Your data, handled with care.

We collect the minimum data needed to verify identity, route payments, and prevent fraud:

• Account details — name, email, role, business affiliation.
• Verification data — KYC/KYB documents, beneficial ownership, tax IDs.
• Payment metadata — request amounts, vendor relationships, payout destinations.
• Device & usage telemetry — IP, browser, session activity for security monitoring.

Your data powers routing decisions, AI verification, regulatory reporting, and customer support. We never sell personal data, and we never use donor or vendor records to train third-party models.

• Sub-processors — Supabase (data), Stripe (payments), Resend (mail), Lovable Cloud (hosting).
• Regulators — when required by law, subpoena, or financial-crimes reporting obligations.
• Business partners — only with your explicit consent or as part of a verified payment route.

You can request access, correction, export, or deletion of your personal data at any time. Residents of the EU, UK, California, and other regulated jurisdictions retain all rights granted under GDPR, UK-GDPR, and CCPA/CPRA.

Verification records are retained for 7 years to satisfy AML/BSA requirements. Operational logs are retained for 18 months. Marketing data is purged within 30 days of unsubscribe.