Privacy Policy

1. What We Collect

When you use LastDonor.org, we collect information you provide directly:

• Account information: Name, email address, password (hashed), and optional location.
• Donation information: Donor name, email, location, donation amount, and optional message. Payment details (credit card numbers) are processed directly by Stripe and never stored on our servers.
• Newsletter subscriptions: Email address and sign-up source.
• Story submissions: Name, email, and story details submitted via the Share Your Story form.

2. How We Use Your Information

• Process and acknowledge donations
• Send donation confirmations and campaign updates
• Display public donor names on campaign pages (unless anonymous)
• Send newsletter updates (with your consent)
• Improve platform functionality and user experience
• Comply with legal and regulatory requirements

3. Cookies & Analytics

We use Plausible Analytics, a privacy-focused analytics tool that does not use cookies and does not collect personal data. We may use essential cookies for authentication (session tokens) and saved theme preference.

4. Who Sees Your Data

We do not sell, rent, or trade your personal information. Not now, not ever. We only share data with the services that make the platform work:

• Stripe: For payment processing
• Resend: For transactional emails
• Supabase: For database hosting
• Vercel: For application hosting

5. Your Privacy Rights

Depending on your location, you may have the following rights:

• California (CCPA): Right to know what personal information we collect, right to request deletion, right to opt out of data sales (we do not sell data), and right to non-discrimination for exercising these rights.
• European Economic Area / UK (GDPR / UK GDPR): Right of access, right to rectification, right to erasure (“right to be forgotten”), right to restriction of processing, right to data portability, right to object to processing, and the right to lodge a complaint with your national supervisory authority (e.g., the ICO in the UK or a EU Data Protection Authority).

To exercise any of these rights, email privacy@lastdonor.org. We will respond within 30 days.

6. Data Retention

We retain account data for as long as your account is active. Donation and transaction records are retained for a minimum of 7 years for financial reporting and tax compliance. If you delete your account, personal identifiers are removed within 30 days; anonymized aggregate transaction data is retained for compliance purposes. You may request a copy of your data at any time by emailing privacy@lastdonor.org.

7. Security

We implement industry-standard security measures including encrypted connections (TLS), bcrypt password hashing, role-based access control, and regular security audits. Payment processing is handled entirely by Stripe, a PCI DSS Level 1 certified provider.

8. Contact & Mailing Address

For privacy-related inquiries, contact us at privacy@lastdonor.org. For physical mail requests, contact us by email so we can provide the current mailing details.