Privacy Policy
Your Privacy Matters
At AbleHearts, we're committed to protecting your personal information with the highest standards of security and transparency.
Last Updated: January 2024
GDPR Compliant
CCPA Compliant
Privacy at a Glance
✓ What We Do
- • Collect only necessary information
- • Use bank-level encryption
- • Never sell your data
- • Give you full control
✗ What We Don't Do
- • Share data with marketers
- • Store credit card numbers
- • Track you across websites
- • Send spam emails
Information We Collect
Personal Information
- Name, email address, and phone number
- Mailing address (for tax receipts)
- Demographic information (optional, for impact reporting)
Payment Information
- Credit card details (processed securely via Stripe)
- PayPal account information
- Cryptocurrency wallet addresses (for donation tracking)
- M-PESA phone numbers (Kenya donors)
Usage Data
- IP address and browser type
- Pages visited and time spent on site
- Referring websites and search terms
- Device information (mobile vs desktop)
Cookies & Tracking
- Essential cookies for site functionality
- Analytics cookies (Google Analytics) - opt-out available
- Preference cookies (language, theme)
- No third-party advertising cookies
How We Use Your Information
Primary Uses
- Process donations and send tax receipts
- Communicate updates about Mary & Lydia
- Send monthly impact reports with photos
- Respond to your questions and support requests
- Improve our website and donor experience
Legal Compliance
- Comply with IRS/CRA tax reporting requirements
- Maintain financial records for 7 years (USA) / 6 years (Canada)
- Respond to legal requests or court orders
- Prevent fraud and protect donor security
Marketing (with your consent)
- Send fundraising appeals (opt-out anytime)
- Share success stories and impact updates
- Invite you to special events or campaigns
- Request testimonials or feedback
How We Protect Your Data
Security Measures
- SSL/TLS encryption for all data transmission
- PCI-DSS Level 1 compliance for payment processing
- Secure password hashing (bcrypt)
- Regular security audits and penetration testing
- Two-factor authentication for admin accounts
- Automatic logout after 30 minutes of inactivity
Payment Security
- We NEVER store credit card numbers
- All payments processed by Stripe or PayPal (industry leaders)
- Cryptocurrency wallets use cold storage
- Bank transfer details encrypted in transit and at rest
Data Breach Protocol
- Immediate notification within 72 hours
- Free credit monitoring for affected donors
- Transparent disclosure of breach details
- Remediation plan and prevention measures
Third-Party Services
Payment Processors
- Stripe (credit cards) - Privacy Policy: https://stripe.com/privacy
- PayPal - Privacy Policy: https://www.paypal.com/privacy
- Binance Pay - Privacy Policy: https://www.binance.com/privacy
- M-PESA (Safaricom) - Privacy Policy varies by country
Analytics & Tools
- Google Analytics (anonymized IP) - Opt-out: https://tools.google.com/dlpage/gaoptout
- Vercel (hosting) - Privacy Policy: https://vercel.com/legal/privacy-policy
- Email service (Mailchimp/SendGrid) - for newsletters only
Social Media
- Twitter/X - if you interact with our tweets
- TikTok - if you watch or share our videos
- These platforms have their own privacy policies
Your Privacy Rights
Access & Control (USA - CCPA / Canada - PIPEDA)
- Request a copy of all data we have about you
- Correct inaccurate information
- Delete your account and all associated data
- Opt-out of marketing emails (keep donation receipts)
- Restrict processing of your data
- Data portability (download your information)
Cookie Preferences
- Accept all cookies
- Reject non-essential cookies
- Customize cookie preferences
- Access cookie settings anytime in footer
Communication Preferences
- Unsubscribe from fundraising emails (link in every email)
- Opt-out of phone calls
- Choose email frequency (weekly, monthly, quarterly)
- Select content types (impact updates only, all news, etc.)
Data Retention Policy
We keep your information only as long as necessary:
- • Donation records: 7 years (IRS requirement) / 6 years (CRA requirement)
- • Marketing emails: Until you unsubscribe
- • Account data: Until you request deletion
- • Analytics: 26 months (Google Analytics default)
International Data Transfers
AbleHearts operates internationally, connecting donors in USA/Canada with beneficiaries in Kenya. Your data may be transferred to:
🇺🇸 USA / 🇨🇦 Canada
Payment processing, donor management, tax receipts
🇰🇪 Kenya
Beneficiary information, impact reporting, M-PESA transactions
All transfers use encryption and comply with GDPR (EU), CCPA (California), and PIPEDA (Canada) standards.
Children's Privacy
AbleHearts does not knowingly collect information from children under 13 (USA) or 16 (EU). Our services are intended for adults.
If you're a parent and believe your child has provided us with information, please contact us immediately at donations@able-hearts.org and we'll delete it promptly.
Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. When we do:
- We'll update the "Last Updated" date at the top
- For material changes, we'll email you (if you're on our list)
- We'll post a notice on our homepage for 30 days
- Your continued use constitutes acceptance of changes