Privacy Policy

Last Updated: January 1, 2026
Effective Date: January 1, 2026

1. Introduction

Impact Idol ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our volunteer management platform, including our website, mobile applications (iOS and Android), and related services (collectively, the "Services").

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.

1.1 Your Organization's Privacy Policy Comes First

Impact Idol is a platform. Each community on Impact Idol is run by its own organization, such as a nonprofit, school group, food pantry, or volunteer chapter. That organization decides what information it asks its members for, how it uses that information, who in the organization can see it, and how long it keeps it. Its own privacy policy and terms apply to you in that community.

Impact Idol hosts and processes this information on the organization's behalf and following its instructions. In privacy-law terms, the organization is the data controller and Impact Idol is its data processor. This Privacy Policy describes how the Impact Idol platform handles information and the minimum protections that apply in every community.

For questions about your information, or to access, correct, or delete it, contact your organization first. If you can't reach them, or your question is about the Impact Idol platform itself, contact us at [email protected] and we will help or pass your request to the right organization.

2. Information We Collect

We collect several types of information from and about users of our Services:

2.1 Personal Information You Provide Directly

• Account Registration: Full name, email address, password (encrypted), phone number (optional)
• Volunteer Profile: Skills, interests, availability, volunteer hours, event participation history
• Payment Information: Processed through Stripe, Inc. We do not store credit card numbers
• Communications: Messages sent through our platform, email correspondence, feedback

2.2 Information Collected Automatically

• Device Information: IP address, browser type, device type, operating system
• Usage Data: Pages viewed, features used, time spent on site
• Cookies and Tracking: We use cookies to collect browsing information (see Section 9 for details)

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide Services: Create accounts, process event registrations, track volunteer hours
• Improve Services: Analyze usage patterns, develop new features, personalize experience
• Communications: Send transactional emails, event reminders, push notifications
• Security: Prevent fraud, monitor for unauthorized access, enforce Terms of Service
• Legal Compliance: Respond to legal requests, comply with applicable laws

4. Data Security

We implement industry-leading security measures to protect your information:

• Encryption in Transit: All data uses TLS 1.2 or higher encryption
• Encryption at Rest: Sensitive fields encrypted with AES-256-GCM
• Password Protection: Passwords hashed using industry-standard algorithms
• Multi-Factor Authentication: Optional MFA for enhanced security

5. Children's Privacy (COPPA Compliance)

Impact Idol is committed to protecting children's privacy in compliance with the Children's Online Privacy Protection Act (COPPA).

• We do not knowingly collect personal information from children under 13 without verifiable parental consent
• Parents/guardians must create household accounts and provide consent for minors
• Parents can review, delete, and export their child's data at any time

6. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information in limited circumstances:

• Nonprofit Organizations: If you're a volunteer member, your profile is visible to organization administrators
• Service Providers: Third-party services (Stripe for payments, Google Analytics for analytics)
• Legal Reasons: To comply with court orders, legal requests, or protect safety

7. Cookies and Tracking Technologies

We use cookies and similar technologies to improve your experience:

• Strictly Necessary Cookies: Essential for website functionality (authentication, security)
• Analytics Cookies: Google Analytics to understand usage (can be disabled)
• Functional Cookies: Remember preferences (language, theme)

You can manage cookie preferences via the cookie banner or browser settings. Opt out of Google Analytics

7.1 Mobile Numbers and SMS Consent

We use mobile numbers and SMS opt-in data only to provide account verification codes and minor sign-up approval messages to parents or guardians. Mobile numbers and SMS opt-in data are not sold or shared with third parties for marketing purposes.

8. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Update inaccurate information
• Deletion: Request deletion of your account and data
• Portability: Export your data in CSV or PDF format
• Opt-Out: Unsubscribe from marketing emails

To exercise your rights, contact us at [email protected]

9. State-Specific Privacy Rights

California Residents (CCPA/CPRA)

• Right to Know: Categories of personal information collected
• Right to Delete: Request deletion of your information
• Right to Opt-Out of Sale: We do NOT sell your personal information
• Non-Discrimination: We won't discriminate for exercising your rights

European Union (GDPR)

If you are located in the EU/EEA, you have additional rights under GDPR including the right to lodge a complaint with your local data protection authority.

10. International Data Transfers

Impact Idol is based in the United States. If you access our Services from outside the US, your information may be transferred to and processed in the United States. We use Standard Contractual Clauses (SCCs) for international transfers.

11. Data Retention

We retain your information as long as necessary to provide Services:

• Active Accounts: Data retained while account is active
• Deleted Accounts: 90-day grace period, then permanent deletion
• Legal Requirements: Some data retained for 7 years (consent records, financial data)

12. Third-Party Links

Our Services may contain links to third-party websites. We are not responsible for their privacy practices. Please review their privacy policies before providing information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email and posted on our website 30 days before taking effect. Your continued use after changes constitutes acceptance.

14. Contact Us

If you have questions about this Privacy Policy or our practices, please contact us:

Document Version: 1.0
Last Updated: January 1, 2026
Effective Date: January 1, 2026