Privacy Policy

This policy explains how CauseStack (“CauseStack”, “we”, “us”) handles information collected through this website and in providing the CauseStack platform to the organizations that use it.

CauseStack runs inside each customer’s own Salesforce org. The nonprofit that uses CauseStack decides what information it collects about its donors, volunteers, and other contacts, and how it uses that information. If you gave your information to a nonprofit that uses CauseStack, that nonprofit’s privacy policy applies, and you should contact it directly about your information.

• Forms you submit.If you apply to become a founding partner, the form opens on our Salesforce site and the answers you enter are stored in our Salesforce org.
• Emails you send us.If you write to us, we receive your email address and whatever you include in the message.
• Cookies.The site runs on Salesforce Experience Cloud, which sets the cookies it needs to deliver pages and keep the site secure. We do not add analytics, advertising, or tracking cookies or pixels.
• The live demo.The demo page shows a read-only CauseStack workspace filled with sample data.

We use the information you send us to reply to you, to review founding partner applications, and to talk with you about CauseStack. We do not sell personal information, and we do not share it with advertisers.

CauseStack installs into your Salesforce org, and the records you manage with it stay in that org under the access controls you already use. We do not copy your records into our own systems.

A few features connect to outside services to do their job. Those services receive only what the feature needs, and each one is listed under Service providers below. We see information from your org only when you send it to us, for example when you submit a support request from Alfred, which attaches your two most recent Alfred logs.

Donations and other payments taken through CauseStack forms are processed by Stripe. Card details are entered into Stripe’s secure fields and go directly to Stripe; your Salesforce org receives a reference to the payment, not the full card number. Payments run on the nonprofit’s own Stripe account, either with its own keys or through Stripe Connect, and Stripe’s privacy policy applies to the payment details it processes.

Alfred is an optional paid add-on. When someone in your org uses it, CauseStack builds the request inside your org and sends it straight to the AI provider your org is set up with (Anthropic, OpenAI, or Google Gemini). The request can include your question, your org’s structure, and the record data the task needs, which can include personal details such as names or email addresses. An admin can hide objects from Alfred.

Every Alfred request is logged in your own org. CauseStack does not train a model on your data. If your org uses its own provider key, your agreement with that provider governs how it handles requests; if it uses our key, our agreement with the provider applies. The AI, Data & Security page (/security) covers this in more detail.

We use these services to run the website and the platform. Each one receives only the information needed for its part of the work.

• Salesforce.Hosts this website, our forms, and the CauseStack platform inside each customer’s org. Email that CauseStack sends is delivered through Salesforce.
• Stripe.Processes card payments taken through CauseStack forms.
• Supabase.Handles sign-in for CauseStack portals: email addresses, passwords, sign-in links, invitations, and password resets.
• Anthropic, OpenAI, and Google Gemini.Answer Alfred requests, depending on which provider an org uses.
• Google reCAPTCHA.Helps keep spam off CauseStack forms.
• Fly.io.Hosts the service that generates PDF documents, which receives the content of the document being generated.

We keep information you send us for as long as we need it to respond to you and to manage our relationship with you. You can ask us to delete it at any time. Data in a customer’s Salesforce org is kept and deleted by that customer.

You can ask us what information we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@causestack.org. If your information is held by a nonprofit that uses CauseStack, contact that nonprofit, since it controls that data.

CauseStack works inside Salesforce’s security model: access comes from the permission sets your admins assign, and your records stay in your org. The AI, Data & Security page (/security) describes how we test and review our code.

This website is meant for organizations and the people who work with them. It is not directed at children, and we do not knowingly collect information from children through it.

We will update this page when our practices change and revise the date at the top. If a change is significant, we will tell customers directly.