Privacy Policy

• Account and profile: name, email, display name, password hash, organization details, role, and preferences.
• Donations: amount, currency, references, status, payment method, donor messages; for guests: name/email/phone/address if provided; for anonymous donations we preserve anonymity in displays.
• NGO/media: campaign images, documents, ids you upload.
• Usage and device: IP, device/browser info, referral URL, timestamps, and basic analytics.
• Support/communications: messages you send us.
• From third parties: payment processors (payment status, references), auth providers (OAuth basics), and service providers tied to platform operations.

• Operate, secure, and improve the platform.
• Create and manage accounts, organizations, and campaigns.
• Process donations, issue confirmations, and show donor tallies (respecting anonymity).
• Enforce policies, detect fraud/abuse, and meet legal or compliance obligations.
• Communicate about service updates, security, support, and—where allowed—product news (you can opt out).

• Contract performance (providing the service you request).
• Legitimate interests (security, fraud prevention, service improvement, analytics).
• Consent (e.g., certain marketing, optional fields).
• Legal obligations (e.g., recordkeeping, AML/KYC where required).

• Service providers: hosting, storage/CDN, analytics, payment processing, email/SMS, support tooling.
• Payment processors: to collect donations; they receive the payment info you provide at checkout.
• Organization admins: campaign-level data needed to operate their campaigns (not your full payment instrument).
• Legal/compliance: to comply with law, enforce terms, or protect rights and safety.
• Business changes: in a merger, acquisition, or sale of assets, data may transfer under similar protections.

• Public surfaces: when you choose to donate anonymously, we hide your name and identifying info from public pages and other donors.
• Organizer visibility: organization admins may see your identity only if you consent (per donation or profile default). Platform administrators may access donor details for compliance, fraud prevention, or refunds.
• We still process necessary payment/identity data (including for guests) even when public anonymity is set. Guest donors who do not choose anonymity may have a display name shown; emails are not displayed.

We keep data as long as needed for the purposes above and to comply with legal, tax, and accounting obligations. When no longer needed, we delete or anonymize it.

We use reasonable technical and organizational measures (encryption in transit, access controls, logging). No system is 100% secure; notify us promptly of any suspected incident.

Depending on your location, you may have rights to access, correct, delete, or restrict certain processing, and to object or withdraw consent. You can manage some preferences in your account. To exercise rights, contact privacy@mboa.app or submit a DSAR via our request form (see compliance.mboa.app); we will verify your identity and respond within required timelines. Some data (e.g., payments/AML records) may be retained where legally required.

Data may be processed in countries other than yours. We apply safeguards appropriate to the transfer method (e.g., contractual protections).

The service is not directed to children under 16. We do not knowingly collect their data. If you believe we have, contact us to delete it.

Links to other sites/services are governed by their own policies; review them separately.

We may update this Policy. We will post the effective date and, for material changes, provide notice. Continued use after changes means you accept the updated Policy.