Privacy Policy
Effective: 13 October 2026 · Last updated: 13 October 2026
In short. We collect what we need to run your account, process payments, and improve the site. We don't sell your data, we don't run ads, and we don't track you across other websites. A small set of trusted providers help us run the Service, and each is named below. You can see, correct, download or delete your data at any time. GivingTree Map also publishes public information about organizations and, sometimes, the people who are party to a transaction, by name only (we take measures to keep information about individuals to a minimum). If that includes you, section 9 explains your rights. This policy is written to meet Brazil's LGPD, Europe's GDPR, the UK GDPR, and US state privacy laws, including California's.
1. Who we are
GivingTree Global, Inc., a Delaware public benefit corporation, is responsible for your personal data. In privacy law terms, we're the "controller" (controlador under the LGPD).
- Legal address: 16192 Coastal Highway, Lewes, Delaware 19958, United States. This is the address of our registered business agent, not GivingTree's operating address. GivingTree Global is a fully remote company, operating chiefly between the United States and Brazil.
- Privacy contact: Matthew Honold, privacy@givingtreemap.com. Under the LGPD, Matthew is our encarregado, the person responsible for privacy questions.
2. What we collect
When you create an account:
- your first name, last name (optional), email address and a securely hashed password, or, if you sign in with Google, your name, email address and profile picture from Google (we never see your Google password)
- your country, which you choose when you sign up. If you sign up with Google, or your account was made before we asked, we set it from your IP address. You can change it on your account page.
- your time zone, read from your browser at sign-up, or from your IP address if needed
- your language preference
- whether you want to receive our newsletter and/or platform updates. Both arrive as emails you can opt in to receive. The box for each is unticked, both on the sign-up page and on your account page, until you tick it.
- an access code, if you enter one. Some codes are made for one person and include that person's first name.
- the campaign link that first brought you to the site, if there was one (for example, a link in an email we sent to a partner community), and when you first arrived
When you use the Service:
- what you save, follow or create in your account, such as saved searches on the Map, preferences and report files
- which features you use, so we can apply your plan's usage limits
- your plan, ring, any codes you've used, and usage credits
- technical data such as your IP address, browser, device type, pages viewed, and error logs. Each time you sign in, our sign-in provider records the IP address and browser of that session, to keep your account secure.
When you pay (through Stripe):
- your billing name, billing country, the last four digits and brand of your payment method, and your payment history on our platform. Stripe handles your full card details. We never receive them.
When you contact us or send feedback: your name, email address, what you tell us, and the page you sent it from. If you're signed in, we connect your message to your account. To prevent spam, we also keep a hashed version of your IP address, a scrambled code that can't be turned back into the address.
When you click a link to another site: we don't track where you go. Like any website, the site you visit may see that you came from GivingTree Map. From there, its own privacy policy applies.
From analytics: we use Vercel Web Analytics to see, in aggregate, which pages people visit and which features they use. It works without cookies and doesn't identify you or follow you across other sites. It counts a few actions, such as completing sign-up or using a courtesy code, without linking them to your name or email.
What we don't collect: we don't ask for sensitive data such as health, religion or political views, and we don't knowingly collect data from anyone under 18.
3. Why we use it, and our legal basis
Privacy laws ask us to name a legal reason for each use. Here's ours:
| What we do | Why | Legal basis |
|---|---|---|
| Create and run your account, sign you in, provide the Service | You asked for it | Performance of a contract (GDPR art. 6(1)(b); LGPD art. 7, V) |
| Charge your payments, issue receipts, handle refunds and the exchange-rate credits | You bought a plan | Contract, and legal obligations for tax records (GDPR art. 6(1)(c); LGPD art. 7, II) |
| Send service emails (sign-up confirmation, billing, renewal reminders, changes to these terms) | Running your account | Contract |
| Time service emails for working hours in your local time, and skip weekends and public holidays in your country | So our emails arrive at a reasonable time, and deadlines fall at midnight your time | Legitimate interest (GDPR art. 6(1)(f); LGPD art. 7, IX) |
| Keep the Service secure, prevent abuse, and enforce usage limits | Protecting you and the Service | Legitimate interest |
| Understand, in aggregate, how the Service is used, and improve it | Making it better | Legitimate interest |
| Send the newsletter, platform updates or offers | Only if you opt in | Consent (GDPR art. 6(1)(a); LGPD art. 7, I). You can withdraw it at any time. |
| Respond to legal requests | When the law requires | Legal obligation |
Where we rely on legitimate interest, we've weighed it against your rights. You can object at any time (section 8).
No automated decisions about you. We don't make decisions that have legal or similarly significant effects on you based solely on automated processing. What you see on GivingTree Map is information, not a decision about you.
4. Who we share it with
We don't sell your personal data, and we don't share it for advertising. That includes "sale" and "sharing" as defined by California law.
We share data only with providers that help us run the Service. Each processes it on our instructions under a data processing agreement:
| Provider | What they do | Data involved | Where |
|---|---|---|---|
| Vercel | Hosting, content delivery, analytics, IP-based country and time zone | Technical data, IP address, aggregate usage | US and global edge network |
| Supabase | Database, accounts and sign-in | Account data and everything stored in your account | United States |
| Stripe | Payments | Billing data | United States and globally |
| Mapbox | The interactive Map | Technical data, anonymous Map usage | United States |
| Sign-in with Google, only if you use it | Your Google sign-in | Global | |
| Resend | Sending service emails | Your email address, first name, language, and the email's content | United States |
If you opt in to the newsletter, we'll send it through a newsletter provider, which we'll name in this table before the first issue goes out.
We also use public holiday calendars from Nager.Date and Hebcal to time our emails. We send them no data about you.
Tools that build the site, not your account. To research and write the Map and the Knowledge Base, we use AI and web services: Google (Gemini), Perplexity, Anthropic (Claude) and Cloudflare. We also use Sanity to manage the written articles on our site (mainly in the Knowledge Base section). For reference data we use public sources such as Frankfurter and the Banco Central do Brasil for exchange rates, and the World Bank and the UN Development Programme for country indicators. These services work with public information, not with your account. We don't send them your account data.
We may disclose data when the law requires it, to protect people's safety, or to defend our legal rights. If GivingTree Global, Inc. is merged or acquired, your data may transfer to the new owner. This policy would continue to protect it, and we'd tell you first.
We'll update this list before we add a new provider that handles your personal data.
5. International transfers
We're a US company, and our main providers store data in the United States. If you're outside the US, your data is transferred there.
We protect those transfers with the safeguards your law recognizes. For the EU and UK, that means the European Commission's Standard Contractual Clauses and the UK addendum, or the EU-US Data Privacy Framework where a provider is certified. For Brazil, it means the ANPD's standard contractual clauses (LGPD art. 33). You can ask us for a copy of the relevant safeguards.
6. How long we keep it
| Data | How long |
|---|---|
| Account data and saved work, including report files | While your account exists. Deleted within 30 days after you delete your account. Backups clear within a further 30 days. |
| Sign-in session records (IP address, browser) | While the session is active, and up to 30 days after it ends |
| Feedback and contact messages | 3 years, then deleted. If you delete your account, we remove your name and email from your messages. |
| Billing and tax records | As long as tax and accounting law requires, usually 5 to 7 years |
| Technical logs | 90 days |
| Emails and support messages | 3 years after the last message, unless the law requires longer |
| Your payment records at Stripe | Kept by Stripe as payment and tax law requires, even after you delete your account |
| Aggregate analytics | As long as useful. They don't identify you. |
7. How we protect it
Data is encrypted in transit (HTTPS) and at rest. Access is limited to the people and systems that need it. Our database rules let each signed-in account read only its own data.
No system is perfectly secure. If a breach puts your data at risk, we'll tell you and the relevant authorities as quickly as the law requires. Under the LGPD that is within 3 business days, and under the GDPR within 72 hours for authorities.
8. Your rights
Wherever you live, you can ask us to:
- see the personal data we hold about you, and get a copy
- correct data that's wrong or incomplete
- delete your data, or your whole account. You can delete your account yourself from your account page. If you have an active paid plan, cancel it first.
- download your data in a portable format. Until we add a download button, ask us and we'll send it.
- object to or restrict how we use it, including uses based on legitimate interest
- withdraw consent you've given, such as for newsletters, at any time. This doesn't affect what we did before you withdrew it.
- know who we share it with (section 4)
In Brazil (LGPD), you also have the right to confirmation that we process your data, to anonymization or blocking of unnecessary data, to information about what happens if you refuse consent, and to review of decisions made solely by automated means.
In California and other US states, you have the right to know, delete and correct, and to opt out of the sale or sharing of personal data. We don't sell or share it. We won't treat you differently for using any of these rights. We honor Global Privacy Control browser signals.
How to ask: email privacy@givingtreemap.com or use the contact form with "Privacy" in the subject. Many requests can be done directly from your account page. We may need to confirm your identity first. We aim to answer within 15 days and will always answer within the time your law sets.
Complaints. If you're not satisfied, you can complain to your data protection authority. In Brazil, that's the ANPD (Autoridade Nacional de Proteção de Dados). In the EU, it's your national supervisory authority. In the UK, it's the ICO. In California, it's the California Privacy Protection Agency. We'd appreciate the chance to fix it first.
9. If you appear on GivingTree Map
GivingTree Map is about the activity of organizations: who funds what, who invests where, who runs which programs. We keep information about individual people to a minimum. Sometimes a record names a person, such as an individual donor or an angel investor, insofar as he or she is a party to that activity. If that's you, this section is for you, even if you've never visited our site.
- What we publish about people: only your name, and only as a party to a transaction, for example as the giver of a grant or donation, or as an investor. We publish nothing else about you: no location, employer, role, biography or photo.
- When we name you: only if you or your own organization made the transaction public, for example in an announcement, on your website or in a filing. If money moved through your foundation, family office or company, we name that organization instead of you. In every other case, we show "an individual."
- What we never publish: private contact details, anything about your private life, or a gift that would reveal your religion, politics, health or other sensitive matters. In those cases, we show "an individual."
- Where it comes from: the public source that reported the transaction. Each record links to it.
- Why, and our legal basis: to give a clear, public picture of where capital goes in the purpose-driven economy (also called the impact economy). We rely on legitimate interest (GDPR art. 6(1)(f); LGPD art. 7, IX), applied only to transactions that were already made public. Under the LGPD, information a person has made public themselves can also be used in ways consistent with that publication (art. 7, §4).
- How long: for as long as the transaction is on the Map.
- Your rights: all the rights in section 8 apply to you. If you ask us to remove your name, we'll replace it with "an individual" and make sure it doesn't come back. We'll confirm within 15 days, usually much sooner. When you ask, we hide your name while we review your request.
- How to ask: see Corrections and Removal Requests, or email privacy@givingtreemap.com.
10. Children and minors
The Service isn't meant for anyone under 18, and we don't knowingly collect their data. If you think a child has given us data, contact us and we'll delete it. We don't publish information about minors on the Map.
11. Cookies
See our Cookie Policy.
12. Changes
If we change this policy in a way that has a material effect, we'll email you at least 30 days before it takes effect and show the date at the top. If a change needs your consent, we'll ask for it.