Site Privacy Policy

Last Modified: October 21, 2024

1. Processing Activities Covered by this Privacy Policy

Virtuous Software Inc. (“Virtuous” or “we” or “our” or “us”) share our users’ (collectively “you” or “yours” and “users”) concerns about the privacy of personal information collected on the internet. Accordingly, this Privacy Policy (“Policy”) describes how we collect, use, and disclose information that is associated with an identified or identifiable natural person and is protected as personal data under applicable data protection laws (“Personal Data”) through:

• our Sites including without limitation www.virtuous.org, www.raisedonors.com, www.vomo.org, www.givevirtuous.org, and www.virtuoussoftware.com, as well as all related subdomains and apps (“Sites”); or
• email, text, and other electronic messages (“Communications”).

Sites and Communications are collectively “Services”.

It does not apply to information collected by:

• Us offline or through any other means, including on any other site operated by us or any third party;
• Through our customers using our commercial SaaS-based/cloud-services (“Subscription Services”); or
• Any third party, including through any application or content (including advertising) that may link to or be accessible from or through the Services.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. Your use of our Services will signify and confirm your consent to the terms of this Policy. If you do not agree with this policy, do not access or use our Services or interact with any other aspect of our business.

This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of our Services after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.

2. Legal Basis for Processing Personal Information

The lawful basis upon which we process your data will depend on the Personal Data collected and the nature of our use. We normally collect Personal Data in performance of a contract between Virtuous and you, in which we are the data controller, to provide you with the content available through our Services, connect you with other users, and to provide you with other information in response to any of your requests. We may also collect your Personal Data if you have provided us with consent to use your data, in which case the lawful basis is your consent, or if we have a legitimate interest in processing your personal information where the processing is not overridden by your data protection interests or fundamental rights and freedoms.

Personal Data We Collect About You

We collect the following categories of data through our Services, which may contain Personal Data. You are not required to provide any Personal Data to us, but if you do not provide certain Personal Data to us, you may not be able to use our Services and we may not be able to authenticate or assist you with your inquiries or requests.

Data We Collect Directly from You

Contact And Other Information. If you request a demo, create an account, engage with us through our chatbots, interact with our marketing services, or otherwise contact us or use our Services in any way, we may collect personally identifiable contact information from you such as your name, phone number, email address, company information, title, etc.

Data We Collect from Your Use of Our Services

Usage Data. We may collect information from your use of the Sites about your internet connection, the equipment you use to access our Site, such as usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies, or interactions with our chatbots. See the Section on Cookies below for more information.

Data We Collect About You from Third Parties

From our Service Providers. Certain of our service providers may collect and share data about you through the services they provide to us, such as when they help us collect your contact information or usage data.

From Unrelated Third Parties. We may receive data about you or your organization, industries, lists of companies that are our customers or prospective customers, website visitors, marketing campaign recipients, and others (including that of individuals associated with such entities) related to our business from affiliates, channel partners, service providers, vendors, or through publicly available information. We do not control these third parties’ tracking technologies or how they may be used.

4. Cookies

What is a Cookie?

A cookie is a small piece of data that may be stored on your computer or mobile device. It allows a website to “remember” your actions or preferences over a period of time. We may also use other similar technologies from time to time, such as web beacons or pixel tags, to monitor internet or electronic network activity.

Why do we use cookies?

Virtuous and its third-party vendors use first-party (where we place them) and third-party cookies (where our vendors place them). Examples of the types of cookies that we use and their purposes are summarized in the chart below.

How long do cookies last?

We use two types of cookies on our Sites. “Session cookies” last as long as your online session and expire when you close your browser. “Persistent cookies” stay on your device after your browser has been closed but generally not longer than 13 months.

How can you manage your cookie preferences?

See Managing Your Preferences below.

5. How We Use Personal Data

We use Personal Data for the following purposes to:

• Provide, update, maintain, audit, improve, and protect our Services and business;
• Provide customer service, maintenance, and support;
• Respond to requests, comments, and questions by you;
• Provide and facilitate the delivery of Services;
• Detect, investigate, protect against, and prevent security issues, including through malicious, fraudulent, illegal, or other similar activity;
• Comply with verification and fraud prevention laws and requirements;
• Detect bugs, repair and report errors, and perform activities to maintain the quality or safety of our Services;
• Link or combine it with other personal information we get from third parties to help provide you with better service;
• Develop and send you marketing, sales, and promotional communications (where this is in accordance with your marketing preferences);
• Display and measure engagement with advertisements across different devices and sites;
• Conduct internal research for technological development and demonstration;
• Use for short-term transient purposes such as to test or customize new content for our Services;
• Process your information for other legitimate business purposes such as data analysis, audits, collecting and assessing feedback, identifying usage trends, determining the effectiveness of our marketing campaigns, and to evaluate and improve our products, services, marketing, and customer relationships;
• Analyze or predict your personal preferences, interests, or behavior;
• In any other way we may describe when you provide the information;
• For any other purpose with your consent.

6. How We Share and Disclose Personal Data

We do not sell your information and we do not share your information with third parties other than as follows:

• Upon your instruction
• With your consent, for example, when you agree to our sharing your information with other third parties for their own marketing purposes subject to their separate privacy policies;
• Internally within our organization and subsidiaries;
• Where it has been de-identified, including through aggregation or anonymization;
• To our third-party vendors and service providers who act on our behalf and instruction to fulfill Services obligations, provide IT, provide billing and corporate functions, process data, prevent fraud, and to fulfill other purposes such as marketing and advertising;
• To a prospective or actual purchaser or seller in the context of a merger, acquisition, or other reorganization or sale of our business or assets;
• As required by applicable law, including without limitation in response to any government or regulatory agency request to cooperate with law enforcement investigations or upon receipt of any court order;
• To comply with laws or to respond to lawful requests and legal process, to protect our rights and property and that of our agents, customers, members, and others, including to enforce our agreements, policies, and terms of use or in an emergency to protect the personal safety of any person;
• Within certain of our products, we use and transfer your data collected through Google APIs in accordance with the Google API Services User Data Policy, including its Limited Use requirements located at https://developers.google.com/terms/api-services-user-data-policy. These products include:
  • Gmail Integration: If you use the Gmail integration (or choose to integrate any other Google Workspace application) with our Subscription Service, you will be asked to give us access to information from your Google account. By using the Gmail integration with the Subscription Service, you will grant the Subscription Service access to information associated with your account, including contacts, emails, calendars, distribution lists, subject lines, and URLs of tracked links from your email. The Subscription Service will be able to read, modify, create, and send emails from your connected Gmail account. The Subscription Service will scan the content of your emails to identify which emails you are tracking. The Subscription Service will store replies, outgoing mail, email headers, subject lines, distribution lists, aliases, time sent, and email bodies. You acknowledge that the correspondences tracked in the Subscription Service will be visible to other users in your Subscription team.
  • Google reCAPTCHA: We have implemented Google reCAPTCHA on certain products and services to prevent malicious software from engaging in abusive activities on our Sites.
  • Google Single Sign-on: We have implemented Google SSO on certain products and services in order to provide authentication via Google as the external identity provider (IdP).
• For any other purpose disclosed by us when you provide the information;
• With your consent.

7. How Long Do We Keep Your Personal Data?

We generally retain Personal Data for as long as needed for the specific business purpose or purposes for which it was collected. In some cases, we may be required to retain Personal Data for a longer period of time based on laws or regulations that apply to our business or for other necessary business purposes. When the purposes of processing are satisfied, we will delete or depersonalize your personal data within a reasonable time period.

8. Anonymized Data

We may create anonymous data from the personal information we receive about you and other individuals whose personal information we collect as set forth in this Privacy Policy. Anonymous data might include analytics information and information collected by us using cookies. We make personal information into anonymous data by excluding information (such as your name) that makes the data personally identifiable to you.

9. Links to Third-Party Sites

Our Sites may contain links to third-party Sites and features. This Privacy Policy does not cover the privacy practices of such parties. These parties have their own privacy policies, and we do not accept any responsibility or liability for their Sites, features, or policies. Please read their privacy policies before you submit any data to them.

10. Security of Personal Data

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we implement physical and technical measures designed to protect your Personal Data from unauthorized access, use, or disclosure.

We may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of the Services. If we learn of a security system’s breach, we may attempt to notify you electronically by posting a notice on the Services, by mail, or by sending an email to you.

More information about our security practices are available here.

11. Age Limitations

Virtuous Services are not intended for use by anyone younger than 13 years old. If you learn that anyone younger than 13 has used our Services or provided us with Personal Data, please contact us and we will take steps to delete such Personal Data.

12. Non-Discrimination

We will not discriminate against you if you exercise your choices, provided that if you do not provide data to us, we may not be able to provide Services to you.

13. Your Marketing Choices

There are several ways that you can manage your cookie and marketing preferences:

• Within your browser, you can choose whether you wish to accept cookies or not. Different browsers make different controls available to you. Generally, your browser will offer you the choice to accept, refuse, or delete cookies at all times or those from certain providers or those from specific websites.
• If you wish to opt out of any marketing communications from us, please contact us at [email protected]. Please note that even if you opt out from receiving marketing emails, we may still send you non-marketing emails, which include emails in connection with your use of the Services.

14. International Data Transfers

Our Services are generally located in the United States, and we may also process your information in other jurisdictions to provide support and other similar services. If you are visiting or using our Services, please be aware that your personal data may be transferred to and processed in a jurisdiction other than the country in which you are resident. The data protection laws of these jurisdictions may or may not be as comprehensive or protective as those in your country. When we engage in such transfers, we strive to use appropriate technical safeguards and use a variety of secure mechanisms, including standard contractual clauses and equivalent clauses, to help protect your rights.

15. Your State Privacy Rights

Certain state consumer privacy laws may provide their residents with additional rights regarding our use of their Personal Data. For example, California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia provide (now or in the future) their state residents with rights to:

• Confirm whether we process their personal information.
• Access and delete certain personal information.
• Correct inaccuracies in their personal information, taking into account the information’s nature and processing purpose (excluding Iowa and Utah).
• Data portability.
• Opt-out of personal data processing for:
  • targeted advertising;
  • sales; or
  • profiling in furtherance of decisions that produce legal or similarly significant effects.
• Either limit (opt-out of) or require consent to process sensitive personal data.
• The right to request certain information at no charge two times every 12 months (California).

The exact scope of these rights may vary by state. To exercise any of these rights, please see Who to Contact to Exercise Your Rights.

16. Your EEU, UK, and Switzerland Rights

Although our Services are located in the United States, to the extent that you are accessing our services from the European Economic Area, the UK, Switzerland, or the United Kingdom, you may have the following data protection rights subject to lawful exemptions:

• The right to access, correct, update, or request deletion of your personal information;
• The right to object to the processing of your personal information by asking us to restrict processing of your personal information or request portability of your personal information; and
• The right to withdraw your consent at any time if we collected and processed your personal information with your consent. Please note that withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• The right to submit a complaint to a data protection authority about the collection and use of your personal information.

17. Who to Contact to Exercise Your Rights?

If you are using any of our Subscription Services, these services are made available to you through the Customer (e.g., the organization subscribing to our services) where the Data Controller is the customer and Virtuous is the Data Processor. Please direct your data privacy questions to your administrator before contacting Virtuous as your use of the Services is subject to that organization’s policies.

For any situations where Virtuous is the Data Controller (e.g., your information was collected outside of using our Subscription Services), please contact us to have your data removed by emailing [email protected].

18. Verified Request

To the extent we are the data controller, we will verify that the information you submit (which may include first name, last name, email address, company, and country/state) matches our records before we fulfill the request. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

19. Contact Us

Please feel free to contact us with any comments, questions, complaints, or suggestions you might have regarding our privacy practices described in this Policy. You may send us an email at [email protected] or via mail to:

1 North 1st Street
Phoenix, AZ 85004
Attn: Virtuous Software Legal Department

20. Changes To Our Privacy Policy

We reserve the right to change, modify, add, or remove portions of this Policy from time to time and will provide you with notice when significant updates are made or as required by applicable law. We recommend that you regularly revisit this Policy to learn of any such changes.