Paddlit
Privacy policy
The short version
- Organisations use Paddlit to run their fundraising events. For the information they put in about their guests, donors and volunteers, the organisation decides what's collected and how it's used, and we handle it on its behalf.
- We never touch the money. Card payments go from the payment processor straight to the organisation's own account, and card numbers never reach Paddlit.
- We don't sell information, show ads or use advertising or analytics trackers, and no organisation sees another's guests or donors.
- We record whether the emails we send for organisations are delivered, opened and clicked, and each organisation sees this for its own guests and volunteers. For emails with sign-in codes, we record only whether each was delivered, bounced or marked as spam, never whether it was opened or clicked.
- When an organisation deletes its account, its information is kept for 90 days so it can be restored, then deleted for good.
The full policy below is what counts.
Who we are
Paddlit is an online service for charity galas and fundraising nights. Organisations use it to sell tickets, check guests in, take pledges and gifts, show a live total on the big screen, and text and email their guests.
In this policy, “Paddlit”, “we” and “us” mean the company that runs Paddlit. “You” means anyone whose information Paddlit handles: the people who run organisations' accounts, their volunteers, their guests and donors, and visitors to our website.
This policy explains what information Paddlit handles, why, who it goes to and how long it's kept. Our Terms of service are the agreement between Paddlit and the organisations that use it.
Whose information it is
Paddlit handles information in two different roles, and it matters which one applies.
For an organisation's guests, donors and volunteers, the organisation decides. When an organisation adds its guests, sells tickets, takes gifts or invites volunteers, it decides what to collect and what to do with it. We handle that information only on the organisation's behalf, as its service provider (some laws say “processor”). If you're a guest or donor, the organisation running the event is the one to ask about your information.
For our own website, sign-ups and accounts, we decide. That covers information about the people who sign up and run an organisation's account, about organisations paying for Paddlit, about visitors to our website and people who ask us for a demo, and the records Paddlit keeps of sign-ins.
What we collect
From organisations and the people who run them: the organisation's name, logo and colours, the email address replies should go to, and the name and work email of the person who signs up and of each owner. If an organisation checks its nonprofit status, its tax ID number (EIN), which we look up in the IRS's public list of tax-exempt organisations. If it sets up its own texting number, the details the mobile carriers require: its legal name, type of organisation, tax ID, website and registered address, and one contact person's name, email address and phone number.
From volunteers: the name, email address and roles an organisation gives us when it invites you, and, if you choose, a mobile number you confirm with a code. If you switch in and out on a shared device, a four-digit PIN, which we keep only in a scrambled form we can't read back. We also keep the messages you send in Paddlit's staff chat.
About guests and donors, from the organisation or from you on its pages:
- your name, email address and mobile number, and whether you agreed to texts about the event (when, and how that was recorded) or asked them to stop
- your bidder number, your table, when you arrived and who checked you in
- the pledges you make, the tickets, tables or sponsorships you buy, the gifts you give (including whether you asked to give anonymously), and the receipts sent to you
- if you keep a card on file: its brand, last four digits and expiry date, how and by whom it was added, and your agreement to have the event's pledges charged to it (the card number itself goes only to the payment processor)
- notes the organisation's staff write about you for the event
- whether you've added your bidder card to your phone's wallet
From visitors to our website: what you type into the Book a demo form (your name, organisation and email address, and when your next event is). We keep the internet address you sent it from only in a scrambled form, to limit how many requests can come from one place.
Recorded as Paddlit is used:
- each sign-in: when it happened, the internet address it came from and the kind of browser and device, so we can keep accounts safe
- who did what in an organisation's account (who checked a guest in, who took a pledge, who changed a setting), so changes can be undone and the organisation can see who made them
- the emails and texts we send for organisations, and whether each email was delivered, opened or clicked (see Emails and texts, below)
- which version of our Terms of service and this policy the person who signed an organisation up agreed to, and when
- the requests our servers handle, in our servers' logs
We don't track where you are. If an organisation adds its venue's location, an iPhone may show the bidder card on the lock screen near the venue; the phone does that on its own, and Paddlit isn't told.
We don't ask for Social Security numbers, health information or full card numbers, and the box for staff notes asks staff to keep payment and medical details out of it.
Payments and cards: we never touch the money
When an organisation takes payments in Paddlit, they're processed by Stripe, a certified payment processor, on the organisation's own Stripe account. The organisation is the seller: its name is on the card statement, and the money goes from Stripe into the organisation's account and on to its bank. Paddlit never holds, receives or passes on donated money, and takes no cut of it.
Card numbers are typed into Stripe's secure fields, which send them straight to Stripe; they never reach Paddlit's servers. We keep only a card's brand, last four digits and expiry date, so staff and the cardholder can see which card is on file. A saved card is stored by Stripe on the organisation's account. When it's removed in Paddlit, it's taken off Stripe a day later (the day lets the removal be undone).
When an organisation sets up payments, the details Stripe needs (such as its bank account, and who the person setting it up is) are entered in Stripe's own secure screens and go to Stripe. Paddlit keeps only where the setup has got to, anything Stripe still needs, and the bank's name and the last four digits of the account.
Stripe handles payment information as the organisation's payment processor, under its own privacy policy.
Paying for Paddlit itself: organisations pay for their plan on Stripe's secure payment pages. We keep the plan, its dates and status, the invoices, and the card's brand, last four digits and expiry date, never the card number. If an organisation sends us a sales tax exemption certificate, we keep it privately with its account.
Emails and texts
Emails are sent through Amazon Simple Email Service (Amazon SES). The emails we send for an organisation (invitations, bidder cards, reminders, receipts, payment links and year-end statements) come from Paddlit's email address under the organisation's name, and replies go to the organisation.
For emails to guests, donors and volunteers, we record whether each one was delivered, bounced or marked as spam, whether it was opened, and which of its links were clicked. We do this with a tiny image in the email, which is fetched when the email is opened, and by sending its links through a Paddlit address on their way to where they lead. The organisation sees this for its own guests and volunteers, so it knows who got its messages.
Opens are approximate: some email apps fetch images automatically, so an email can show as opened when nobody read it, and others block images, so an email that was read can show as unopened. Tracking covers only emails sent through Paddlit. For emails with sign-in codes, we record only whether each was delivered, bounced or marked as spam, never whether it was opened or clicked.
Texts to guests come from the organisation's own texting number, which we set up and register with the mobile carriers for it. Texts go only to guests the organisation has marked as having agreed to them. Reply STOP to any of them and that organisation's texts stop; reply HELP for help. If you text a giving word (such as GIVE) to an organisation's number, you get one reply with a link to give, and nothing more unless you've agreed to texts.
Sign-in codes sent by text, and volunteer invitations by text, come from Paddlit's own number.
Texts are delivered through Twilio and the mobile carriers. Message and data rates may apply.
How we use it
Information organisations put in Paddlit is used to provide Paddlit to that organisation: to run its events, show its people what their role needs, send the messages it asks us to send, take its payments, write its receipts and reports, and keep its records.
Our own information is used to:
- set up and run organisations' accounts, and sign people in
- bill organisations for their plan and texting, and work out sales tax
- check an organisation's nonprofit status
- answer demo requests, and email owners about their account and their plan
- keep Paddlit safe: spot sign-ups from throwaway email addresses or many from one place, and limit repeated attempts
- count how Paddlit is used (such as events, guests, texts and storage) to apply each plan's limits and bill for it
What we don't do: we don't sell or rent anyone's information. We don't show ads, and Paddlit has no advertising or analytics trackers. No organisation sees another organisation's guests, donors or volunteers. Paddlit doesn't use AI, and guests' and donors' information isn't used to train any.
If you volunteer for more than one organisation, you have one Paddlit sign-in, but each organisation sees only its own events and what you did for it.
How long we keep it
While an organisation uses Paddlit, its information is kept until it's deleted in Paddlit, so the organisation keeps its records and donor history from year to year. Some things are cleared sooner on their own:
- a deleted event can be brought back for 24 hours, then it's gone for good
- staff chat for an event is deleted 90 days after the event; other conversations lose messages older than a year; and a deleted message's words are cleared a day later
- sign-in codes are deleted after 7 days, and the records of sign-ins 30 days after they end
- a card removed in Paddlit leaves the payment processor a day later
- a download of everything an organisation has, made by one of its owners, can be downloaded for an hour and is deleted soon after
When an organisation deletes its account, everything stops at once: its volunteers are signed out, its guests' links, bidder cards and big screen stop working, and its texts stop. Its information is kept for 90 days so an owner can restore it. After 90 days it's deleted for good: its events, guests, donors, pledges, payment records, messages, chat, notes and files, and the sign-ins of volunteers who don't work with any other organisation. Its texting number is given up.
What Paddlit's deletion doesn't reach:
- payment records on the organisation's own Stripe account, which stay with the organisation and Stripe
- the invoices for the organisation's Paddlit plan, which stay with Stripe, which handles our billing
- our record of what our staff changed
Demo requests are kept in our staff console.
Your choices
If you're a guest or donor:
- Reply STOP to stop an organisation's texts.
- See your card on file, and change or remove it, on your own bidder card page.
- Give anonymously if you'd like: your name isn't shown on the big screen or in reports, though the organisation's staff can see it so they can send your receipt and handle any refund.
- To see, correct or delete what an organisation holds about you, or to stop its emails, ask the organisation: it decides. It can erase your details from its account in Paddlit, and we can do that for it when it asks us to. Erasing removes your name, contact details and notes about you, and who the emails and texts sent to you went to and what they said; the amounts the organisation needs for its accounts stay, without your name, and if you replied STOP, its texts still won't come to your number. If you saved a card, erasing takes it off the organisation's payment account; the payment processor's own records of your past payments, which belong to the organisation's account there, aren't changed.
Anyone can ask us what information Paddlit holds about them, or ask us to correct or delete it: write to us through the contact form on our main page. If you're a volunteer, an organisation can take you off its events, or erase your details from them, which also closes your Paddlit sign-in unless another organisation still has you; to close your Paddlit sign-in altogether, ask us.
We don't sell or share personal information for advertising, so there's nothing to opt out of, and a Global Privacy Control signal from your browser matches how Paddlit already works.
Keeping it safe
How Paddlit protects information:
- Sign-ins use one-time codes sent to your email or phone, not passwords. Codes are kept only in scrambled form and stop working after five wrong tries.
- Sign-in cookies are sent only over encrypted connections.
- Each organisation's information is kept apart, and every request is checked against the organisation the person signed in to. We test this automatically.
- People see only what their role needs.
- Card numbers never reach our servers.
- Files such as logos are stored privately and shown only through Paddlit, by links that can't be guessed. They stop working the moment an organisation is deleted.
- The keys to each organisation's texting number are stored encrypted.
- Our staff sign in with a second step on their phone, see an organisation's screens only read-only, and every change they make is recorded.
Keeping a sign-in safe is partly up to you: don't share sign-in codes or your PIN, and sign out of shared devices.
Where it's kept
Paddlit is hosted on Amazon Web Services in the United States.
Changes to this policy
This page always shows the current version of this policy.
Contact us
Questions about this policy or your information? Write to us through the contact form on our main page.