Privacy Policy

Who we are

Givolve ([ENTITY: legal name pending incorporation]) operates a platform that connects people who want to give with people who have specific needs. This policy explains what personal information we handle, why, how long we keep it, and your rights over it. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

What we collect, and why

• Account information: name, email, and the role you choose (giver or receiver). Used to create and secure your account and to identify you to the other party in a gift.
• Campaign content: the story, amount, category, fund-use breakdown, and any images or updates a receiver chooses to publish. Used to display the need publicly and let givers evaluate it.
• Verification documents: for needs that go through Story Verification, a receiver may upload supporting documents. These might be proof of a bill or of a situation. They are stored in a private Supabase storage bucket that is never publicly accessible. Only the uploader and the Givolve admins reviewing the request can open it, through short-lived signed URLs. Used solely to decide whether a need earns a Story-Verified badge.
• Payment data (givers): card and payment details are handled directly by Stripe when you give; we never see or store your card number.
• Payout data (receivers): during the beta, receivers add their own bank account details directly in Givolve, not through Stripe. That means account holder name, account number, and routing/sort code or IBAN as applicable. These are encrypted before storage in our database and used only by our team to send payouts manually. We plan to move payouts to Stripe Connect in a later phase. At that point Stripe would hold this data instead of us.
• Identity verification status:during the beta, the "Identity Verified" badge is decided by manual review from our team, not automated Stripe KYC. We record only the resulting yes/no status, not the documents used to reach it. Any such documents fall under Verification documents above.
• Anonymous usage analytics: page views, shares, and donation events per need. These use a per-session random ID stored in your browser for the session only. We do not use tracking cookies, do not store IP addresses, and record country only (not precise location). Used to show receivers how their need is performing.

How long we keep it

Account and campaign content is kept for as long as your account is active. We keep it a reasonable period afterward for legal and fraud-prevention purposes. Verification documents are deleted 90 days after the need they support closes, whether it was completed, rejected, or taken down. We do not need them once a review decision is made and the need is no longer live.

Who we share it with

We do not sell personal information, ever. We share data only with the processors needed to run the platform:

• Stripe: processing gift payments from givers.
• Supabase: database, authentication, and file storage (including encrypted bank details and the private verification-documents bucket).
• Resend: transactional email delivery.
• Vercel: application hosting.

We may also disclose information if required by law, or to investigate fraud or protect the safety of our users.

Your choices and rights

You can view and edit your profile, control email preferences, and request deletion of your account. Under PIPEDA, you have the right to access the personal information we hold about you. You can also correct it if it is inaccurate, or request its deletion. Some records we have to keep for legal or fraud-prevention reasons, such as a completed gift's transaction record. Email support@givolve.ca to make a request. We will respond within 30 days.

Contact

Questions about privacy, or want to exercise your rights above? Email support@givolve.ca.