Privacy Policy

Effective October 2, 2026

Gratituity LLC ("Gratituity," "we," "us") runs gratituity.com, a platform that helps nonprofits show donors how donated funds were spent. This policy explains what information we collect, how we use and share it, and the choices you have. It applies to our website, donor dashboards, and related services (the "Services").

1. Information we collect

Website visitors

Our site is delivered and protected by Cloudflare. When you visit, Cloudflare processes technical information such as your IP address, browser and device type, the pages you request, and the time of your visit. This is used for security, performance, and abuse prevention, and may be summarized into aggregate visitor statistics that do not use cookies.

Donors

Donations are processed by Square. When you donate, you provide your payment details and contact information (such as name and email) directly to Square. We never receive or store your full card number. Our systems do not retrieve donor information from Square; they only confirm that a donation was completed through checkout. Square shows us transaction details in our merchant account, such as your name, email, donation amount, and date. We use your email address to thank you, ask how you would like to be recognized, and send updates about the fundraisers you supported. Our email correspondence with you is kept in our email account.

How donors are recognized

We don't require your first or last name to use Gratituity. You remain Anonymous unless you tell us you want to be Known. If you choose to be Known, we display the alias you give us. If you don't provide an alias, we display your first name only if you chose to enter one when creating your donor profile; otherwise you remain Anonymous. We never use the name from your payment details for recognition. We recommend using an alias rather than your real name.

Nonprofits

Nonprofits that use Gratituity provide organization and contact details for their staff, and upload expense records such as receipts and invoices. These documents may contain names or other information about vendors or staff. We ask nonprofits to remove information that is not needed to show how funds were spent.

When you contact us

If you email us, we receive your email address and whatever you include in your message.

2. How we use information

• To provide the Services, including processing donations through Square and showing donors how funds were spent.
• To read and organize expense records. We use automated tools, including AI services, to extract details such as vendor, date, and amount from uploaded receipts. Results that are uncertain are flagged for human review.
• To keep the Services secure and prevent fraud and abuse.
• To send donors thank-you messages and updates about the fundraisers they supported. You can stop these at any time by replying "UNSUBSCRIBE" or emailing [email protected].
• To respond to questions and requests.
• To comply with legal obligations and enforce our terms.

We do not sell personal information, and we do not use it for targeted advertising.

3. Information that is public by design

Gratituity exists to make nonprofit spending visible. Expense details read from a nonprofit's receipts, such as vendor names, amounts, and dates, may be shown on public donor dashboards. Receipt images themselves are never shown publicly; they are visible only to Gratituity and to the nonprofit's own authorized users who uploaded them. Donors are shown as "Anonymous" unless they choose to be Known, in which case we show only their alias or, if none was given, the first name they chose to enter on their donor profile. We never display donor email addresses or payment details.

4. How we share information

We share information only with service providers that help us run the Services, and only as needed for them to do so:

• Square: payment processing.
• Cloudflare: website delivery, security, and backend processing.
• Amazon Web Services: file storage and databases.
• Anthropic: AI processing of uploaded expense records.
• Google: email (Gmail) for donor and partner correspondence.

We do not share donor names or email addresses with the nonprofits we fundraise for. Nonprofits see donors only as they appear on dashboards: Anonymous, or by the alias or first name the donor chose.

We may also disclose information if required by law, to protect the rights and safety of Gratituity or others, or as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to that information.

5. Cookies

We do not use advertising or tracking cookies. Our providers may set strictly necessary cookies for security, for example to detect bots. Because we do not track you across sites, we do not change our practices in response to "Do Not Track" signals.

6. Data retention

We keep information as long as reasonably necessary to provide the Services, meet legal, tax, and audit obligations, resolve disputes, and prevent abuse. Published expense records may be kept for as long as the related fundraising remains viewable, so donors can continue to verify how funds were spent. When we no longer need information, we delete or anonymize it.

7. Security

We use reasonable technical and organizational measures to protect information, including encryption in transit and access controls. No system is completely secure, and we cannot guarantee absolute security.

8. Your choices and rights

Depending on where you live, including Virginia, California, and other states with privacy laws, or the European Economic Area and United Kingdom, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information.
• Get a copy of your information in a portable format.
• Object to or restrict certain processing.

To make a request, email [email protected]. We may need to verify your identity before acting on it. If we deny your request, you may appeal by replying to our decision. We will not discriminate against you for exercising these rights. For payment records held by Square, you can also contact Square directly.

9. Children's privacy

The Services are intended for people 16 and older. We do not knowingly collect personal information from anyone under 16. You must be 18 or older, or have a parent or guardian's permission, to make a donation. If you believe someone under 16 has given us personal information, contact us at [email protected] and we will delete it.

10. International visitors

Gratituity is based in the United States. If you use the Services from outside the U.S., your information will be processed in the U.S., where data protection laws may differ from those in your country.

11. Third-party links

Our Services may link to other sites, including nonprofit websites and Square checkout pages. Their privacy practices are governed by their own policies.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new effective date, and for significant changes we will provide additional notice where appropriate.

13. Contact us