DonationPay
- The documents do not say whether your data trains AI.
- The policy rules out using your data for targeted ads.
- Data is shared only with the providers who run the service.
- The documents do not say who can read your content.
They collect donor, payment, and device data for nonprofits, share it with the charity and Stripe, and keep it as long as needed.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Donor details, donation amounts, form answers, payment data via Stripe, plus IP and device logs.
Read the exact line
Privacy policy
“When you access the Services, we may automatically collect information such as: • IP address; • browser type and version; • device and operating-system information;”
Training
They process donations, fight fraud, run accounts, and improve the product; they say they do not use donor data for ads.
Read the exact line
Privacy policy
“DonationPay also does not use or disclose Donor personal information for cross-context behavioral advertising as those concepts are defined under applicable California privacy law.”
Sharing
The charity you donate to, Stripe, and vendors like hosting and email get the data; they say they do not sell it for money.
Read the exact line
Privacy policy
“As of the Effective Date of this Privacy Policy, DonationPay does not sell personal information for money.”
Kept
They keep it as long as they think they need it for records, taxes, fraud, and the charity; backups linger a while.
Read the exact line
Privacy policy
“DonationPay retains personal information for as long as reasonably necessary for the purposes described in this Policy, including to:”
Controls
You can email them for access or deletion, but donor requests may be sent to the charity instead.
Read the exact line
Privacy policy
“Because DonationPay often processes Donor information on behalf of an Organization, we may direct a privacy request concerning an Organization’s donor records to that Organization.”
Fine print
The policy is dated; they may give extra notice for big privacy changes. Terms on suing, refunds, and accounts are not here.
Read the exact line
Privacy policy
“If changes materially affect how we process personal information, we may provide additional notice where appropriate or required by law.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Email a privacy request (access, correction, or deletion)
Privacy Officer, DonationPay Inc., support@donationpay.org
Read the charity’s own privacy policy before donating
The Organization’s privacy policy, as DonationPay directs donors to review it
Use a legally valid opt-out signal such as Global Privacy Control if it applies
Browser GPC; they say they will process it where law requires
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Once the charity has your donor info, DonationPay says it is not on the hook for what that charity does with it.
Read the exact line
Privacy policy
“DonationPay is not responsible for an Organization's independent use of information after it receives that information from DonationPay.”
For example, a charity could email you later using the address you typed on the donation form, under that charity’s own rules.
There is no set delete-by date. They keep data for services, taxes, fraud, disputes, and supporting charities.
Read the exact line
Privacy policy
“DonationPay retains personal information for as long as reasonably necessary for the purposes described in this Policy, including to:”
For example, a one-time gift could stay in their records for years because of tax or fraud rules.
Asking DonationPay to delete your donor record may just get forwarded to the charity.
Read the exact line
Privacy policy
“Because DonationPay often processes Donor information on behalf of an Organization, we may direct a privacy request concerning an Organization’s donor records to that Organization.”
For example, emailing support@donationpay.org about a gift might send you to the nonprofit instead of deleting it on the spot.
The charity can pipe your data into other tools it picks.
Read the exact line
Privacy policy
“An Organization may choose to connect DonationPay to another service, such as a CRM, accounting platform, automation service, email provider, or other integration.”
For example, your name and email could land in the charity’s Mailchimp or Salesforce account.
They can pull extra data from outside databases to check identity, fraud, and compliance, mainly for organization accounts.
Read the exact line
Privacy policy
“We may also obtain information from Stripe, public records, nonprofit databases, government sources, sanctions or compliance databases, fraud-prevention providers, and other sources”
For example, they might check a nonprofit’s tax ID against government lists before allowing fundraising.
They say they do not sell your data for cash, at least as of this policy date.
Read the exact line
Privacy policy
“As of the Effective Date of this Privacy Policy, DonationPay does not sell personal information for money.”
For example, they claim they would not sell a donor email list to a marketing company for money.
They say they do not use donor data to follow you around the web with ads.
Read the exact line
Privacy policy
“DonationPay also does not use or disclose Donor personal information for cross-context behavioral advertising as those concepts are defined under applicable California privacy law.”
For example, donating on a hosted form should not, under this policy, put you in a Facebook-style ad audience from DonationPay.
They describe basic security steps, including encryption and limits on who can see data.
Read the exact line
Privacy policy
“These measures may include encryption, access controls, authentication controls, monitoring, logging, infrastructure security, payment-industry security practices, and restrictions on employee and contractor access.”
For example, they say staff access to donor records is supposed to be restricted, not open to everyone.
They say the product is not meant for kids under 13 and they do not knowingly collect from them for their own purposes.
Read the exact line
Privacy policy
“DonationPay’s Services are not directed to children under 13.”
For example, a 12-year-old should not be filling out these donation forms, and charities are told not to set forms up that way.
They update the date when the policy changes and might give extra notice for big changes, but it is not a firm promise of advance email to everyone.
Read the exact line
Privacy policy
“If changes materially affect how we process personal information, we may provide additional notice where appropriate or required by law.”
For example, they could change how they use data and only bump the “Last Updated” date unless the law requires more.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
How we got here · grade B · score 50/100 · 15 of 15 policy answers backed by a verified quote · 8 not stated
What does the app collect beyond what it needs to work?
They collect donor and payment details plus automatic device, IP, browser, and log data. Organizations can add extra form fields.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They say they do not use or disclose donor personal information for cross-context behavioral advertising. Cookies are described for running and measuring the service.
Do they sell or share your data, and can you opt out?
They say they do not sell personal information for money. Data goes to the charity, Stripe, service providers, and integrations the charity turns on.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
They keep data as long as reasonably necessary. Deletion is by request, often routed to the charity, and backups can linger.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe encryption, access controls, monitoring, and payment-industry practices, but no independent audit or leak history.
Is there a real age gate, and are teens protected?
They say the services are not directed to children under 13 and they do not knowingly collect from them for their own purposes. No age-check method is described.
Will they tell you when the rules change, and is the policy specific?
The policy has effective and last-updated dates. They may give extra notice for material changes where they think it is appropriate or required.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 2,536 words at a professional or legal expert level (Flesch reading ease 4.8).
