1. Information we collect

Information you give us: name, email address, phone number, postal address and any message you submit through our contact, volunteer, newsletter or donation forms.

Donation information: donation amount, frequency and the last four digits of your card, as reported by our payment processor. We never receive or store your full card number.

Account information: if you create a donor account, your email address and a securely hashed password.

Usage information: pages visited, approximate location, browser and device type, collected through Vercel Analytics and Google Analytics. We use this only to understand how the site is used and to measure our appeals (for example, how many donations or volunteer applications a page leads to). We never send your name, email or messages to these services, and we do not use advertising trackers.

2. How we use your information

To process donations and send tax receipts.

To respond to your inquiries and volunteer applications.

To send program updates and newsletters, only when you have subscribed. You can unsubscribe at any time.

To keep our website secure, prevent fraud and comply with legal obligations.

3. Sharing your information

We do not sell or rent your personal data. We share it only with service providers that help us operate: Stripe and PayPal (payments), Resend (email delivery), Vercel (hosting and analytics), Google (Google Analytics) and Neon (database). Each is bound by its own privacy and security commitments.

We may disclose information when required by law, regulation or a valid legal process.

4. Payments

Payments are processed by Stripe, a PCI-DSS Level 1 certified provider. Your card details are transmitted directly to Stripe and never touch our servers.

5. Data security and retention

We use encryption in transit (HTTPS), hashed passwords, access controls and security headers to protect your data. No method of transmission is entirely secure, so we encourage appropriate precautions when sharing information online.

We keep donation records for as long as required by U.S. tax and accounting law, and other personal data only as long as needed for the purposes described here.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to withdraw consent, and to object to certain processing. To exercise these rights, email info@gapdev.org.

7. Children's privacy

Our website is not directed to children under 13 and we do not knowingly collect personal data from them. If you believe a child has provided us with personal information, please contact us so we can delete it.

8. Cookies

Essential cookies remember your language preference, keep you signed in to your donor account and protect forms against abuse.

Analytics cookies (Google Analytics, for example _ga) help us understand which pages are useful. Visitors in the European Economic Area, the United Kingdom, Switzerland and nearby territories with equivalent laws are asked first: until they agree, Google Analytics is not loaded and nothing is sent to Google. Elsewhere it is on by default. Anyone can change their choice at any time with the "Analytics preferences" link at the bottom of every page. If you decline, Google Analytics is switched off, its cookies are removed and it is not loaded on your later visits. You can also block it with Google's opt-out add-on (tools.google.com/dlpage/gaoptout). Visits to your donor account, the sign-in pages and the newsletter confirmation and unsubscribe links are never reported.

We do not use advertising cookies, and we have turned off Google's advertising features and data sharing for advertising.

9. Changes and contact

We may update this policy from time to time; the date at the top reflects the latest revision. Questions? Email us at info@gapdev.org.