Hibox for Nonprofits Privacy Policy

1.Introduction

This policy explains what information Hibox for Nonprofits ("Hibox," "we," "us") collects, how we use it, and the choices you have. It applies to our website at hibox.co and to the Hibox software and services.

We handle information in two different roles:

• For our own business. We decide how to use information about website visitors, people who contact us, and the people who manage Hibox accounts for their organizations.
• For our customers. Nonprofit organizations ("Customers") use Hibox to store information about their staff, volunteers, participants, families, and donors. We process that information only on behalf of the Customer and under their direction. The section on Customer Data below explains this in more detail.

By using our website or services, you agree to this policy. It works together with our Terms of Service and Acceptable Use Policy.

2.Information We Collect

Information you give us

• Contact and demo requests. Your name, email address, phone number, organization name, and anything else you include when you fill out a form or contact us.
• Account information. Names, email addresses, phone numbers, job titles, and login details for the people who use Hibox.
• Billing information. Billing contact details and payment information for your subscription. Card details are handled by our payment processor, and we do not store full card numbers.
• Support requests. Information you share when you ask for help.

Customer Data

This is the information Customers and their Users enter into Hibox, or that people give to a Customer through Hibox. Depending on the features used, it may include:

• Participants and families: names, birth dates, contact details, enrollment, attendance, program records, and payment history
• Sensitive program information the Customer chooses to collect, such as household income, demographics, allergies, medications, and custody or pickup details
• Staff (Staff Central): employee profiles, HR records, pay and leave information, time tracking, clock in and out records, shift schedules, and background screening results
• Volunteers: profiles, schedules, and background screening results
• Donors and gifts: contact details, giving history, and payment records
• Grants: applications, budgets, and reports
• Messages and files: emails, text messages, staff chat messages, and shared files
• Training records: course progress, completions, and certificates
• People outside the organization: names and contact details of people who book meetings or sign up for events and webinars through a Customer's scheduling pages

Information collected automatically

When you visit our website or use Hibox, we collect basic technical information such as your IP address, browser type, device type, pages viewed, and the dates and times of your visits. We use this to keep the service secure and working well.

3.How We Use Information

We use the information we collect to:

• Provide, run, and maintain Hibox
• Set up and manage accounts
• Process payments and send billing notices
• Respond to questions and provide support
• Send service updates, security alerts, and other messages about your account
• Send news and marketing about Hibox, if you have not opted out
• Keep Hibox secure and prevent fraud and misuse
• Understand how Hibox is used so we can fix problems and improve it
• Follow the law and enforce our terms

We use Customer Data only to provide Hibox to that Customer, to support them, and to keep the service secure. We never use Customer Data to market to participants, families, or donors.

4.Customer Data and Our Role

This means:

• The Customer is responsible for giving any notices and getting any consent the law requires before collecting information about participants, families, staff, volunteers, or donors.
• The Customer is responsible for setting User roles and permissions so that only the right people can see sensitive information.
• If you are a participant, parent, guardian, staff member, volunteer, or donor of an organization that uses Hibox, please contact that organization with questions about your information or to ask for access, correction, or deletion. If we receive a request directly, we will send it to the organization.

The privacy practices of each Customer are governed by that organization's own privacy policy, not this one.

A Data Processing Agreement that describes how we handle Customer Data is available to Customers on request.

5.How Information Moves Within Hibox

Hibox modules share some information so organizations do not have to enter it twice. The Customer controls who can see it.

• Fundraising. When a Customer uses Hibox Fundraising, people already in its records, such as families, volunteers, and past participants, can appear as contacts in its fundraising tools. Each Customer decides whether to use program contacts for fundraising. Field level permissions let the Customer keep program details, such as attendance or sensitive program information, hidden from fundraising staff.
• Payments. Program fees and donations are recorded in both Program Management and Fundraising when a Customer uses both, so the Customer has a complete financial picture.
• Staff chat and files. Messages and files shared in staff chat are Customer Data. The Customer's administrators may be able to see them.
• Training records. Course progress and certificates can be seen by the Customer's administrators and managers who have permission to view them.

6.Special Types of Records

Some records are covered by extra laws. The Customer is responsible for following these laws and for limiting access to these records in Hibox.

• School records (FERPA). If a Customer stores student records it receives from a school, such as grades, school attendance, or test scores, the Customer must follow the Family Educational Rights and Privacy Act (FERPA) and its data sharing agreement with the school. Hibox handles these records only as the Customer's service provider.
• Health records (HIPAA). Hibox is not designed to store records covered by the Health Insurance Portability and Accountability Act (HIPAA) and should not be used as a medical record system. Basic health details needed for program safety, such as allergies and medications, may be stored.
• Survivor and substance use records. Domestic violence programs covered by the Violence Against Women Act (VAWA) and substance use programs covered by 42 CFR Part 2 have strict limits on sharing client information. These organizations must follow those rules and should limit who can see these records.

7.Public Forms and Pages

Customers can use Hibox to publish registration forms, donation pages, event signups, and booking pages. Information entered on these pages goes to the Customer that published them and becomes Customer Data. The Customer's own privacy notice applies to how that organization uses it.

8.Children's Information

Many of our Customers serve children, so Customer Data often includes information about children. We take special care with this information.

• We collect and use children's information only on behalf of the Customer that entered it, and only to provide Hibox to that Customer.
• Our website is not directed to children, and we do not knowingly collect personal information directly from children under 13 for our own purposes.
• When a Customer lets children use Hibox directly, the Customer is responsible for getting parent or guardian consent as required by the Children's Online Privacy Protection Act (COPPA) and other laws.
• We never use children's information for advertising or marketing, and we never sell it.

If you believe a child has given us personal information without proper consent, contact us at support@hibox.co and we will work with the Customer to address it.

9.How We Share Information

We share information only in these situations:

• Service providers. We use trusted companies to help run Hibox, such as cloud hosting, email and text message delivery, payment processing, background screening, and customer support tools. They may use the information only to provide services to us and must protect it.
• At the Customer's direction. When a Customer uses Hibox to send messages, run background checks, accept donations, or connect other apps, we share information as needed to complete those actions.
• Legal reasons. We may share information when required by law, court order, or legal process, or when needed to protect the safety, rights, or property of any person, including children.
• Business changes. If Hibox is involved in a merger, sale, or similar event, information may be transferred as part of that deal. This policy will continue to protect it.

Payments and text messages

• Stripe. Online payments for program fees and donations are processed by Stripe. Stripe receives the payer's name, payment details, and payment amount. Stripe's own privacy policy also applies to these payments. We do not store full card numbers.
• Twilio. Text messages are delivered by Twilio. Phone numbers and message content pass through Twilio and mobile carriers so messages can be delivered. Message history stays in Hibox as Customer Data.

Sharing the Customer controls

• Payroll exports. Staff Central creates payroll export files. The Customer chooses which payroll company receives them.
• Funder reports. Hibox helps Customers prepare reports for funders such as CSBG, 21st CCLC, and United Way. Some reports may include sensitive program information the funder requires. Reports go to a funder only when the Customer sends or approves them.
• Training partners. Some training may be offered with partners, such as state afterschool networks. A partner can see course completion and certificate records for a Customer's staff only when the Customer agrees.

A current list of our service providers, including our hosting, background screening, and AI providers, is available at [LINK TO SERVICE PROVIDER PAGE].

10.Cookies and Tracking

Cookies are small files stored in your browser. We use them to keep you logged in, remember your settings, keep Hibox secure, and understand how people use our website.

On our public website, we may use analytics tools to see which pages are visited and how people find us. Inside the Hibox software, we use only the cookies needed to run and secure the service, and we do not use advertising cookies.

Emails sent through Hibox do not include tracking. We do not track whether a message was opened or whether a link was clicked.

You can block or delete cookies in your browser settings. If you block them, some parts of Hibox may not work.

Our website honors Global Privacy Control, a browser setting that tells websites not to sell or share your personal information. Since we do not sell or share personal information for advertising, this setting does not change how Hibox works for you.

11.AI Features

Some Hibox features may use artificial intelligence (AI) to draft content, summarize information, or suggest actions. When you use these features, the information needed for that task is sent to our AI service provider to produce a result.

• We use AI providers that are not allowed to use Customer Data to train their models.
• We do not use Customer Data to train AI models.
• AI results are shown to your Users to review. They are not used to make automatic decisions about people.

12.Data Security

We use reasonable technical and organizational safeguards to protect information. These include encryption of data in transit and at rest, access controls, and limiting employee access to people who need it to support the service.

No system is perfectly secure. If we learn of a security incident that affects Customer Data, we will notify the affected Customers without unreasonable delay and as required by law.

13.Data Retention

We keep account and business information for as long as your account is active and as needed to meet legal, tax, and accounting requirements.

We keep Customer Data for as long as the Customer uses Hibox. Customers can delete records or export their data at any time. When a Customer closes its account, we delete or deidentify its Customer Data within [NUMBER] days, unless the law requires us to keep it longer. Backup copies are removed on our normal backup schedule.

14.Where Data Is Stored

Hibox is based in the United States, and information is stored and processed in the United States.

Hibox is intended for organizations in the United States. If you visit our website or use Hibox from outside the United States, your information will be transferred to and processed in the United States.

15.Your Choices and Rights

• Marketing emails. You can stop receiving marketing emails at any time by clicking "unsubscribe" in any email. We will still send messages about your account and the service.
• Text messages. Reply STOP to any text message sent through Hibox to stop receiving them.
• Account information. Account administrators can update most account information inside Hibox. You can also contact us to update or delete it.
• Access, correction, and deletion. Depending on where you live, you may have the right to ask for a copy of your personal information, to correct it, or to delete it. To make a request, email support@hibox.co. We will verify your identity before responding. We will not treat you differently for making a request.

If your information was entered into Hibox by an organization you work with or receive services from, please send your request to that organization. We will help them respond.

16.State Privacy Rights

Some states, including California, give residents extra rights over their personal information. If these laws apply to you, you may have the right to:

• Know what personal information we collect, use, and share
• Get a copy of your personal information
• Correct information that is wrong
• Delete your personal information, with some exceptions
• Opt out of the sale of personal information or its use for targeted advertising (we do not sell personal information or use it for targeted advertising)
• Appeal if we deny your request

To use these rights, email support@hibox.co. You may also have someone you authorize make a request for you. We will verify your identity and respond within the time the law requires.

These rights apply to information we control for our own business. For Customer Data, we will help the Customer respond to your request.

17.Changes to This Policy

We may update this policy from time to time. We will post the new version on this page and change the date at the top. For major changes, we will notify account administrators by email before the changes take effect.

18.Contact Us

Questions about this policy or your information can be sent to: