Plain English first. This policy is written for nonprofit administrators, not lawyers. Every section starts with a one-line summary of what it means.
Section 1 — Introduction.
This policy explains what IRPForge does with your information and what rights you have. IRPForge operates irpforge.com and nonprofitirp.com. This Privacy Policy applies to both sites. It is incorporated by reference into our Terms of Service at irpforge.com/terms.
Section 2 — What Data We Collect.
We collect only what we need. We do not collect health data, donor records, or sensitive data about the people your organization serves. 2a. Lead Capture — email address, org type, org size, how you heard about us. No name, phone, or job title. 2b. Account Creation — email address and hashed password. 2c. Intake Form — organizational information only: org name, type, sector, headcount, technology choices, response roles. No SSNs, no PHI, no financial account numbers, no personal data about clients, donors, or patients. 2d. Payment — processed by third-party processor. IRPForge never sees your full card number. 2e. Usage and Analytics — aggregate data: pages visited, features used, browser type, device type, general geographic region. We use Cloudflare Web Analytics.
Section 3 — Why We Collect It.
Intake form data: to generate your plan only. Email: to deliver documents, account notices, and (opt-in only) marketing. Payment data: to process purchases. Analytics: to improve the Service.
Section 4 — Double Opt-In Email Marketing.
You will never receive marketing emails unless you have explicitly signed up and confirmed. Opting in is not required to use the Service. Step 1 — You enter your email and check a box. Step 2 — We send a confirmation email with a link. Step 3 — You click the link and are subscribed. Every marketing email includes an unsubscribe link. Unsubscribing does not affect your account or access to the Service.
Section 5 — Cookies and Analytics.
Essential cookies keep you logged in and maintain your session. Analytics cookies collect aggregate, non-identifying data. We do not use advertising cookies or track you across other websites. Analytics are provided by Cloudflare Web Analytics (https://www.cloudflare.com/privacypolicy/).
Section 6 — Data Sharing.
We do not sell your data. We share only with: hosting provider, payment processor, and email delivery provider — all under confidentiality obligations. We do not share with advertisers or data brokers.
Section 7 — Data Retention.
Account data: retained for life of account, deleted within 30 days of deletion request. Intake form data: 12 months for Starter purchases. Generated documents: same as intake data. Payment records: 7 years as required by law. Marketing email list: retained until unsubscribe.
Section 8 — Your Rights.
Right to access: email privacy@nonprofitirp.com with subject "Data Access Request." Response within 30 days. Right to deletion: email privacy@nonprofitirp.com with subject "Data Deletion Request." Response within 30 days. Right to unsubscribe from marketing: unsubscribe link in every marketing email.
Section 9 — Data Security.
We use encrypted storage, HTTPS, and access controls. No system is perfectly secure. If you believe your account has been compromised, contact us immediately at privacy@nonprofitirp.com.
Section 10 — Children.
Service not directed at children under 13. We do not knowingly collect data from minors.
Section 11 — Changes to This Policy.
We will post revised policies at irpforge.com/privacy with an updated effective date. Material changes will be communicated by email or prominent notice before taking effect.
Section 12 — Contact.
Email: privacy@nonprofitirp.com — Web: irpforge.com — We respond to all privacy requests within 30 days.