Privacy Policy

1. Introduction

Donor Impact IQ ("the Service"), operated by IQ Corp™ ("we", "us", or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our donor prospect validation platform.

This policy applies to all users of the Service. By using the Service, you consent to the practices described in this policy.

2. Information We Collect

Account Information: When you register, we collect your name, email address, and organization name.

Prospect Data: You voluntarily submit information about your donor prospects, including names, LinkedIn profiles, organizational affiliations, scores, pipeline values, gift/grant records, and notes. This data is specific to your account and is not shared with other users.

Usage Data: We collect information about how you interact with the Service, including pages visited, features used, timestamps, and device/browser information.

Authentication Data: We store authentication tokens and session data to keep you logged in securely.

3. How We Use Your Information

• To provide, maintain, and improve the Service and its features
• To create and manage your account and authenticate your sessions
• To process subscription payments and manage billing
• To generate AI-powered prospect research, scores, and recommendations
• To communicate with you about your account, updates, and support requests
• To monitor and analyze usage patterns to improve the Service
• To detect, prevent, and address technical issues, fraud, or security violations
• To comply with legal obligations

4. AI Processing & Third-Party Services

To generate prospect research and scores, we send prospect names and relevant details to AI model providers. These providers process data on our behalf and do not use your data to train their models. We use reputable AI providers that maintain appropriate data processing agreements.

We also use payment processing services (Stripe) to handle subscription billing. Payment card information is handled directly by the payment processor and is never stored on our servers.

5. Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Our infrastructure is hosted on SOC 2 Type II and ISO 27001 certified servers by Base44
• Multi-tenant data isolation ensures your data is only accessible to your account
• Access to production systems is restricted and audited
• Regular security assessments and penetration testing are conducted

Despite these measures, no method of transmission or storage is completely secure. We cannot guarantee absolute security.

6. Data Isolation & Multi-Tenancy

Your prospect data, gift records, segments, and connections are scoped exclusively to your account. Every database query is filtered by your user ID, ensuring no other user can access, view, or query your data. Administrators can only manage user accounts, not prospect data belonging to other users.

7. Data Retention

We retain your data for as long as your account is active. If you cancel your subscription, your data is retained for 30 days to allow for reactivation. After 30 days, all prospect data, gifts, segments, and associated records are permanently deleted. You may request earlier deletion at any time.

Usage logs and analytics data may be retained in aggregated, anonymized form for up to 24 months for service improvement purposes.

8. Your Rights

Depending on your jurisdiction (GDPR, CCPA, and other privacy laws), you may have the following rights:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Request your data in a machine-readable format
• Objection: Object to certain processing activities
• Withdrawal of Consent: Withdraw consent for processing at any time

To exercise these rights, contact us through the Settings page. We will respond within 30 days.

9. Cookies & Tracking

The Service uses essential cookies to maintain authentication sessions and remember your preferences. We do not use advertising or third-party tracking cookies. Analytics cookies, if used, are anonymized and used solely to improve the Service.

10. Sharing of Information

We do not sell, rent, or trade your personal data. We may share information with:

• Service Providers: Third parties that process data on our behalf (AI providers, payment processors, hosting providers) under data processing agreements
• Legal Authorities: When required by law, court order, or to protect our rights and safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations

11. International Data Transfers

Your data may be processed in countries other than your own, including the United States. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses, for any international data transfers subject to GDPR requirements.

12. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us for prompt deletion.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. We encourage you to review this policy periodically. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact

For questions about this Privacy Policy or your data, please contact us at info@donorimpactiq.com or through the Settings page.