Privacy Policy

A nonprofit organization uses Data Health to clean and match its own donor records, and to track pledges its members have made and chase the ones that are still open. The organization uploads its own files: gift exports from its accounting system, membership lists, honors and pledge sheets. Data Health matches those records to each other, resolves duplicate identities, and can send pledge reminders from the organization’s own email account.

The organization decides what to upload, who may see it, and who is contacted. In data-protection terms the organization is the controller of the records about its donors and members, and CauseMatch is a processor acting on its instructions. If you are a donor or member and you want your record changed or removed, the organization that holds it can act fastest, but you may also write to us at joseph@causematch.com and we will act or route the request.

Records the organization uploads. These are files the organization chooses to import. In practice they contain donor and member names, email addresses, and, where the organization’s own file contains them, postal addresses and phone numbers. They also contain giving history: the date, amount and currency of each gift, what it was designated for, and how it was recorded as paid. Pledge files add the item or honor pledged, the occasion, the amount, the date pledged, and any payments recorded against it. Uploaded rows are stored unchanged as an immutable record of what the file said, and a separate, editable person record is derived from them. Corrections are made on the derived record; the original import is never rewritten.

Accounts for the organization’s own staff. For each person who signs in we store a name, an email address, and an identifier from our sign-in provider. We do not store passwords.

The connected Gmail account. If the organization connects a Google account for sending, we store the email address of that mailbox and the OAuth refresh token Google issues. Section 3 covers this in full.

A record of every reminder. For each pledge reminder the application queues or sends, we store the recipient’s email address, the subject, the exact message text that was sent, the time it was sent, the identifiers Google returned for the message and its conversation, and any error. This is kept so the organization can prove what it said to whom, and so the next reminder joins the same conversation instead of starting a new one.

Ordinary server logs. Our hosting provider records requests to the application, including IP address, timestamp and the path requested, in the normal course of running a website.

When someone at the organization connects a Google account, Data Health asks for exactly three OAuth scopes, and nothing else.

• https://www.googleapis.com/auth/gmail.send so the application can send the organization’s pledge reminders from the organization’s own mailbox. This matters to the recipient: the message arrives from the office they already know, and a reply reaches that office rather than a third party. This scope permits sending only. It grants no ability to read, search or list mail. The application calls exactly one Gmail method, users.messages.send, and no other.
• openid and email for one purpose: they are what makes Google return an id_token in the token response, which is the only way the application learns which mailbox was just granted. We store that address and show it in the app, so the person who connected the account can see which mailbox reminders will come from, and so a second person cannot silently attach a different one.

What we do not do with Google account data. We do not read, search, list, download, or store the contents of the connected mailbox, or any message it has received. The application holds no read scope and is not technically capable of doing so. We do not use Google user data for advertising. We do not sell it. We do not use it to develop, improve or train generalized artificial intelligence or machine-learning models. We do not transfer it to any third party except as needed to deliver the message the user asked us to send, or when the law requires it.

Stated explicitly, because this application does include an assistant feature described in section 5: Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models. The assistant answers questions about an organization’s own uploaded records. It has no access to the Gmail connection, and no data obtained from any Google API is passed to it.

Limited Use. Data Health’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How the token is stored and how to remove it. The refresh token is stored in our database so that reminders approved today can still be sent tomorrow. It is used for one thing: to obtain a short-lived access token at the moment a message is sent. It is never written to logs, never displayed in the application, and never shared. Disconnecting the account inside Data Health erases the stored token immediately. You can also revoke the grant directly at myaccount.google.com/permissions, after which the next send attempt fails, the connection is marked disconnected, and nothing further is sent until someone reconnects.

Pledge reminders are not marketing. Each one states what the organization’s records show as still open and asks the recipient to settle it or to correct the record. The application refuses to send when it cannot stand behind the claim: if the organization’s payment data does not cover a recent enough period, every reminder is held rather than sent, because telling someone they have not paid over a window nobody has checked is the specific harm this feature is built to avoid.

Every reminder carries two ways out, and both work immediately:

• a plainly visible unsubscribe link in the body of the message, and
• a List-Unsubscribe header with one-click support, so a mail client can offer or perform the unsubscribe without the recipient opening anything.

Either one marks that person as do-not-email within that organization’s records. The application will not queue another reminder to them, and the unsubscribe link does not expire. A recipient can also simply reply to the message, which reaches the organization’s own mailbox directly.

We use the following providers. Each one processes only what its function requires.

• Vercel, application hosting and request logs.
• Neon, the managed PostgreSQL database that holds the records described in section 2.
• Supabase Storage, object storage for the files an organization uploads.
• WorkOS, sign-in for the organization’s own staff accounts.
• Google, delivery of reminder messages through the organization’s own connected mailbox.
• Anthropic, for an optional assistant feature that answers questions about a workspace’s records. It is off by default and is currently limited to named CauseMatch staff accounts. When it is used, the records needed to answer the question are sent to Anthropic to produce that answer.

These providers operate in the United States and other countries, so information covered by this policy is stored and processed outside the country where it was collected.

Uploaded files and the rows imported from them are kept as the organization’s permanent record of what its own system said, and derived person, gift and pledge records are kept for as long as the organization’s workspace exists. The reminder log is kept as a record of what was sent.

Deleting a workspace deletes everything belonging to it, including uploads, imported rows, people, gifts, pledges, reminders and any connected mailbox record. An organization can also ask us to delete specific records, or all of its data, by writing to joseph@causematch.com. We act on deletion requests within 30 days and confirm when it is done. We may keep a minimal record that a deletion request was made and satisfied.

Depending on where you live, you may have the right to ask for a copy of the information held about you, to have it corrected, to have it deleted, to object to a particular use, and to complain to a supervisory authority. Because the organization that uploaded the records controls them, the fastest route is to contact that organization directly. You may also write to us at joseph@causematch.com, and we will act on the request or pass it to the organization and tell you that we have. To stop reminder emails without contacting anyone, use the unsubscribe link in any message.

Traffic to the application is served over HTTPS. Every record belongs to exactly one workspace, and the application scopes each query to the workspace of the signed-in user, so one organization’s records are not reachable from another’s account. Staff sign in through our authentication provider rather than a password we store. Application secrets, including the Google client secret, are held as encrypted environment variables and are not present in the source code. The Gmail refresh token is never logged.

No system is perfectly secure. If we discover a breach affecting an organization’s records we will notify that organization promptly and describe what happened.

Data Health is a tool for organizations and is not directed at children. We do not knowingly solicit information from children.

If we change this policy we will update the date at the top of the page, and we will tell the organizations using Data Health directly when the change is material.

Questions, requests, and complaints about this policy or about information held in Data Health go to joseph@causematch.com.

See also our Terms of Service.