Privacy Policy

blessed.fund provides donor management and fundraising software to nonprofit organizations (“Organizations”). This policy explains how we handle information about the people who use blessed.fund: staff and volunteers of Organizations, donors who give through an Organization’s donation pages, and anyone who contacts us through our website.

When an Organization stores information about its donors in blessed.fund, the Organization decides what is collected and how it is used, and we process that information on the Organization’s behalf. If you are a donor and have questions about your records, please contact the Organization you gave to.

• Account information: name, email address, password (stored only as a secure hash), two-factor authentication settings, and the role you hold in your Organization.
• Donor information: details an Organization enters, imports, or collects on its donation pages, such as name, email address, phone number, mailing address, employer, giving history, pledges, tribute details, and notes.
• Payment information: donations are processed by Stripe or Square. Card and bank details are entered directly with those processors; we receive and store only references such as transaction IDs and the last four digits. For an Organization’s own bank account, we store the last four digits and an encrypted routing number.
• Inquiries: the information you submit through our contact form, such as your organization’s name, your name, email address, phone number, and website.
• Technical information: IP address, browser type, sign-in sessions, and a log of actions taken in the application, which we use for security and auditing.
• Email engagement: when an Organization sends email through blessed.fund, we record whether messages are delivered, opened, or clicked, and whether the recipient unsubscribes.

We use information to:

• Provide the service, including processing donations, issuing receipts and year-end statements, and sending email on an Organization’s behalf
• Keep accounts secure, including two-factor authentication, fraud prevention, and audit logs
• Respond to inquiries and provide support
• Communicate with Organizations about their accounts and our services
• Maintain, troubleshoot, and improve the platform

We do not sell personal information, and we do not share it with third parties for their own marketing. We share information only with the service providers that help us run blessed.fund, and only as needed to provide the service:

• Amazon Web Services — hosting and data storage in the United States
• Stripe and Square — payment processing
• Postmark — sending email and reporting delivery, opens, and clicks
• Anthropic — powering AI search; only the question you type and the structure of the database are sent, never donor names, addresses, or giving records
• Cloudflare — bot protection (CAPTCHA) on sign-in pages

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy will continue to apply.

We do not use advertising or third-party analytics trackers on blessed.fund. We store a sign-in token in your browser so you stay signed in, and our CAPTCHA provider may use browser storage to tell people from bots. Emails sent through blessed.fund contain open and click tracking so Organizations can see how their messages perform.

We protect information with encryption in transit, AES-256-GCM encryption for sensitive organization data such as payment credentials, two-factor authentication, role-based access controls, strict separation between Organizations, and audit logging. The platform runs in a private network on Amazon Web Services with automated daily backups. No system is perfectly secure, but we work to protect your information and will notify affected Organizations of a security incident as required by law.

We keep Organization and donor information for as long as the Organization’s account is active, or as needed to provide the service. Organizations can edit or delete donor records at any time. Audit logs are kept for up to seven years for security and accountability. When an Organization closes its account, we delete or anonymize its data within a reasonable period, except where we must keep it to meet legal obligations.

• Unsubscribe: every email blast includes an unsubscribe link, and we honor it automatically.
• Donors: you can view your giving history and download receipts through the donor portal. To correct or delete your records, contact the Organization you gave to.
• Account holders: you can update your profile in the application, or contact us to access or delete your information.

Depending on where you live, you may have additional rights under local law. Contact us and we will respond as required.

blessed.fund is intended for organizations and adults. We do not knowingly collect personal information from children under 13.

We may update this policy from time to time. When we do, we will change the “Last updated” date above, and for significant changes we will notify Organizations by email or in the application.

If you have questions about this Privacy Policy, please contact us at privacy@blessed.fund.