Privacy policy

This policy explains how Warm Heart Foundation (“the Foundation”, “we”, “us” or “our”), a nonprofit organization based in the United States handles personal information on this website and in related emails and services. We collect only what we need to receive donations, grant them to causes, keep the site safe and tell people about causes that need help.

We do not sell your personal information for money. Where we use advertising technologies that may count as “sharing” or “targeted advertising” under U.S. state laws, you can opt out as explained below.

(a) Information you provide:

• Donors: name, email, donation amount, selected cause, optional message, display preferences (for example, anonymous) and, if you choose, billing address.
• Account holders: name, email, password (stored hashed), profile photo and preferences.
• Organizers and beneficiaries: contact details, the story, photos and videos you submit, relationship to the beneficiary, and verification documents such as a photo ID, medical estimates, invoices or leases. Bank details for disbursements are collected by our payment processor.
• Messages you send us through the contact form, email or chat.

(b) Payment information: card and bank details are collected directly by Stripe, Inc. (and by PayPal or another provider when you choose it at checkout). We never see or store full card numbers. We receive a confirmation, the last four digits, the card brand and the billing country. Stripe's handling of your data is described at stripe.com/privacy.

(c) Information collected automatically: device and browser type, IP address and approximate location, pages viewed, referring site or ad, and cookie or similar identifiers, as described in the Cookie Policy.

(d) Information from third parties: payment confirmations and fraud signals from our processors; ad performance data from advertising platforms; and information an organizer provides about a beneficiary.

• To process donations, issue receipts and answer questions about them.
• To verify organizers and beneficiaries, review causes and disburse funds.
• To detect and prevent fraud, abuse, money laundering and sanctions violations.
• To run, secure and improve the site, including measuring which pages and features work.
• To show your name and message on a cause page if you allowed it.
• To send emails you asked for, such as milestone alerts or news about causes; you can unsubscribe at any time.
• To promote causes through advertising and measure whether those ads reach people, as described below.
• To meet legal, tax and accounting obligations and to enforce our Terms.

Where laws such as the EU or UK GDPR apply, we rely on:

• Contract: processing your donation and running your account.
• Consent: non-essential cookies, advertising technologies and optional emails.
• Legitimate interests: security, fraud prevention, improving the site and telling supporters about similar causes.
• Legal obligation: tax, accounting and anti-money-laundering records.

• Essential: keep you signed in, remember your cookie choices and protect the site. These cannot be switched off.
• Analytics: help us understand which pages and features work, in aggregate.
• Advertising: pixels and tags from Meta, TikTok and Google that measure whether an ad led to a visit or a donation.

You can change your choices at any time in Cookie settings. We honor Global Privacy Control (GPC) signals; we do not currently respond to “Do Not Track” signals because there is no common standard for them. The Cookie Policy lists each cookie and how long it lasts.

• Payment processors (Stripe and, if used, PayPal) to process payments and prevent fraud.
• Service providers who host the site, send email, store files, provide analytics or support us, under contracts that limit their use of the data.
• Organizers and beneficiaries of the cause you supported: your name, amount and message, unless you chose to stay anonymous or hide the amount. Your email is never shown publicly.
• Advertising platforms such as Meta, TikTok and Google, through their pixels and tags or as hashed contact lists, to measure and improve the reach of our ads — only as described in this policy and the Cookie Policy, and subject to your choices.
• Authorities, when required by law or to protect rights, safety and the integrity of the site.
• A successor organization if the Foundation merges or transfers its operations, with notice to you.

We may use the Meta Pixel and Conversions API, the TikTok Pixel and Events API, Google Ads and Google Analytics tags, and similar tools. They help us understand whether an ad led someone to visit a cause or donate, and to show causes to people likely to care. These tools may collect your IP address, device identifiers, the pages you visit and events such as a completed donation; the platforms may link this to your account with them under their own policies.

We do not send health details, verification documents or donation messages to advertising platforms, and we do not build ad audiences from sensitive categories such as health, religion or sexual orientation.

• Cookie settings: choose which non-essential cookies and tags to allow, as explained in the Cookie Policy.
• Opt out of targeted advertising and “sharing”: email us with the subject “Do Not Sell or Share”. We also honor Global Privacy Control (GPC) signals sent by your browser.
• Ad settings on each platform: Meta (facebook.com/adpreferences), Google (adssettings.google.com) and TikTok (in-app privacy settings).
• Emails: use the unsubscribe link in any non-essential email. Receipts and security notices will still be sent.
• Public display: when donating, you can hide your name or the amount.

• Donation and disbursement records: for at least seven years, to meet tax and accounting rules.
• Verification documents: for as long as the cause is active and up to five years afterward, or longer if the law requires.
• Account information: while your account is open; deleted or anonymized within 30 days of closing it, except where we must keep records.
• Technical logs and analytics: generally no longer than 24 months.

We use encryption in transit, a PCI-compliant payment processor, access controls limited to staff who need the data, and monitoring for unusual activity. No system is perfectly secure; if you suspect a problem with your account, contact us right away.

We are based in the United States and process data there. If you are outside the U.S., your information will be transferred to the U.S. We use appropriate safeguards for transfers from the EEA, UK and Switzerland, such as the European Commission's standard contractual clauses.

Depending on where you live, you may have the right to:

• Access: ask what personal information we hold about you.
• Correction: have inaccurate information fixed.
• Deletion: ask us to delete information we no longer need to keep.
• Objection and restriction: object to, or limit, certain uses.
• Portability: receive a copy in a usable format.
• Opt-out: of targeted advertising, “sharing” and non-essential email.

To make a request, email contact@warmheartfoundation.com. We will verify your identity and reply within the time the law requires (usually 30 to 45 days). We will not treat you differently for exercising your rights.

Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with consumer privacy laws have the rights above, plus the right to opt out of the sale or sharing of personal information and of targeted advertising, and to appeal a decision we make about a request.

In the last 12 months we collected identifiers, payment confirmation details, internet activity, approximate location and, for organizers, verification information. We used them for the purposes in this policy. We did not sell personal information for money; use of advertising pixels may be considered “sharing” for cross-context behavioral advertising, which you can opt out of as described in Your privacy choices. An authorized agent may make a request for you with your written permission.

If the GDPR or UK GDPR applies to you, you also have the right to lodge a complaint with your local data protection authority. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

The site is meant for adults. We do not knowingly collect personal information from children under 13 except as part of a cause submitted by a parent or guardian, who controls that information. Images of minors are used only with a parent's or guardian's consent. If you believe a child has given us information, contact us and we will delete it.

Cause pages and our emails may link to other websites, such as a hospital, a news article or a social network. Those sites have their own privacy practices, which we do not control. Check their policies before sharing information with them.

Transactional emails — receipts, security notices and messages about a cause you support or run — are part of using the site and are always sent. Optional updates, such as news about causes or milestone alerts, are sent only if you asked for them, and every one has an unsubscribe link. We may use a service provider to send email and to tell us whether a message was opened.

If we learn of a security incident that affects your personal information, we will investigate, contain it and notify you and the relevant authorities without undue delay and within the time the law requires, with the information you need to protect yourself.

We will post updates here and change the date at the top. If a change materially affects how we use your information, we will tell you by email or on the site before it takes effect.

Privacy questions and requests: contact@warmheartfoundation.com.

Email: contact@warmheartfoundation.com · Contact form: Help & contact