Privacy Policy

How Bless handles personal information, both for the organizations that use it and for its own accounts, site and analytics.

This Privacy Policy explains how company legal name ("Bless", "we") handles personal information through the Bless Events software, the pages organizations run on it, and our own website (together, the "Service").

Bless is software that nonprofits and other organizations use to run events, sell tickets, take donations and recurring gifts, and hold auctions. Most of the personal information in the Service belongs to those organizations, not to us. That shapes everything below, so we explain it first.

Two roles, in plain terms

1. When you deal with an organization, the organization decides. When you register for an event, buy a ticket, bid in an auction or give a donation on an organization's page, the organization decides what information to collect from you and what to do with it. Bless stores and processes that information on the organization's behalf, as its service provider. We do not sell it, and we do not use it to market our own products to you.

If you have a question or request about information you gave to an organization (for example, to see, correct or delete it, or to stop hearing from the organization), please contact that organization directly. Its own privacy policy governs how it uses your information. If you write to us instead, we will tell you which organization holds your information, pass your request on to it, and help it respond.

2. Some information is ours. Bless decides what to do with a smaller set of information, and this policy is the main notice for it:

Login accounts. A Bless login can be used across more than one organization, so we manage the account itself (your name, email and password).
Organization billing contacts. The people who sign an organization up for Bless and manage its subscription.
Our marketing website and messages you send us.
Support conversations.
Product analytics and error monitoring, which we use to keep the Service working and to improve it.

Information we handle

Information collected for organizations

Depending on what an organization asks for, the Service may hold:

Contact details: names, email addresses, phone numbers and home addresses.
Personal details: dates of birth, gender and marital status.
Household information: who belongs to a household and how they are related, including spouses, children and grandchildren.
Event details: registrations, tickets, seating, answers to an organization's custom questions, and dietary and accessibility notes for seated guests.
Giving and purchase history: donations, recurring gifts, orders, receipts and auction activity, including bidder paddle numbers, bids and items won.
Payment references: Stripe customer and payment-method references, plus the card brand and last four digits. Card numbers are entered into and held by Stripe, our payment processor. Bless never sees or stores full card numbers.
Auction card consent: when you enroll to bid, the time you agreed to let the organization save your card and charge it if you win.
Volunteer details: names and email addresses of people an organization invites to help run an event.

Phone numbers are stored for the organization's use. The Service does not send text messages or place calls.

Information we handle for ourselves

Account information: your name, email address and password for a Bless login. Passwords are stored in hashed form, not as readable text.
Organization and billing information: the organization's name and details, the billing contact's name and email, and subscription records. Subscription payments are processed by Stripe.
Communications: what you send us when you contact us or ask for support.
Usage and device information: pages viewed, actions taken, browser and device type, approximate location derived from IP address, and errors the Service runs into. See "Analytics and error monitoring" below.
Audit records: when a Bless staff member acts on an organization's account (for example, to give support), or when certain money actions take place, we keep a record of who did what and when. For Bless staff actions, that record includes the IP address and browser details.

Sources

We get this information:

From you, when you fill in a form, create a login, register, buy, bid, give or contact us.
From the organization, when it adds or imports contacts, households or volunteers, or when someone in your household registers you.
From Stripe, which tells us whether a payment succeeded and gives us the card brand and last four digits.
Automatically, from your browser, through cookies and similar tools (see our Cookie Notice).

How we use information

For organizations, we use their information to run the Service for them: to process registrations, tickets, donations, recurring gifts and auctions; to send the receipts, confirmations and messages the organization asks us to send; to show the organization its own records and reports; and to provide support.

For our own purposes, we use information to:

create and secure logins, and let you sign in;
bill organizations for their subscription;
answer questions and give support;
send notices about the Service, such as changes to our terms or security notices;
understand how the Service is used, find and fix errors, and improve it;
detect and prevent fraud, abuse and security problems, including by limiting repeated requests;
comply with law and enforce our terms.

We may also create information that is aggregated or de-identified so it no longer identifies anyone, and use it to understand and improve the Service. We do not try to re-identify it.

We do not use personal information to train artificial intelligence models.

How we share information

With the organization. Information you give on an organization's page is available to that organization. If you are part of a household, the organization sees your household's records together.

With service providers (subprocessors). We use a small number of companies to run the Service, such as Stripe for payments, Resend for email, PostHog for analytics and error monitoring, and Hetzner for hosting in the United States. They may use the information only to provide their services to us. The current list, and what each receives, is at /legal/subprocessors. Fonts and one code library load from outside providers (rsms.me and jsDelivr), which see your IP address when your browser fetches them.

With Salesforce, only when an organization connects it. If an organization connects its own Salesforce account, the Service sends that organization's contact records to it, including names, email addresses, phone numbers, dates of birth and gender. Salesforce then holds that data for the organization under the organization's agreement with Salesforce.

For legal reasons. We may disclose information to law enforcement, regulators or others when we believe in good faith that the law requires it, or to protect the rights, property or safety of Bless, our customers, you or others.

With professional advisors, such as lawyers, accountants and insurers, who need it to advise us.

In a business transfer. If Bless is involved in a merger, acquisition, financing, sale of assets, bankruptcy or similar event, information may be transferred as part of that transaction. Any buyer would be bound by commitments at least as protective as this policy for the information it receives.

We do not sell personal information or share it for cross-context behavioral advertising. The Service carries no advertising pixels, and we do not let advertisers collect information on it.

Children

Bless is not directed at children, and children do not create Bless logins.

Children's information enters the Service when a parent or guardian, or an organization, adds a child to a household or registers a child for an event. That information can include the child's name and, if provided, date of birth, along with any answers to the organization's questions and any dietary or accessibility notes. The Service treats anyone under 18 as a minor. We use a child's information only to provide the Service to the organization that holds it.

If you are a parent or guardian and want to review, correct or delete your child's information, contact the organization that registered your child. You can also write to us at privacy email, and we will work with the organization to answer your request.

Analytics and error monitoring

We use PostHog, hosted in the United States, to understand how the Service is used and to catch errors. PostHog runs on every page of the Service, including organizations' public pages, and it collects:

the pages you view and how you move between them, the page you came from, and your browser, device and approximate location (derived from your IP address);
which organization's pages you are on;
details of errors the Service runs into, including the page address.

When you are signed in, we identify you to PostHog by your email address, and send your name, organization, role and account creation date with it.

When you complete a registration or a payment, the Service may also record that event in PostHog under your email address (or your signed-in account), with details such as the event, the number of tickets, the amount and the order number. This applies even if you are not signed in.

Before data is sent, we remove the secret parts of certain links (such as sign-in, invitation, donor-management and unsubscribe links) from the page addresses PostHog receives. Personal fields are also filtered out of our own server logs.

Your choices. You can block PostHog by blocking cookies and local storage for our sites, or by using a browser or extension that blocks analytics scripts. The Service works without PostHog. See our Cookie Notice.

Global Privacy Control and Do Not Track. Today the Service does not change what it collects when your browser sends a Global Privacy Control (GPC) or Do Not Track signal. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or sharing for those signals to stop.

How long we keep information

We keep information for as long as we need it to provide the Service and for the purposes in this policy, including legal, tax, accounting and dispute needs.

Organization data is kept while the organization uses Bless. When an organization's account ends, we delete its data within deletion days days, except where the law requires us to keep records longer.
Login accounts are kept until the account is closed.
Registration carts (what you put in your basket before you check out) are deleted once your order is placed or after the cart expires.
Analytics data is kept by PostHog under the retention settings of our PostHog account.

Security

We take reasonable steps to protect personal information. Today these include:

encrypted connections (HTTPS) for all traffic;
a content security policy that limits what code can run on our pages;
limits on repeated requests to slow down password guessing and abuse;
encryption of donor fields on donations and of Salesforce access credentials in our database;
filtering personal fields out of application logs;
audit records of money actions and of Bless staff acting on an organization's account.

No system is perfectly secure, and we cannot promise that information will never be accessed, lost or changed without permission. If we learn of a breach that affects your information, we will notify the organization and, where the law requires, you.

To report a security problem, write to security email.

Your choices

Your login. You can view and update your name and email by signing in.
Emails from organizations. Announcement emails sent through the Service include an unsubscribe link, and unsubscribing stops that organization's announcements. You will still receive receipts and other messages about your own registrations, orders and gifts.
Recurring gifts. You can update your card or cancel a recurring gift from the link in your receipt email.
Cookies and analytics. See our Cookie Notice.
Declining to give information. If you do not provide information an organization marks as required, you may not be able to register, buy, bid or give.

Your privacy rights

Depending on where you live, state privacy laws may give you the right to:

Know and access: ask what personal information we hold about you, where it came from, why we use it and whom we disclose it to, and get a copy.
Correct: ask us to correct inaccurate information.
Delete: ask us to delete information we hold about you.
Opt out: of the sale of your personal information, of its use for targeted advertising, and of certain profiling. We do not sell personal information, do not use it for targeted advertising, and do not use it for profiling that produces legal or similarly significant effects.
Appeal: ask us to reconsider if we decline your request.
Not be discriminated against for using these rights.

These rights are not absolute, and the law allows us to decline some requests. For information we hold for an organization, the organization decides how to respond, and we will send your request to it.

Sensitive information. Some information an organization collects, such as information about children or dietary and accessibility notes, may count as sensitive under some state laws. We use it only to provide the Service. We do not use it to infer characteristics about you.

How to make a request

Email privacy email or call privacy phone. Tell us your name, the email address you used, and, if you know it, which organization's page you used.

Verifying your identity

To protect you, we confirm a request comes from you before acting on it. Usually we do this by asking you to confirm from the email address we have on file. For requests about sensitive information, or if we cannot match you that way, we may ask for more information. We use what you give us for verification only to verify you.

Authorized agents

You can ask someone to make a request for you. We may ask the agent for proof that you authorized them, such as signed permission or a power of attorney, and we may ask you to confirm your identity with us directly.

Appeals

If we decline your request, we will explain why. You can appeal by replying to our answer or writing to privacy email with "Appeal" in the subject. We will respond within the time the law allows. If you are not satisfied with our answer to your appeal, you may contact your state attorney general.

California residents

If the California Consumer Privacy Act applies to us, this section is our notice at collection for California residents. In the past 12 months:

Category (CCPA)	Examples	Why we use it	Disclosed for a business purpose to	Sold or shared
Identifiers	Name, email, phone, address, account login, IP address	Providing the Service, security, support, billing, analytics	The organization, service providers, Salesforce if the organization connects it	No
Customer records (Cal. Civ. Code 1798.80)	Address, phone, card brand and last four digits	Providing the Service, payments	The organization, Stripe, service providers	No
Protected characteristics	Date of birth (age), gender, marital status	Providing the Service for the organization	The organization, Salesforce if connected (birth date and gender)	No
Commercial information	Tickets, orders, donations, recurring gifts, bids	Providing the Service, receipts, analytics	The organization, Stripe, service providers	No
Internet or network activity	Pages viewed, actions, errors	Analytics, error monitoring, security	PostHog	No
Geolocation (approximate)	City or region from IP address	Analytics	PostHog	No
Sensitive personal information	Information about children; dietary and accessibility notes; account login credentials	Providing the Service and signing in	The organization, service providers	No

We do not sell or share personal information, including that of consumers under 16. We collect this information from the sources and use it for the purposes described above, and we keep it for the periods in "How long we keep information".

Shine the Light. We do not disclose personal information to third parties for their own direct marketing.

Nevada residents

We do not sell covered information as Nevada law defines it. You may still send an opt-out request to privacy email, and we will record it.

Other websites

Organizations' pages may link to their own websites and to other services. We do not control those sites, and this policy does not cover them.

Where information is stored

Bless is based in the United States. We host the Service in the United States, and our service providers process information in the United States.

Changes to this policy

We may update this policy. When we do, we will change the effective date at the top. If a change is material, we will also tell organizations and account holders by email or through the Service before it takes effect.

Contact us

company legal name company address Email: privacy email Phone: privacy phone

Portions adapted from templates published by General Legal, PC under CC0. General Legal has not reviewed this document.