Privacy Policy

Who we are

Touch & Give is a system that nonprofits and their emissaries use to take donations in person. It includes the touchgive.charity website, a dashboard for nonprofits and an Android™ app. The app works as a donation kiosk on a tablet with a Stripe card reader, or on a phone with Stripe Tap to Pay.

Touch & Give is operated by Meheira Inc., a New York nonprofit corporation with 501(c)(3) tax-exempt status. Its details:

Meheira Inc., 1476 Union St, Brooklyn, NY 11213, USA

In this policy, "we," "us" and "Touch & Give" mean Meheira Inc. For any privacy question, you can reach us at:

office@touchgive.charity

Information we collect

What we collect depends on who you are: a nonprofit that uses the service, a donor, or a visitor to the website.

Nonprofits and their users

• Dashboard users: name and email. The password is stored encrypted by our sign-in provider.
• Nonprofit details: name, logo, colors, campaigns, a contact email and the ID of the nonprofit's Stripe account.
• City and coordinates, if the nonprofit sets a city. They are used to calculate Shabbat times.
• Devices: ID, nickname, app version, device type and card reader status.
• Donations: amount, currency, campaign, time, the device that took the donation, the Stripe payment ID and refunds.

Donors

When a donor gives on a nonprofit's device, the donation details listed above are saved. The donor's name and email are saved only if they asked for an email receipt.

For a monthly donation on a kiosk, we also keep the donor's name, email, monthly amount, day of the month and number of payments. The card itself is saved only at Stripe.

Website visitors

If you leave your details in the form on the website, we keep what you entered: name, phone with its country code, organization and message. We also keep the country of that code, the language of the page, and whether you asked for updates.

If you contact us on WhatsApp, the messages are handled by WhatsApp (Meta) under its own privacy policy.

Everyone who uses the service

We collect IP addresses to secure the service and to limit repeated requests.

What we don't collect

• Card numbers. Only Stripe receives card details. We don't see or store card numbers.
• Device location. During an in-person payment, Stripe collects the device's location to verify the payment and prevent fraud. That is why the app asks for location permission: the Stripe payment component inside the app requires it. Our server does not store device location.

How we use information, and on what basis

We use information only for the purposes below. Each purpose lists its legal basis.

• To provide the service to the nonprofit: the account, dashboard, devices and campaigns. Basis: contract, meaning the Terms of Use the nonprofit accepted.
• To process donations and send receipts. Basis: we process this information on behalf of the nonprofit and on its instructions.
• To secure the service, prevent misuse and limit repeated requests. Basis: our legitimate interest, and that of the nonprofits, in keeping the service safe.
• To get back to you after you contact us through the website. Basis: our legitimate interest in answering people who reach out.
• If you ticked "Send me updates", we send updates on WhatsApp to the number you gave. Each such message is marked as an advertisement, and you can unsubscribe at any time: reply "STOP" or write to us. Basis: consent, which you can withdraw at any time.
• To keep records the law requires, such as for tax purposes. Basis: legal obligation.

Who is responsible for the information

The nonprofit is responsible for its donor data. Touch & Give processes that data only on behalf of the nonprofit and on its instructions. The rules for this are in the Terms of Use, in the "Data processing terms" section.

Touch & Give is responsible for the data of the nonprofit's dashboard users and for inquiries sent through the website.

Donations to religious organizations

A donation to a religious organization may reveal the donor's beliefs. Under some privacy laws, such as in the European Union, this is especially sensitive information. We process it only on behalf of the nonprofit, and only for the donation and the receipt.

Service providers

We run the service with these providers:

• Stripe: payment processing, in the nonprofit's own Stripe account.
• Supabase: database and user sign-in.
• Vercel: hosting for the website and the server.
• Resend: sending emails, including receipts.
• Cloudflare Turnstile: bot protection on forms.
• Upstash: limiting repeated requests. It receives only IP addresses and internal device and nonprofit IDs.
• Expo: app updates.
• Open-Meteo: looking up the nonprofit's city. It receives only the city name.
• name.com and Google (Gmail): mail sent to our office address is forwarded through name.com to the team's Gmail inbox.

Stripe processes payment information under its own privacy policy:

https://stripe.com/privacy (opens in a new tab)

Any third party that receives information from us provides the same or equal protection for it as described in this policy.

If we add or replace a provider, we'll update this list and let the nonprofits know.

Transfers to the United States

Information is processed in the United States and in the countries where our providers operate. Our database is in Germany (EU) and our servers run in the US. Some providers and team members may access information from the countries where they work. If you are outside the United States, for example in the European Union or in Israel, your information is transferred to the United States. Privacy laws there may differ from those in your country. After the transfer, the information is still handled under this policy.

How long we keep information

• Website inquiries: up to 24 months from our last contact with you.
• Nonprofit and donation data: as long as the nonprofit uses the service. When the relationship ends, we delete the data or return it to the nonprofit, at its choice. Information the law requires us to keep for legal or tax purposes is kept for up to 7 years and then deleted.
• Backups: deleted within 90 days. Information we've deleted doesn't stay in backups longer than that.

Your rights

Depending on the law that applies to you, you have the right to:

• Access your information and get a copy of it.
• Correct information that is wrong.
• Ask us to delete your information.
• Object to processing based on legitimate interest.
• Receive your information in a format you can move to another service (portability).
• Withdraw your consent to updates at any time.

To use any of these rights, or to stop receiving updates, email us:

office@touchgive.charity

Donors can contact the nonprofit they gave to, since it is responsible for the donation data. You can also contact us, and we'll help the nonprofit handle the request.

Complaints to a regulator

If you think we haven't handled your information properly, please write to us first and we'll look into it. If you are in the European Union, you have the right to file a complaint with the data protection authority in your country. In Israel, you can file a complaint with the Privacy Protection Authority.

Security

• Communication with the website, the dashboard and the app is encrypted with HTTPS.
• Access to information is limited by permissions.
• Card details are processed by Stripe, which complies with the card industry security standard, PCI DSS.

No method protects information perfectly, so we can't promise absolute security.

Children

The service is not intended for children under 16. If a child under 16 left their details on the website, email us and we'll delete them.

Cookies

We don't use analytics, advertising or tracking tools. We use only what the site needs: sign-in cookies (Supabase) when you sign in to the dashboard, until you sign out; and a bot check (Cloudflare Turnstile) on the contact, sign-in and sign-up forms, which checks your browser and keeps one value in its own storage, with no cookies on our site. We don't track visitors across sites, so Do Not Track and Global Privacy Control signals change nothing.

Changes to this policy

When we update this policy, we'll change the date at the top of the page. If a change is material, we'll let the nonprofits that use the service know.