Privacy Policy | Nonprofit Strategic Planner

Effective Date: July 14, 2026

Summary: We collect only what we need to provide the Nonprofit Strategic Planner, we never sell your data, and we give you control over your information. This section is a plain-language overview; the full policy follows.

1. Who We Are

The Nonprofit Strategic Planner (the "Service"), located at www.nonprofitstrategicplanner.com, is operated by Human Works Group Inc ("Company," "we," "us," or "our"). For the purposes of the EU General Data Protection Regulation (GDPR) and UK data protection law, Human Works Group Inc is the data controller for personal data processed through the Service. You can reach us any time at hello@nonprofitstrategicplanner.com.

2. Information We Collect

We collect the following categories of information:

Account information you provide when you sign up or request access: your name, work email address, job title, organization, mailing address, and phone number.
Plan content you enter into the Service, such as your organization's strategic planning responses, mission and vision statements, and related notes.
Payment information when you purchase a paid plan. Payments are processed by Stripe; we do not store your full card number. We receive limited transaction details (such as amount, plan, and status) from Stripe.
Access requests submitted by organizations whose email domain is not yet approved, including the name, email, organization, and reason you provide.
Technical and usage data automatically collected when you use the Service, such as your IP address, browser type, device information, and pages or features accessed, used to operate and secure the Service.

3. How We Use Your Information

To provide, maintain, and improve the Service and your strategic plan.
To create and administer your account and authenticate your sign-in (via secure, passwordless email links).
To process payments and provide the plan or advisory services you purchase.
To review and respond to access requests and support inquiries.
To communicate with you about your account, transactions, and important Service updates.
To protect the security and integrity of the Service and to comply with legal obligations.

4. Legal Bases for Processing (EU/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

Performance of a contract — to deliver the Service you sign up for and provide the plans you purchase.
Legitimate interests — to operate, secure, and improve the Service, provided these interests are not overridden by your rights.
Consent — where we ask for it, such as certain optional communications. You may withdraw consent at any time.
Legal obligation — to comply with applicable laws, tax, and accounting requirements.

5. How We Share Information

We do not sell your personal information. We share it only as needed to run the Service, with:

Service providers that operate the Service on our behalf, including our hosting and database provider (Supabase), our web hosting provider (Vercel), our payment processor (Stripe), and our email delivery provider. These providers process data under contract and only for the purposes we specify.
Legal and safety recipients, where required by law, regulation, legal process, or to protect the rights, property, or safety of our users, the public, or us.
Business transfers, if we are involved in a merger, acquisition, or sale of assets, in which case we will notify you of any change in how your data is handled.

6. International Data Transfers

We are based in the United States, and our service providers may process and store your information in the United States and other countries. These countries may have data protection laws that differ from those in your jurisdiction. Where we transfer personal data of EEA or UK users internationally, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK addendum), to protect your information.

7. Data Retention

We keep your personal data for as long as your account is active and as needed to provide the Service. We retain certain information after account closure where necessary to comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymize it. You may request deletion of your account and associated data as described below.

8. Your Rights

EEA and UK users. Under the GDPR and UK data protection law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability. You may also lodge a complaint with your local supervisory authority.

California users. Under the California Consumer Privacy Act (CCPA/CPRA), you have the right to know what personal information we collect and how we use it, to request deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under California law. We will not discriminate against you for exercising your rights.

Everyone. Regardless of where you live, you may request access to or deletion of your information. To exercise any of these rights, contact us at hello@nonprofitstrategicplanner.com. We will respond within the timeframe required by applicable law and may need to verify your identity before acting on your request.

9. Cookies and Tracking

The Service uses only the cookies and local storage necessary to operate, such as keeping you signed in and remembering your session and preferences. We do not use third-party advertising cookies. Your browser settings can be used to block or delete cookies, though doing so may affect how the Service works.

10. Data Security

We take reasonable technical and organizational measures to protect your information. All data is transmitted over encrypted connections (HTTPS/TLS), access to your plan data is restricted to your account through database row-level security, and access to systems is limited to authorized personnel. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Children's Privacy

The Service is intended for use by organizations and adult professionals. It is not directed to children, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact

Questions or requests regarding this Privacy Policy or your personal data should be directed to:

Human Works Group Inc
Nonprofit Strategic Planner
hello@nonprofitstrategicplanner.com