Collective Privacy Policy

We collect information in three ways: information you give us directly, information we receive from services you connect to Collective, and information collected automatically when you use the Service.

Information you give us

When you create an account, set up an organization, or contact us, we collect information you choose to provide, which may include:

• Your name, email address, and phone number
• Your organization’s name, address, mission description, and tax-exempt status (for nonprofit organizations)
• Profile photos and other images you upload
• Posts, captions, comments, and other content you publish on Collective
• Payment information (handled directly by our payment processor, Stripe; we do not store full card numbers)
• Any other information you choose to provide in support requests, surveys, or community submissions

Where you live

When you sign up we ask for your neighborhood and up to three nearby ones, or your city if you live outside the places we cover. If you choose to share your device's location, we use it once to find your neighborhood and keep only the neighborhood and city, not your exact location.

Notifications

If you turn on notifications in the Collective app, we keep your device's push token and the alerts you choose (such as news from organizations you follow, event reminders, or notes from your family), and send them through Apple's and Google's notification services.

LinkedIn and your work

You can connect your LinkedIn account. LinkedIn then shares your name, email address and profile photo with us. To fill in your work, we may also look up your public professional profile (job title, employer, photo and general location) from a business data provider, using your email address or a LinkedIn link you give us, and ask you whether it is you. Nothing from it shows on your profile until you confirm it. If you confirm that you work at an organization on Collective, that organization is asked to confirm you as its staff before you appear on its page.

What you see on Collective

We count which posts and organization pages were on your screen, using your account or a random identifier for your browser or device, so we can tell organizations how many people saw each organization's work. Organizations see only totals, never who saw what.

Organizations you give to

When you donate to an organization through Collective, that organization sees your name and your donation so it can thank you, and keeps them with its own records of you. If you choose “Give anonymously” for a donation or for your monthly giving plan, the organization sees only that “A supporter” gave: never your name, and the amount is never connected to you. A note you add goes as “A supporter”'s too. “Show me as a supporter” puts your photo and first name on an organization's public page, never an amount; giving anonymously turns it off.

Giving together

If you give together with family or friends, we keep the names of the people you add, for a child the first name and age you enter, each member's part of the family's giving and where it goes, and the notes members write about those choices. In a group, members see each other's names and which organizations each chose, never amounts. See Section VIII for children.

Information from connected services

Collective lets nonprofits connect third-party services to streamline their operations. When you connect a service, that provider sends us information based on the permissions you authorize. We collect only what we need to deliver the integration.

Instagram data

If your organization connects an Instagram Business or Creator account, we request a single permission (instagram_business_basic) and use it to read the following fields from Meta's Instagram Graph API:

• Profile fields: id, username, account_type, name, biography, profile_picture_url, website, media_count, followers_count
• Media fields (per post): id, caption, media_type, media_url, thumbnail_url, timestamp, permalink, like_count, comments_count
• Engagement fields, refreshed periodically: like_count, comments_count

We also store the long-lived Instagram access token your organization issues during the OAuth flow, encrypted at rest in our database, and refresh it before expiry. The integration is read-only: we do not publish, comment, message, follow, or otherwise modify any data on your Instagram account. You can disconnect at any time (see Section VII).

Other connected services

You may also connect Stripe (for payments and donor records), email providers, and other integrations from time to time. The data we receive is described in the authorization screen presented when you connect each service. We treat that data with the same protections described in this Policy.

Staff can also connect their own Google Calendar or Microsoft Outlook calendar. Section V explains exactly what we read and keep.

Supporter lists and CRMs

A nonprofit can connect its donor database (for example Bloomerang) or upload a file of its supporters. When it does, we keep that organization's list so we can show its staff who they already know, remove duplicates, and note where each supporter came from. For each supporter we may keep the fields the organization shares with us, such as name, email address, giving history and the date they were added.

• Each organization’s list is encrypted with a key that belongs to that organization alone, so no other organization’s data can open it
• To recognize the same person across sources, we compare one-way hashes of email addresses rather than the addresses themselves
• A list is visible only to staff of the organization that provided it, except for the supporters that organization chooses to thank publicly (below). We never show one organization’s list to another organization, and we never sell or rent it
• We only write changes back to an organization’s CRM if that organization turns this on

Thanking supporters publicly. An organization can choose supporters from its own list, or people on Collective who support it, to thank by name in the Supporters section of its public Profile on Collective. We show only a first name and last initial, and a photo only if the person added one to Collective. We never show an amount. We do not show anyone who has asked to be hidden or who chose not to be shown on Collective, anyone the organization's records mark as do not contact, opted out or deceased, anyone we believe is under 18, or anyone who gave to that organization anonymously through Collective.

The organization chooses who is shown. To come off every Profile on Collective, email team@getcollective.io. To come off one Profile, ask that organization or use the “Not you? Hide” link under its Supporters.

Filling in supporter records. An organization can ask us to fill in missing details on its own supporters' records, such as role, employer, LinkedIn profile, location and photo. We first use what we already hold: the supporter's own Collective profile (only what they share with organizations, and never their email address), the organization's other lists, and information nonprofits have published. If the organization chooses, we also look the supporter up by the email address on its list with third-party data providers (currently Apollo and Reverse Contact). We never look up anyone the organization's records mark as do not contact. What we find is kept with that organization's list, under its key, with where each detail came from, and is visible only to its staff.

The organization that provided a list controls it. When it disconnects a source or removes a file, we delete the supporters we kept from it within 30 days. A supporter who wants their information removed can ask the organization or email team@getcollective.io.

Information collected automatically

When you visit Collective, our servers and our hosting provider automatically collect standard log information, including:

• IP address and approximate location derived from it
• Browser type and version, operating system, and device type
• Referring URL, pages visited, and time spent
• Cookies and similar technologies (see our Cookie disclosure below)

We use this information to operate the Service, prevent fraud and abuse, and improve the product. We do not use it to build advertising profiles about you.

Cookies

We use a small number of cookies and similar technologies to keep you signed in, remember your preferences (such as theme and last-used organization), and measure aggregate usage. You can disable non-essential cookies in your browser settings; essential cookies are required for sign-in.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Authenticate you and protect your account
• Display your organization’s page, posts, programs, and contact information to your supporters
• Process donations, subscriptions, and other transactions through Stripe
• Send transactional messages (sign-in codes, receipts, donation confirmations, account notices)
• Send opt-in product updates and announcements that you can unsubscribe from at any time
• Detect and prevent fraud, abuse, security incidents, and violations of our Terms of Service
• Comply with legal obligations and enforce our agreements

We also use where you live and the causes you choose to pick organizations, events and posts to show you, and we report to each organization, as numbers only, how many people saw its work. We use AI services to write short headlines and descriptions from organizations' public posts and to check that photos are suitable to show. We do not use your personal information to train AI models.

How we use Instagram data specifically

• Display your organization’s connected Instagram profile (username, profile picture, follower count) on its Collective page so supporters can confirm they are following the right organization.
• Import your historical and ongoing Instagram posts into your Collective community feed, so you don’t have to repost the same content in two places.
• Refresh aggregate engagement counts (likes and comments) on imported posts to keep your feed accurate.
• Optionally surface new posts to your members or the public, based on the audience setting you choose for each synced post.

We do not use Instagram data for advertising, profiling, training machine learning models, or any purpose unrelated to running the Collective experience your organization opted into.

We do not sell your personal information, and we do not share Instagram data with third parties for their own purposes. We share information only in the limited circumstances described below.

Sub-processors

We rely on a small number of vetted vendors to operate the Service. They are contractually bound to handle your information only on our instructions, with security and confidentiality obligations equivalent to ours.

• Google Cloud / Firebase: primary cloud infrastructure for authentication, database (Firestore), file storage, and serverless functions.
• Vercel: web hosting and content delivery for getcollective.org.
• Stripe: payment processing for donations and subscriptions. Card details are submitted directly to Stripe; Collective does not see or store full card numbers.
• SendGrid / Resend: transactional and announcement email delivery.
• Sentry: application error monitoring (we strip personally identifying fields from error reports).
• Datadog / Google Cloud Logging: aggregated server logs and performance monitoring.
• Anthropic: AI that writes short feature and ask drafts from organizations' public posts and checks public photos.
• Apollo: business profile lookup (job title and employer) when you fill in your work, and when an organization asks to fill in its own supporters' records.
• Reverse Contact: professional profile lookup by email address when an organization asks to fill in its own supporters' records.
• LinkedIn: when you connect your LinkedIn account.
• Apple Push Notification service and Firebase Cloud Messaging: delivering notifications you turn on.
• Upstash and Mux: caching, and video hosting for organizations' posts.

Public content

Posts, programs, public profile information, and other content your organization publishes on its Collective page are visible to anyone with the link, including search engines, unless you have configured them as members-only. Imported Instagram posts respect the audience setting you choose at sync time (everyone or members only).

Legal requirements

We may disclose information when required to do so by law, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Collective, our users, or the public. We will challenge overbroad requests where reasonable and notify affected users where permitted.

Business transfers

If Collective is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

Aggregated and de-identified data

We may share aggregated or de-identified information that cannot reasonably be used to identify you. For example, total donation volume across the platform, or the number of organizations using a particular feature.

We take reasonable and appropriate measures to protect personal information, including:

• Encryption in transit (TLS) for all traffic to and from the Service
• Encryption at rest for our primary databases and storage buckets
• Principle-of-least-privilege Firestore security rules that prevent users from reading or modifying records that don’t belong to their organization
• HMAC-SHA256 signature verification on Meta deauthorization and webhook callbacks
• Restricted, audited access to production systems
• Regular dependency updates and security review of new integrations

No system is perfectly secure. If we discover a security incident that affects your information, we will notify you in accordance with applicable law.

Collective HQ can show a nonprofit's staff the meetings they have with supporters the organization already knows. To do that, a staff member can connect their own Google Calendar or Microsoft Outlook calendar. Nothing is read until that person connects it themselves, and we only ask for read-only access.

What we read

When you connect a calendar, we read events from that calendar only. For each event we look at:

• The start and end time
• The title
• The email addresses of the attendees

We never create, change, or delete events, and we never send invitations from your calendar.

What we keep

We compare attendee email addresses with the supporters already in your organization's HQ. We keep only the events that include at least one of those people. For each one we store who was there, when it happened, and a short summary (usually the event title). Everything else is discarded right away. We never store a copy of your full calendar, and events with people who aren't in your HQ are not saved.

Stored meetings are visible to staff of your organization who can already see that supporter in HQ. We also store the access token Google or Microsoft issues when you connect, encrypted at rest, so we can keep the calendar in sync.

How it's shared

We don't sell calendar data and we don't share it with anyone outside your organization. The only exceptions are the service providers that host Collective (for example, our cloud database), which process it on our behalf to run the feature, and cases where the law requires us to disclose it.

Disconnecting and deletion

You can disconnect your calendar at any time from your settings in Collective HQ. When you do, we revoke our access and delete the meetings we stored from that calendar. You can also remove Collective from your Google Account's third-party connections or your Microsoft account's app permissions. To ask us to delete this data, email team@getcollective.io and we will do it within 30 days.

Google API Services User Data Policy

Collective's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms:

• We use Google user data only to show your meetings with supporters in Collective HQ.
• We never use it for advertising, including retargeting or interest-based ads.
• We never sell it. We only transfer it when that is needed to provide this feature, to comply with the law, or as part of a merger or acquisition with notice to you.
• No person at Collective reads it unless you ask us to (for example, for support), it is needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.
• We never use it to develop, improve, or train generalized AI or machine learning models.

We hold data from Microsoft calendars to the same rules.

Collective pages may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before sharing personal information with them.

You can review and update most of your information at any time by signing in to Collective. To request a full export, correction, or deletion of your data, email team@getcollective.io from the email address associated with your account. We will respond within 30 days and may verify your identity before acting on the request.

Disconnecting Instagram

You can revoke Collective's access to your Instagram account in three ways:

1. From inside Collective: in your organization's portal, open Organization → Connections → Instagram and choose Disconnect (in the older settings: Settings → Social Media → Disconnect Instagram). Your access token is deleted at once, and your Instagram profile fields and synced posts are deleted within 30 days.
2. From Instagram: visit instagram.com → Settings → Apps and Websites and remove Collective from the Active list. Meta will send a signed deauthorization request to our endpoint at https://us-central1-collective-prod-env.cloudfunctions.net/instagramDataDeletion, which clears tokens and disables sync within 30 days and returns a confirmation URL.
3. By email: if either of the above is unavailable, email team@getcollective.io and we will process your request within 30 days.

Notifications, location, LinkedIn and family

You can turn notifications off in the Collective app or in your phone's settings, stop sharing your location in your phone's settings, and change your neighborhood at any time. You can disconnect LinkedIn from your profile, which removes what came from it. A parent or guardian can edit or delete a child's profile at any time, which deletes the child's information.

Marketing communications

You can opt out of product announcements and other non-transactional emails at any time by clicking the unsubscribe link in the footer of those messages, or by emailing team@getcollective.io with the subject line “UNSUBSCRIBE.” Transactional messages (sign-in codes, receipts, account notices) are required for the operation of the Service and cannot be opted out of while your account is active.

Account deletion

You may delete your Collective account at any time from your account settings or by emailing team@getcollective.io. On deletion, we remove personal information associated with your account within 30 days, except where retention is required by law (for example, donation records required for tax reporting) or necessary to resolve disputes and enforce our agreements.

Collective accounts are for people 18 and older. A parent or guardian can add a child's profile inside the parent's own account to give together as a family. The parent enters the child's first name and age; the child has no account, login or email, and we do not collect information directly from the child.

A child's choices and notes stay inside the family and are never shared with an organization. If the parent shares the child's gift link, the child's first name, the family's name and the family's city show on that page to anyone with the link. The parent can edit or delete the child's profile at any time, which deletes this information.

We do not otherwise knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us at team@getcollective.io and we will delete it.

California residents (CCPA / CPRA)

If you are a California resident, you have the right to (i) know what personal information we collect, use, and share about you; (ii) request deletion of your personal information; (iii) correct inaccurate personal information; (iv) opt out of the “sale” or “sharing” of your personal information for cross-context behavioral advertising; and (v) limit the use of sensitive personal information. Collective does not sell or share personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

To exercise any of these rights, email team@getcollective.io from the email address associated with your account. We will not discriminate against you for exercising your rights.

Nevada residents

Nevada residents may direct us not to sell their personal information. We do not currently sell personal information.

Colorado, Texas, and Virginia residents

Residents of these states have the right to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising and the sale of personal information. We do not currently engage in either practice. To exercise these rights, email team@getcollective.io.

Connecticut, Florida, Montana, Oregon, and Utah residents

Residents of these states have rights similar to those described for Colorado, Texas, and Virginia residents above. To exercise these rights, email team@getcollective.io.

Collective is operated from the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

For users in the European Economic Area, the United Kingdom, or Switzerland, our legal bases for processing personal information are (a) performance of our contract with you, (b) our legitimate interests in operating and improving the Service, (c) compliance with legal obligations, and (d) where applicable, your consent. You have the right to access, rectify, erase, restrict, or object to processing of your personal information, and to data portability. To exercise these rights, contact team@getcollective.io. You also have the right to lodge a complaint with your local supervisory authority.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the bottom of this page and, for material changes, notify account holders by email or through the Service before the change takes effect. Your continued use of the Service after the updated Policy is posted constitutes acceptance of the updated Policy.

If you have questions about this Privacy Policy or our data practices:

• Email: team@getcollective.io
• Mailing address: Collective Social Corp, 1510 W Knox St, Durham, NC 27705