Privacy Policy

Effective Date: April 9, 2026 · Last Updated: April 9, 2026

1. Introduction

VolunteerFlow is a multi-tenant Software-as-a-Service (SaaS) platform designed to help nonprofits, educational institutions, and other organizations manage volunteer programs, track volunteer hours, schedule events, and coordinate volunteer activities.

This Privacy Policy describes how VolunteerFlow ("we," "us," "our," "Company") collects, uses, discloses, and otherwise processes personal information through our platform, website, and services (collectively, the "Services"). This Privacy Policy is intended for:

• Organization representatives (owners, administrators, managers, coordinators, and leaders) who manage volunteer programs
• Volunteers who participate in volunteer activities coordinated through the platform
• Internal staff members and employees who use the platform for support, administrative, or operational purposes

As a SaaS platform, VolunteerFlow operates on a multi-tenant architecture. Organizations (nonprofits and other eligible entities) are data controllers responsible for the volunteers in their programs, while VolunteerFlow acts as a data processor. This means that organizations determine what personal information is collected from volunteers, while VolunteerFlow provides the infrastructure and tools to manage that information.

Please read this Privacy Policy carefully. By accessing or using VolunteerFlow, you agree to the practices described in this policy. If you do not agree with our privacy practices, please do not use the Services.

2. Information We Collect

2.1 Volunteer Information

When volunteers register for or use the platform, either directly or through their organization's instance, we may collect:

• Name (first and last name), email address, phone number, physical location or address
• Skills and volunteer interests; volunteer hours and activity logs
• Emergency contact information (name, phone number, relationship)
• Profile avatar or photograph; custom tags or categories assigned by the organization
• Volunteer status (active, inactive, suspended, etc.); share tokens for secure portal access
• Application and onboarding records; training completions and certifications; orientation attendance
• Reference check information; waiver signatures and consent records; badge or achievement records

2.2 Organization Information

When organizations sign up for VolunteerFlow, we collect:

• Organization name, email address, phone number, physical address, website URL, Tax ID or EIN
• Organization logo and branding colors; timezone preference; portal settings and customization preferences
• Checkr API key (for background check integration); billing and subscription information

2.3 Staff and Administrator Information

For users with staff or administrative roles, we collect: full name, email address, job title and department, user role and permissions level, last login timestamp, login attempt records, user creation date and creator ID.

2.4 Event and Activity Information

Information related to volunteer events includes: event title, description, location, dates/times, contact information, images and media, volunteer applications and registrations, hours logged, attendance records and check-ins.

2.5 Message and Communication Data

When using our messaging features, we collect: full message content and attachments, sender and recipient information, message timestamps, read/unread status.

2.6 Technical and Session Data

We automatically collect: IP address, user agent and browser information, device type and operating system, session timestamps, session duration, pages visited and features used, click and interaction data, referring URL, crash and error logs, performance metrics.

2.7 Billing and Payment Information

For organizations on paid plans, we collect Stripe customer ID, Stripe subscription ID, PayPal subscription ID (if applicable), current subscription plan and tier, billing cycle dates, and invoice records. We do not directly collect credit card numbers, expiration dates, or CVV codes — these are handled exclusively by Stripe and PayPal.

2.8 File Upload Information

When files are uploaded, we collect: file name, file type and MIME type, file size, uploading user, upload timestamp, and storage path.

2.9 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. See Section 7 and our Cookie Policy for detailed information.

3. How We Use Your Information

3.1 Providing and Improving Services

We use personal information to create and manage user accounts, provide core platform functionality, customize your experience, send transactional emails, diagnose technical issues, and develop and improve our Services.

3.2 Communication and Support

We use your information to respond to inquiries and support requests, send customer support updates, provide onboarding assistance, send administrative announcements, and facilitate communication between volunteers and organization coordinators.

3.3 Security and Fraud Prevention

We use personal information to monitor for unauthorized access, prevent fraud and abuse, enforce our Terms of Service, protect the safety of VolunteerFlow and our users, and comply with law enforcement requests and legal obligations.

3.4 Background Checks and Volunteer Screening

When an organization integrates VolunteerFlow with Checkr, we use volunteer personal information (name, email, phone, address) to facilitate background check candidate creation. Organizations are responsible for obtaining proper consent from volunteers before initiating background checks.

3.5 Analytics and Business Intelligence

We use aggregated and anonymized usage data to analyze trends, measure platform performance, identify popular features, and prepare internal business reports.

3.6 Billing and Account Management

We use billing information to process subscription payments and renewals, track subscription status, generate invoices and billing statements, monitor payment failures, and enforce billing terms.

3.7 Legal and Compliance

We use personal information to comply with applicable laws and regulations, respond to government and law enforcement requests, establish or defend legal claims, and comply with data protection regulations (GDPR, CCPA, etc.).

4. Multi-Tenant Data Structure and Data Roles

4.1 Data Controller vs. Data Processor

VolunteerFlow operates as a multi-tenant platform where each organization has its own isolated instance. Under data protection laws (including GDPR and CCPA): Organizations using VolunteerFlow are data controllers — they determine the purposes and means by which volunteer personal information is collected and processed. VolunteerFlow is a data processor — we process personal information on behalf of organizations, according to their instructions, and only for purposes necessary to provide the Services.

4.2 Data Isolation and Segregation

Each organization's data is logically isolated within our multi-tenant architecture. Organization administrators can only access their own organization's volunteer data. Volunteers can only view and manage their profile within their associated organization.

4.3 Volunteer Data Ownership

Volunteers' personal information is managed by the organization that recruited them. The organization determines what information is collected, how it is used, who has access, how long it is retained, and whether information is shared with background check providers. Volunteers should review the privacy policy of their specific organization.

4.4 Data Processing Agreements

Organizations that fall under GDPR, CCPA, or other data protection regulations enter into Data Processing Agreements (DPAs) with VolunteerFlow. See our Data Processing Agreement for full details.

5. Internal Employee Access and Support Operations

5.1 Authorized Access by VolunteerFlow Staff

To provide customer support, troubleshoot technical issues, onboard new organizations, and maintain the platform, authorized VolunteerFlow employees may access organization data. Staff roles include: Owner, Super Admin, Admin, Manager, Senior Support, Support Agent, Onboarding Specialist, Billing Specialist, and Read Only. Access is limited to what is necessary for each employee's job responsibilities.

5.2 Support and Troubleshooting Access

When an organization contacts support, our team may need to view organization settings and configuration, review volunteer data to diagnose issues, check logs and system records, and test functionality to replicate and resolve issues. Support staff do not access personal information for any other purpose.

5.3 Support Impersonation Mode

VolunteerFlow provides a "support impersonation mode" that allows authorized support staff to view the platform as if they were an organization administrator, for legitimate support and troubleshooting purposes. This feature is strictly limited to authorized personnel. Organizations are notified in their support ticket when support impersonation mode is used.

5.4 Comprehensive Audit Logging

All access to organization data by VolunteerFlow staff is logged in our audit system. Every staff action generates a record containing: staff member ID and name, organization ID, action category and type, resource type and ID, field-level changes (before and after values), reason for access, IP address, session ID, and precise timestamp. Organizations can request audit logs of staff access to their data.

5.5 Data Security During Support Access

All access occurs over encrypted HTTPS connections. Sessions are authenticated and session activities are logged. Sensitive data (passwords, payment information) is masked and not displayed. Support access is rate-limited to prevent abuse.

5.6 Limitations on Internal Access

VolunteerFlow staff do not access personal information for marketing purposes, do not share personal information with unauthorized parties, do not use personal information for research unless anonymized, and are subject to disciplinary action for unauthorized access. See our Employee Access & Audit Policy for full details.

6. Sharing with Third Parties

VolunteerFlow shares personal information with third-party service providers to operate the platform. We only share the minimum information necessary and require third parties to protect that information.

6.1 Stripe — Payment Processing

We use Stripe to process subscription payments. Data shared: organization name, email, billing address, invoice amounts, subscription details. We do not share volunteer personal information with Stripe.

6.2 PayPal — Payment Processing

Organizations can optionally use PayPal as an alternative payment method. Data shared: organization name, email, billing address, invoice amounts.

6.3 Twilio — SMS Messaging

If an organization enables SMS messaging features, we integrate with Twilio. Data shared: volunteer phone numbers, message content, message timestamps. Organizations are responsible for obtaining volunteer consent before sending SMS messages.

6.4 Checkr — Background Check Integration

When an organization configures VolunteerFlow with Checkr API credentials, we facilitate background check submissions. Data shared: volunteer name, email address, phone number, and physical address. Organizations must obtain explicit written consent from volunteers before submitting background checks.

6.5 Supabase — Database and File Storage

All data collected through VolunteerFlow is stored in Supabase, a cloud database and authentication platform. Supabase is a data processor and maintains strict data security standards. Data is encrypted in transit and at rest.

6.6 Sentry — Error Tracking and Session Replay

We use Sentry to monitor application errors, performance issues, and user sessions. Data shared: error logs, stack traces, user session data, IP addresses, user agent information, page URLs, and click events. Sentry captures 10% of normal sessions and 100% of sessions where errors occur. PII masking is enabled, which redacts common patterns of sensitive data.

6.7 Vercel — Analytics and Hosting

We use Vercel for application hosting, deployment, and analytics. Data shared: page views, user interactions, performance metrics, device type, browser information, referring URL, and general location information. Vercel analytics data is anonymized.

6.8 No Selling of Personal Information

VolunteerFlow does not sell, rent, or trade personal information for money or other valuable consideration. We do not share personal information with data brokers or marketing networks.

6.9 Legal Requirements and Law Enforcement

We may disclose personal information without further notice if required by law or legal process, necessary to enforce our Terms of Service, or necessary to protect the safety, rights, or property of VolunteerFlow, our users, or the public.

6.10 Business Transfers

If VolunteerFlow is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will provide notice of such change and any choices you may have.

7. Cookies and Tracking Technologies

For full details on cookies and tracking technologies we use, please see our dedicated Cookie and Tracking Policy.

7.1 Authentication Cookies

We use JWT authentication cookies (HTTP-only, Secure) to maintain your login session. These cookies are essential for the platform to function and expire 7 days from login.

7.2 Analytics Cookies

Vercel Analytics and Speed Insights place cookies to track user behavior and measure website performance. These do not include personally identifiable volunteer information.

7.3 Error Tracking (Sentry)

Sentry may place cookies to enable session replay functionality — capturing 10% of normal sessions and 100% of error sessions. PII masking is enabled (maskAllText: true). Session replays are retained for 90 days.

7.4 Managing Cookies

You can control cookies through your browser settings. Authentication cookies cannot be disabled without preventing login. To opt out of Vercel Analytics, visit Vercel's opt-out page. To opt out of Sentry session replay, contact legal@volunteerflow.us.

7.5 Do Not Track

We do not currently respond to Do Not Track (DNT) signals, but you can use cookie controls in your browser to limit tracking.

8. Data Retention

8.1 Default Data Retention

By default, VolunteerFlow retains personal information for as long as your account is active or as long as needed to provide the Services.

8.2 Organization-Configurable Retention

Organizations can configure custom data retention policies through their VolunteerFlow settings, including automatic deletion of inactive volunteer records and purging of old audit logs.

8.3 Specific Retention Periods

• Volunteer profiles: Retained while active; deleted upon removal or account closure
• Hours and activity logs: Typically 1–7 years per organization settings
• Staff audit logs: Minimum 1 year for security and compliance
• Session logs and IP addresses: 30 days to 1 year
• Backup data: 30–90 days (disaster recovery)
• Billing records and invoices: Minimum 7 years for tax and accounting
• Authentication cookies: 7 days from login

8.4 Deletion of Account Data

When an organization closes its account, data is removed from active interfaces and may be retained in backups for up to 90 days before permanent deletion. Billing records may be retained longer for legal purposes.

8.5 Right to Request Deletion

Volunteers and organization representatives can request deletion of personal information. Deletion is subject to legal retention requirements, ongoing legal disputes, and the organization's data retention policies.

9. Security

9.1 Security Measures

• Encryption: HTTPS (TLS/SSL) for all data in transit; passwords hashed with bcrypt; sensitive data encrypted at rest in Supabase
• Authentication: HTTP-only Secure cookies; role-based access control (RBAC); MFA available for administrators; IP allowlisting
• Session Security: Sessions tied to IP address and user agent; timeout after 7 days of inactivity; all session activity logged
• Rate Limiting: Login attempts rate-limited; API endpoints rate-limited; brute force protection
• Audit Logging: All access to personal information logged with user ID, action type, resource, timestamp, and IP address

9.2 Security Limitations

While we implement strong security measures, no system is completely secure. We cannot guarantee absolute protection against sophisticated cyberattacks, insider threats, or compromised credentials.

9.3 Data Breach Notification

If we become aware of a security breach affecting personal information, we will notify affected users and organizations without unreasonable delay, provide information about the breach and recommended actions, and comply with notification requirements under applicable laws (GDPR, CCPA, state laws).

10. Children's Privacy

10.1 No Intentional Collection from Children

VolunteerFlow is not designed for children under the age of 13 and we do not intentionally collect personal information from children.

10.2 No Age Verification

10.3 Teens and Young Adults

Volunteers aged 13–17 may use VolunteerFlow if their parent or guardian has consented to their participation and the organization complies with applicable laws protecting minors.

10.4 If We Learn a Minor's Information Was Collected

If VolunteerFlow becomes aware that a minor under 13 has created an account without proper parental consent, we will notify the parent or guardian, provide ability to access and review the minor's information, and delete the account and personal information upon request.

11. Your Privacy Rights

11.1 General Rights

• Right to Access: Request a copy of the personal information we hold about you
• Right to Correction: Correct or update inaccurate or incomplete information
• Right to Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Right to Data Portability: Receive your personal information in a portable, machine-readable format
• Right to Object: Object to processing for marketing purposes or automated decision-making
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

11.2 How to Exercise Your Rights

To exercise any of these rights, contact us at legal@volunteerflow.us. Include your name, organization, and specific request. We will respond within 30 days or as required by law.

11.3 Right to Lodge a Complaint

If you believe your privacy rights have been violated, you have the right to lodge a complaint with your supervisory authority or data protection regulator (EU: your national data protection authority; California: California Attorney General).

12. GDPR Compliance (European Union)

12.1 Legal Basis for Processing

VolunteerFlow processes personal information based on the following legal bases under GDPR: contract performance (to provide Services), legal obligation (required by law), legitimate interests (fraud prevention, security), and consent where required.

12.2 Data Processing Agreements

For organizations processing EU personal information, VolunteerFlow provides a Data Processing Agreement (DPA) including sub-processor disclosures, data subject rights mechanisms, and audit rights. See our Data Processing Agreement or contact legal@volunteerflow.us.

12.3 Data Subject Rights Under GDPR

EU residents have the right to access, rectify, erase, restrict processing, data portability, and object to processing. To exercise these rights, contact your organization administrator or VolunteerFlow support.

12.4 International Data Transfers

VolunteerFlow is headquartered in the United States. For EU personal information transferred outside the EU, transfers are authorized under Standard Contractual Clauses (SCCs) approved by the European Commission.

12.5 Special Categories of Data

VolunteerFlow does not intentionally collect special categories of personal data (health data, biometrics, racial origin, etc.) unless an organization explicitly requires it with appropriate legal basis and consent.

13. California Privacy Rights (CCPA/CPRA)

13.1 Categories of Personal Information Collected

In the past 12 months, VolunteerFlow has collected: identifiers (name, email, phone, IP), personal information (address, emergency contacts), commercial information (billing, subscription), internet activity (pages visited, sessions), geolocation data, professional information (role, hours), education information (training records), and inferences (volunteer history, preferences).

13.2 California Consumer Rights

• Right to Know: What personal information we collect, sources, and how we use it
• Right to Delete: Request deletion of personal information we have collected
• Right to Correct: Correct inaccurate personal information
• Right to Opt-Out: Opt out of sale or sharing of personal information (we do not sell or share personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

13.3 Do Not Sell or Share My Personal Information

VolunteerFlow does not sell or share personal information for cross-context behavioral advertising or in exchange for money. To submit a request, contact legal@volunteerflow.us. We will respond within 45 calendar days.

14. Other State Privacy Laws

In addition to CCPA/CPRA, VolunteerFlow complies with privacy laws in Colorado, Connecticut, Delaware, Illinois (BIPA), New York (SHIELD Act), Utah, Virginia, and other states with similar requirements. If you are a resident of a state with a privacy law, you generally have the right to know what personal information is collected, to access, delete, and correct it, and to opt out of sales or targeted advertising.

To exercise rights under state privacy laws, contact legal@volunteerflow.us. We will respond within timeframes specified by your state's law, typically 30–45 days.

15. Contact Information

15.1 Privacy Questions and Requests

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact:
Email: legal@volunteerflow.us

15.2 Support and Troubleshooting

For technical support or account-related issues, visit our support portal or contact your organization administrator.

15.3 Report a Data Breach

If you believe your personal information has been compromised or accessed without authorization, contact legal@volunteerflow.us immediately.

16. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last Updated" date, notify users by email or through the platform dashboard, and provide a notice period (typically 30 days) before changes take effect. By continuing to use VolunteerFlow after changes become effective, you accept the updated Privacy Policy.

Previous versions of this Privacy Policy are available upon request at legal@volunteerflow.us.

17. Additional Notices

17.1 Third-Party Links

VolunteerFlow may contain links to third-party websites or services. This Privacy Policy applies only to VolunteerFlow. We are not responsible for the privacy practices of third-party providers.

17.2 Data Ownership

Organizations that use VolunteerFlow own the personal information they provide to the platform. VolunteerFlow does not claim ownership of this data and acts as a data processor on behalf of organizations.

17.3 Organizational Responsibility

Organizations using VolunteerFlow remain responsible for collecting personal information lawfully, providing their own privacy notices to volunteers, complying with data protection laws, responding to volunteer data requests, and ensuring appropriate consent for background checks.

17.4 Governing Law

This Privacy Policy is governed by the laws of the State of New York, United States, without regard to conflict of law provisions. Privacy rights under GDPR, CCPA, and other state privacy laws will be applied according to their respective jurisdictions.

17.5 Entire Agreement

This Privacy Policy, together with our Terms of Service and any Data Processing Agreement, constitutes the entire agreement regarding privacy and data protection. If any provision is found to be unenforceable, the remaining provisions will continue in effect.