Welcome to Hilaron. We are committed to protecting your personal information and your right to privacy. This Privacy Policy describes how Hilaron, Inc. (“Hilaron,” “we,” “us,” or “our”) collects, uses, stores, and shares your information when you use our websites, mobile applications, dashboards, and related services (collectively, the “Service”).

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

2.1 Information You Provide

We collect information you voluntarily provide when using the Service:

• Account Information: name, email address, password, and account type (donor or organization).
• Profile Information: profile photo, bio, and preferences.
• Payment Information: credit/debit card details and billing address, processed securely by Stripe. Hilaron does not store full payment card details.
• Donation Information: donation amounts, recipient organizations, and campaign selections.
• Organization Information: organization name, EIN, address, beneficial ownership, bank account details for payouts, and tax-exempt documentation.
• Communications: messages you send to us or to other users through the platform.

2.2 Information Collected Automatically

When you use the Service, we automatically collect certain information:

• Device Information: device type, operating system, and unique device identifiers.
• Log Information: access times, pages viewed, IP address, and referring URL.
• Location Information: general location derived from IP address.
• Usage Information: features used, actions taken, and time spent on pages.
• Cookies and Similar Technologies: see our Cookie Policy for full detail.

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Process donations, recurring gifts, and payouts.
• Generate tax receipts and donation records.
• Send transaction confirmations, account updates, and service notices.
• Verify organization eligibility, identity, and beneficial ownership.
• Communicate with you about your account and the Service.
• Send promotional communications, where you have consented to receive them.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations, including sanctions, anti-money-laundering, and tax recordkeeping requirements.
• Analyze aggregate usage patterns to improve the user experience.

We may share your information in the following circumstances:

4.1 With Organizations

When you make a donation, we share your name and email address with the recipient organization so they can acknowledge your gift, issue receipts, and provide impact updates. You may choose to donate anonymously on a per-contribution basis; even when an organization does not see your identity, Hilaron retains records as required for payment, fraud prevention, and tax purposes.

4.2 With Service Providers

We share information with third-party providers who perform services on our behalf:

• Stripe — payment processing, payouts, and PCI-compliant card handling.
• Google Firebase — authentication, database, storage, hosting, and cloud functions.
• Candid (Foundation Center / GuideStar) — nonprofit verification and EIN lookup data used to enrich organization profiles.
• Hosting and CDN providers — for delivering web and media content (including Cloudflare).
• Email service providers — for transactional and (where opted in) marketing communications.
• Analytics providers — for product usage analysis and quality improvement.

These providers are contractually required to protect your information and to use it only to deliver services to Hilaron.

4.3 For Legal Reasons

We may disclose information if required by law, court order, or government request, or to protect the rights, privacy, safety, or property of Hilaron, our users, or the public.

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption of data in transit (TLS) and at rest (AES-256).
• Secure password hashing managed by our identity provider.
• Access controls, least-privilege provisioning, and audit logging.
• PCI DSS Level 1 compliant payment processing through Stripe.
• Regular security reviews of our infrastructure and dependencies.

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

We retain your personal information for as long as your account is active or as needed to provide you services. We also retain information as necessary to comply with legal obligations (such as tax recordkeeping requirements), resolve disputes, and enforce our agreements. Donation and payout records are retained for at least seven (7) years for tax and audit compliance.

Depending on your location, you may have the following rights:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request deletion of your personal information, subject to our legal retention obligations.
• Portability: request your data in a portable, machine-readable format.
• Opt-out: unsubscribe from marketing communications at any time.
• Withdraw Consent: where processing is based on consent, withdraw it without affecting prior processing.

To exercise these rights, email [email protected]. We respond to verifiable requests within 30 days.

We use cookies, local storage, and similar technologies to keep you signed in, remember preferences, and protect against fraud. For a complete description of the categories of cookies and storage we use, the third parties involved, and your choices, see our Cookie Policy.

You can control cookies through your browser settings. Disabling certain cookies may limit your ability to use parts of the Service (for example, signing in or completing a donation).

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 in compliance with the Children’s Online Privacy Protection Act (COPPA). Account creation requires users to be at least 16 years old (or the age of digital consent in their jurisdiction), and donations require users to be at least 18. If you believe a child under 13 has provided us with personal information, please contact us at [email protected] and we will take steps to delete that information.

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where Hilaron and many of our service providers operate. These countries may have different data-protection laws than your jurisdiction. When we transfer your information internationally, we use appropriate safeguards (such as standard contractual clauses with our sub-processors) to ensure your information remains protected.

California residents have additional rights under the California Consumer Privacy Act (as amended by the California Privacy Rights Act), including the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate personal information, and the right to opt out of the sale or sharing of personal information.

We do not sell your personal information. To exercise your CCPA/CPRA rights, contact us at [email protected].

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the GDPR (and UK GDPR), including access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. You also have the right to lodge a complaint with your local supervisory authority. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. To exercise these rights, contact our Data Protection Officer at [email protected].

The Service may contain links to third-party websites or services that are not operated by Hilaron. This Privacy Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party site you visit.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the updated policy on this page and revising the “Last updated” date above. For material changes, we will provide additional notice (for example, by email or an in-app notification) before the change takes effect.

If you have questions about this Privacy Policy or our privacy practices, please contact us:

• Privacy Inquiries: [email protected]
• Legal: [email protected]
• General Support: [email protected]
• Data Protection Officer: [email protected]

Hilaron, Inc.
Attn: Privacy