Privacy Policy

Hands of Hope foundation (the "Foundation," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit our website or make a donation, and the rights you have over your information.

1. Information we collect

1.1 Information you give us

• Donation details: name, email address, amount, currency, and (optionally) phone number, billing address, or tax identification number (e.g. NIF in Portugal).
• Payment information: processed by our PCI-compliant payment providers (Stripe, Pagou.ai, and WayMB). The Foundation never stores full card numbers or CVV codes. We retain a token, the last four digits, the card brand, and a non-reversible card fingerprint.
• Support tickets: name, email, the content of your message, and any attachments you provide.
• Words of support / comments: the display name and message you submit on a campaign page.

1.2 Information we collect automatically

• Device and log data: IP address, browser type and version, operating system, language preference, referrer URL, and pages visited.
• Cookies and similar technologies: see our Cookie Policy for details.
• Marketing identifiers: the Foundation uses tracking pixels (Meta Pixel, TikTok Pixel, Utmify) to measure ad effectiveness and reach donors with similar interests. These pixels collect cookie identifiers (e.g. _fbp, _fbc, _ttp, _ttclid) and may use server-to-server APIs (CAPI) to send a hashed version of your email to Meta and TikTok for ad attribution and audience matching.

2. Why we collect it (legal basis)

We process your information for the following purposes:

• To process your donation and provide your tax receipt (legal basis: contract, legitimate interest, or your consent);
• To comply with the law, including IRS reporting requirements, anti-fraud screening, and anti-money laundering obligations;
• To communicate with you about your donation, support tickets, and (where you have opted in) Foundation news;
• To analyze and improve the Services and our fundraising effectiveness;
• To prevent fraud and abuse on our platform.

3. How we share information

We share personal information only as needed and with the following categories of recipients:

• Payment processors: Stripe, Inc.; Pagou.ai; and WayMB / Easypay — to process your donation;
• Email delivery: Resend, Inc. — to send donation confirmations and support replies;
• Hosting and database: Vercel and Supabase — to host the Services and store donor records;
• Analytics and ads: Meta Platforms, TikTok, and Utmify — to measure marketing effectiveness;
• Operator notifications: Pushover — to alert the Foundation team of incoming donations;
• Legal compliance: regulators, courts, and law enforcement when required by a valid legal process.

We do not sell or rent your personal information for monetary or other valuable consideration.

4. International transfers

The Foundation is based in the United States and our service providers operate in the United States and the European Union. If you are located outside those regions, your information will be transferred to and processed in jurisdictions that may have different data-protection rules than your home country. Where required, we rely on the European Commission's Standard Contractual Clauses or equivalent legal mechanisms to lawfully transfer data internationally.

5. How long we keep it

• Donor records and receipts: kept for at least seven (7) years for IRS and accounting purposes;
• Support tickets: kept for three (3) years after resolution;
• Marketing identifiers (cookies, pixels): typically kept for up to two (2) years from your last interaction;
• Logs and analytics: typically kept for ninety (90) days to two (2) years.

We may keep information longer when legally required (e.g. ongoing litigation, regulatory hold).

6. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Delete your personal information (subject to legal retention obligations);
• Restrict or object to certain processing;
• Receive a portable copy of your information;
• Withdraw consent for processing based on consent at any time, without affecting prior lawful processing;
• Lodge a complaint with your local data-protection authority (e.g. your EU national DPA, the UK ICO, or the California Attorney General).

To exercise these rights, email adm@handsunitedforsolidarity.org or open a ticket via our support form. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

7. California residents (CCPA / CPRA)

California residents have specific rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"). These rights are detailed in Section 6 above. We do not sell or share personal information for cross-context behavioral advertising in the sense given by the CCPA without your consent. To opt out of any cross-context advertising, use the "Your Privacy Choices" link in the site footer.

8. EEA / UK residents (GDPR)

If you are in the European Economic Area or the United Kingdom, the legal bases listed in Section 2 apply. You also have the right to lodge a complaint with your national supervisory authority. We do not have an EU representative as we are not subject to GDPR Article 27 obligations; please direct GDPR-related requests to adm@handsunitedforsolidarity.org.

9. Children

The Services are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us at adm@handsunitedforsolidarity.org and we will delete it.

10. Security

We implement industry-standard administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, or destruction. No system is ever 100% secure; if we become aware of a breach, we will notify affected individuals and regulators as required by law.

11. Changes

We may update this Privacy Policy from time to time. The "Effective date" at the top indicates the current version. If we make material changes, we will notify you by email or by a notice on the Services before the change takes effect.

12. Contact