Privacy Policy

Draft for pilot use — professional GDPR/CCPA and US nonprofit privacy review is still required before paid bookings open.

1. What we collect

Account details (name, email, phone, country), profile information you choose to add, program applications, reviews and forum posts, and technical data (log and analytics data). Payment card details are processed by Stripe and never stored on our servers.

2. How we use it

To operate your account, process applications and deposits, share necessary applicant details with the host organization you apply to, send transactional emails, and improve the platform. We do not sell your personal data.

3. Public profile

Your volunteer profile (name, photo, completed programs, reviews) is public by default and can be made private at any time in your account settings.

4. Service providers

We use trusted processors to run the platform: Vercel (hosting), Stripe (payments), and Resend (email). Each processes data under its own privacy terms.

5. Your rights

You can access, correct, or delete your personal data, and object to or restrict certain processing. EU/UK residents have rights under the GDPR; California residents under the CCPA. Contact us via the contact form to exercise these rights.

6. Retention & security

We keep data only as long as needed for the purposes above, protect it with industry-standard measures (encrypted transport, hashed passwords), and delete or anonymize it when no longer required.

7. Messages and contact protection

Pre-booking messages are stored so volunteers and Hosts can coordinate. The platform masks emails, phone numbers, websites, and common attempts to move communication off-platform before a confirmed booking, and records each masking event for safety and leakage review. Authorized contact details are disclosed only after the required booking state is reached.

8. Deletion and complaints

Use the contact form to request access, correction, export, deletion, or restriction. Some records may be retained where required for security, dispute handling, legal obligations, or nonprofit accounting. You may also complain to the privacy regulator that applies where you live.