@charitypack.app.

In the event of a privacy breach involving personal information under our control that poses a real risk of significant harm to individuals, CharityPack will:

  1. Notify the Office of the Privacy Commissioner of Canada as soon as feasible after discovering the breach
  2. Notify affected individuals directly with clear information about the nature of the breach, the types of information involved, steps they can take to protect themselves, and CharityPack's contact information
  3. For breaches involving Quebec residents' data: Notify the Commission d'accès à l'information (CAI) in accordance with Law 25's requirements
  4. For breaches involving US residents' data: Notify affected individuals and relevant state authorities in accordance with applicable US state breach notification laws, and in no event later than 72 hours of discovery
  5. Maintain a breach register documenting all incidents regardless of whether the notification threshold is met

Customer Notification: We will notify affected Customer organizations within 72 hours of discovering a breach that involves their Customer Data or Constituent Data.

The CharityPack platform is designed for use by organizations and their authorized adult personnel. We do not knowingly collect personal information directly from individuals under the age of 18.

Under 13 (COPPA — US): In accordance with the US Children's Online Privacy Protection Act (COPPA), CharityPack does not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly.

Under 14 (Quebec Law 25 — Canada): Quebec Law 25 prohibits the collection of personal information from children under 14 without parental or guardian consent.

If Customer Data includes personal information about individuals under 13 (or under 14 for Quebec residents) — for example, as part of a youth program or beneficiary database — the Customer organization is solely responsible for obtaining required parental or guardian consent under applicable law.

This section provides additional disclosures required under US federal and state privacy law for CharityPack's US-based customers, Authorized Users, and Constituents.

15.1 US Federal Trade Commission

CharityPack's privacy practices are consistent with the FTC Act's prohibition on unfair or deceptive trade practices. CharityPack does not engage in any privacy practice that contradicts the representations made in this Policy.

15.2 CAN-SPAM Act

CharityPack complies with the US CAN-SPAM Act in all commercial electronic messages sent to US-based recipients. All such messages will include CharityPack's physical mailing address, a clear identification that the message is an advertisement or promotional communication (where applicable), and a simple, functioning opt-out mechanism. Opt-out requests from US recipients will be honored within 10 business days.

15.3 State Privacy Laws — Nonprofit Customer Exemption

Most US state comprehensive privacy laws — including the California Consumer Privacy Act (CCPA/CPRA), Virginia Consumer Data Protection Act (VCDPA), Texas Data Privacy and Security Act, Utah Consumer Privacy Act, Iowa Consumer Data Protection Act, and Montana Consumer Data Privacy Act — include broad exemptions for nonprofit organizations. This means that most of CharityPack's nonprofit and charitable customers are themselves exempt from these state laws with respect to their Constituent data management activities. CharityPack recommends that customers confirm their own compliance obligations with qualified legal counsel.

15.4 California Residents (CCPA/CPRA)

For California residents, the following additional disclosures apply:

Categories of personal information collected in the preceding 12 months:

  • Identifiers (name, email, IP address)
  • Commercial information (subscription and billing records)
  • Internet or other electronic network activity information (usage logs, analytics)
  • Professional or employment-related information (job title, organization name)

Do Not Sell or Share: CharityPack does not sell or share personal information as those terms are defined under CCPA/CPRA. No opt-out action is required.

Sensitive Personal Information: CharityPack does not collect sensitive personal information as defined under CCPA/CPRA beyond what is strictly necessary to provide the Services, and does not use or disclose it for purposes other than those permitted under the CPRA.

To exercise your California privacy rights, contact privacy@charitypack.app. CharityPack will not discriminate against you for exercising these rights.

15.5 Colorado and New Jersey Residents

Colorado's Colorado Privacy Act (CPA) and New Jersey's New Jersey Data Privacy Act do not include broad nonprofit exemptions. Residents of Colorado and New Jersey who are Constituents within a nonprofit's CharityPack database may exercise applicable rights (access, correction, deletion, portability, opt-out of targeted advertising) by contacting our Privacy Officer at privacy@charitypack.app. CharityPack will work with the relevant Customer organization to fulfill such requests.

Canada (CASL)

In accordance with Canada's Anti-Spam Legislation (CASL), CharityPack will only send commercial electronic messages to individuals from whom we have obtained valid express or implied consent. Each commercial electronic message we send will include CharityPack's legal name and contact information, and a clear, simple, and free mechanism to unsubscribe. Unsubscribe requests will be honored within 10 business days.

United States (CAN-SPAM)

CharityPack complies with the CAN-SPAM Act for commercial email sent to US recipients. Each such message will include a valid physical postal address and a functioning opt-out link. Opt-out requests will be honored within 10 business days.

CharityPack may update this Privacy Policy from time to time to reflect changes in our practices, Services, or applicable law. When material changes are made, we will:

  • Update the "Last Updated" date at the top of this Policy
  • Provide notice via email to the primary account contact at least 30 days before changes take effect
  • Where required by applicable law, seek renewed consent for new processing activities

Continued use of the Services after the effective date of any updated Policy constitutes acceptance of the changes. If you do not agree with the updated Policy, you may terminate your subscription in accordance with our Terms of Service.

For questions, concerns, or requests related to this Privacy Policy or CharityPack's privacy practices:

Philip Manzano — Privacy Officer

CharityPack Inc.
PO BOX 99900 WX 325 212, RPO Brittany Glen
Mississauga ON L5M 0T6, Canada
Email: privacy@charitypack.app

For general support inquiries: support@charitypack.app

For security-related concerns: info@charitypack.app

CharityPack Inc. — charitypack.app — Last Updated: March 21, 2026

Questions? Contact us at privacy@charitypack.app