Privacy Policy

This policy explains what information DIY Your Fundraiser collects, how we use it, and the choices you have. DIY Your Fundraiser is a service of Invoke Technologies, Inc. (“Invoke,” “we,” “us”), which is responsible for the information described here. The same policy applies on the fundraising sites the platform runs under other names, wherever they say they are powered by Invoke Technologies, Inc..

Information we collect

• Organizers: name, email, organization details, and Stripe account status.
• Participants and their contacts: names, email addresses, optional phone numbers, and fundraising details entered by organizers.
• Volunteers: name, email address, optional phone number, the shifts, jobs and items they sign up for, whether they were checked in and their hours, and for a volunteer under 18, a parent or guardian’s email address.
• Auction bidders: name, email address, optional phone number, bidder number, the bids they place (including the most they’ll bid, which is never shown to anyone), what they win and pledge, and whether they paid and picked up. Bid histories show bidder numbers, never names.
• Auction item donors: the name, business, email, phone number and mailing address an organizer enters for whoever gave an item, so the organization can thank them.
• Donors: name, email, donation amount, optional message, and anonymity preference. Card details are collected and processed by Stripe and never stored on our servers.
• Email engagement: delivery, open, click, bounce, and unsubscribe events for campaign emails.
• Acceptance of our terms: when an organizer, or someone signing up to fundraise, accepted our Terms of Service and this policy, and which version.
• Activity records: what was done in the Service, by whom, and when, so problems can be traced and corrected.

How we use information

To operate fundraising campaigns, process payments, send campaign emails on organizers’ behalf, and support and secure the Service.

How we share information

We don’t sell personal information, and we don’t use advertising trackers. We share information only as needed to run the Service:

• Plausible Analytics counts visits to this website and to our dashboard, so we can see which pages are used. It sets no cookies and doesn’t identify or follow visitors. It receives the page’s general address (never names, links from your emails, or anything you type), the referring site, and your browser and device type. Your IP address is used only to work out your country and isn’t stored.
• Stripe processes online donations and pays organizations. It receives the donor’s payment details, name, email, and the donation amount, and collects an organization’s banking and identity details directly during onboarding.
• SendGrid delivers our emails. It receives each recipient’s email address and the email’s content, and reports back whether the email was delivered, opened, or clicked.
• Amazon Web Services hosts our servers, database, and backups in the United States.
• Organizations see the donations to their campaigns, including donors’ names, emails, and messages, so they can thank donors and keep their records. A donor who gives anonymously is not named publicly.
• When the law requires it, or to protect the Service, donors, or organizations from fraud or abuse.

Information is sent to these providers over encrypted connections, and they handle it under their own privacy and security terms.

How we protect information

• Every page and every connection to our servers uses encryption (HTTPS).
• Card details go directly from the donor’s browser to Stripe and never reach our servers.
• Passwords are stored only as secure hashes, never in readable form.
• Our database is encrypted at rest, isn’t reachable from the internet, and is backed up daily to encrypted storage.
• Organizers can see only their own organizations’ information, and changes are logged with who made them and when.

No system is perfectly secure. If we learn of a breach affecting your information, we will notify you as the law requires.

How long we keep information

• Campaign, participant, and donation records are kept while the organization uses DIY Your Fundraiser. Organizations rely on donation records for their bookkeeping and donors’ receipts, so we don’t delete them automatically. To ask us to delete information, see “Your choices” below.
• Activity records, which list the actions taken in the Service and the details entered with them (which can include names and email addresses), are deleted after 2 years.
• Payment notifications from Stripe, kept so a payment’s processing can be checked and repeated if it failed, are deleted after 2 years.
• Email delivery records (whether each email was delivered, delayed, opened, or bounced) are deleted after 2 years.
• Change history, which shows how records changed and who changed them, has no fixed deletion date, so problems can be traced back to their cause.
• Server logs, technical records of requests to our servers used to find and fix problems, are deleted after 30 days.
• Backups of our database are deleted after 14 days, and copies of our servers’ disks after 35 days, so information deleted from the Service can remain in a backup for up to 35 days.

Children’s information

Participants are often students and young athletes, so many are under 18. Children don’t create accounts on DIY Your Fundraiser, and we don’t knowingly collect personal information directly from children under 13. A participant’s information is entered by the organizer of their campaign, who is responsible for having permission from the participant’s parent or guardian to do so.

• What’s public: a participant’s page shows the name the organizer enters, an optional photo, an optional personal story, and their fundraising progress. Email addresses and phone numbers are never shown publicly. For younger participants we recommend a first name and last initial.
• Photos: organizers can hide or remove a participant’s photo at any time.
• Emails: campaign emails about a participant go only to the contacts the organizer lists for them, such as the participant and a parent or guardian, and each email has an unsubscribe link.
• Event passes: a reward pass shows only the participant’s first name and last initial.
• Volunteering: a volunteer under 18 signs up with a parent or guardian’s email address. The parent confirms the sign-up and gets every email about it. A volunteer sign-up page shows only a first name and last initial.

A parent or guardian can ask the organization or us at support@diyyourfundraiser.com to review, correct, hide, or remove their child’s information, and we will work with the organization to do so.

Your choices

Recipients can unsubscribe from campaign emails at any time. To access or delete information, contact us.

Contact

hello@diyyourfundraiser.com