1. About This Policy
Givalgo, Inc. ("Givalgo," "we," "our," or "us") is committed to protecting the privacy and security of the information entrusted to us. This Privacy Policy describes how we collect, use, process, disclose, and protect your personal information when you:
- Visit our website at givalgo.ai and related subdomains
- Access or use our API services at api.givalgo.ai
- Review our developer documentation at docs.givalgo.ai
- Communicate with us via email, forms, or other channels
- Book a demo or attend a product presentation
Important note about our data: Givalgo's core database is built entirely from publicly available U.S. government sources -IRS nonprofit filings, IRS sanctions data, and OFAC sanctions lists. We do not collect, store, or sell personal data about individual donors, nonprofit beneficiaries, or third-party individuals. All nonprofit and organizational data in our platform is sourced from public government records and processed in accordance with applicable law.
This policy applies to all users globally. Where we reference specific legal frameworks (such as GDPR or CCPA), those sections apply only to users in the relevant jurisdiction.
2. Information We Collect
2.1 Information You Provide Directly
When you create an account, subscribe to a plan, or contact us, we collect:
- Account Information: Full name, work email address, company name, job title, and password (stored as a salted hash -never in plain text)
- Billing Information: Payment card details and billing address, processed and stored by our payment processor (Stripe). We do not store full card numbers on our systems.
- Communication Data: Any messages, inquiries, or feedback you submit via email, contact forms, or demo requests
- Demo Booking Data: Name, email, company, and any notes provided when booking a product demonstration via our scheduling system (Calendly)
- Survey and Feedback Data: Responses to optional user research surveys or NPS feedback requests
2.2 Information Collected Automatically
When you interact with our website or API, we automatically collect certain technical data:
| Data Type | Examples | Purpose |
|---|
| Log Data | IP address, browser type, OS, referrer URL, pages visited, timestamps | Security monitoring, debugging, analytics |
| API Usage Data | API key ID, endpoint called, EINs queried, response codes, latency, request volume | Billing, rate limiting, usage dashboards, audit logs |
| Device Information | Screen resolution, device type, browser version | Product improvement, compatibility |
| Session Data | Login timestamps, session duration, feature interactions | Security, product analytics |
API usage logs are stored in our api_usage_log table in our PostgreSQL database, associated with your API key ID (not your personal email) to provide usage dashboards and enforce plan limits.
2.3 Information from Third Parties
We may receive limited information about you from:
- Payment Processors (Stripe): Confirmation of payment success/failure and subscription status
- Authentication Providers: If you sign in via SSO or OAuth, we receive your name and email from that provider
- Referral Partners: If you were referred to us, we may receive your organization name and contact details from a mutual partner
3. How We Use Your Information
We use the information we collect for the following purposes:
3.1 Providing and Operating Our Services
- Creating and managing your account and API credentials
- Processing payments and managing subscription plans
- Delivering API responses and maintaining service uptime
- Providing usage dashboards, rate limit enforcement, and billing summaries
- Responding to support requests and technical inquiries
3.2 Security and Compliance
- Detecting, preventing, and investigating fraudulent or unauthorized use of our API
- Maintaining audit logs for compliance with financial regulations and AML/KYC obligations applicable to our enterprise customers
- Protecting the integrity of our infrastructure and preventing abuse
- Complying with applicable laws, including OFAC, AML, and IRS regulations
3.3 Product Improvement and Analytics
- Analyzing aggregated, anonymized usage patterns to improve API performance and coverage
- Conducting internal research on which features are most valuable to our users
- Identifying and fixing bugs, performance bottlenecks, and data quality issues
3.4 Communication
- Sending transactional emails: account confirmations, password resets, billing receipts, API key notifications
- Sending product update communications and release notes (you may opt out at any time)
- Scheduling and conducting product demonstrations
4. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:
| Processing Activity | Legal Basis |
|---|
| Providing API services and fulfilling your subscription | Performance of a contract (Art. 6(1)(b) GDPR) |
| Processing payments | Performance of a contract |
| Sending transactional emails | Performance of a contract / Legitimate interests |
| Security monitoring and fraud prevention | Legitimate interests (Art. 6(1)(f) GDPR) |
| Product analytics (aggregated) | Legitimate interests |
| Marketing communications | Consent (Art. 6(1)(a) GDPR) -you may withdraw at any time |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c) GDPR) |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms as a data subject.
5. Sharing and Disclosure
We do not sell, rent, or trade your personal information to third parties. We may share your information in the following limited circumstances:
5.1 Service Providers
We share data with carefully vetted service providers who process it on our behalf, subject to strict data processing agreements. Current providers include:
- Amazon Web Services (AWS): Cloud infrastructure, database hosting (RDS PostgreSQL), file storage (S3), serverless compute (Lambda), and API Gateway. Data is stored in
us-east-2 (Ohio, USA).
- Stripe: Payment processing and subscription management. Stripe is PCI-DSS Level 1 certified.
- Calendly: Demo scheduling. Your name and email are shared when booking a call.
- Google Analytics: Aggregate visitor measurement on this marketing website only — not in the Discover application and not in our APIs. Configured with advertising features, ad personalisation and ad-user-data permanently disabled, so your data is never used for advertising or remarketing.
5.2 Legal and Regulatory Disclosures
We may disclose your information if required to do so by law or in good-faith belief that such action is necessary to: (i) comply with a legal obligation, subpoena, or court order; (ii) protect and defend the rights or property of Givalgo; (iii) prevent or investigate possible wrongdoing in connection with our services; or (iv) protect the personal safety of users or the public.
5.3 Business Transfers
In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred to the acquiring entity. We will notify you via email or a prominent website notice before your personal information becomes subject to a different privacy policy.
5.4 With Your Consent
We may share your information for any other purpose with your explicit consent.
6. Cookies and Tracking Technologies
Our website uses a minimal set of cookies strictly necessary for operation:
| Cookie Type | Purpose | Duration |
|---|
| Session Cookie | Maintains your authenticated session on the docs and dashboard | Session (deleted on browser close) |
| CSRF Token | Protects against cross-site request forgery attacks | Session |
| Preference Cookie | Remembers your UI preferences (e.g., dark/light mode) | 1 year |
_ga / _ga_* | Google Analytics 4 — measures how visitors find and move around this marketing website. Set on this website only, never in the Discover application or the APIs. | 13 months |
We do not use third-party advertising cookies, behavioral tracking pixels, or cross-site tracking technologies, and we do not use Facebook Pixel or any similar advertising tracker anywhere.
On our platform — the Discover application and our APIs, where your account activity lives — analytics are entirely first-party: measured by us, stored in our own database, and never shared with an analytics vendor.
On this marketing website only, we use Google Analytics 4 to understand how visitors find us. It runs with advertising storage, ad personalisation and ad-user-data denied by default, so it is never used for advertising or remarketing, and Google Analytics 4 truncates IP addresses on collection.
7. Data Security
We take the security of your data seriously and implement multiple layers of protection:
- Encryption in Transit: All communications between your browser/application and our servers use TLS 1.3
- Encryption at Rest: Our RDS PostgreSQL database uses AES-256 encryption at rest via AWS
- Secrets Management: API keys, database credentials, and service tokens are stored in AWS Secrets Manager -never in source code or environment variables
- Network Isolation: Our database runs in a private VPC subnet with no direct internet access; only our Lambda functions (within the same VPC) can connect
- API Key Authentication: Every API request requires a valid API key passed via
x-api-key header; keys are hashed before storage
- Rate Limiting: Per-key rate limits are enforced at the API Gateway layer to prevent abuse
- Audit Logging: All API requests are logged with key ID, timestamp, endpoint, and response code for security monitoring
- SOC 2 Type II: We are currently working toward SOC 2 Type II certification
While we implement industry-standard safeguards, no security system is impenetrable. We cannot guarantee the absolute security of data transmitted over the internet. In the event of a data breach affecting your personal information, we will notify you in accordance with applicable law.
8. Data Retention
We retain different categories of data for different periods based on business and legal requirements:
| Data Category | Retention Period | Reason |
|---|
| Account information | Duration of subscription + 3 years after closure | Legal/tax obligations |
| Payment records | 7 years | Financial regulations |
| API usage logs | 90 days (rolling) | Billing, debugging, security |
| Support communications | 3 years | Service quality, dispute resolution |
| Audit logs (security) | 1 year | Security monitoring |
| Marketing consent records | Until withdrawal + 3 years | Legal compliance (GDPR) |
When your account is closed or data reaches its retention limit, we securely delete or anonymize it. You may request early deletion of your personal data (subject to legal retention obligations) by contacting privacy@givalgo.ai.
9. International Data Transfers
Givalgo is incorporated in the United States, and our infrastructure is hosted in the AWS us-east-2 (Ohio) region. If you are accessing our services from outside the United States, your information will be transferred to and processed in the United States.
For users in the European Economic Area (EEA) or United Kingdom, such transfers are made pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms. By using our services, you consent to these transfers where required.
10. Children's Privacy
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@givalgo.ai and we will promptly delete that information.
11. Your Privacy Rights
Depending on your location, you may have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@givalgo.ai:
Rights Available to All Users
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete personal data
- Deletion: Request deletion of your personal data (subject to legal retention requirements)
- Portability: Receive your personal data in a structured, machine-readable format
- Opt-Out of Marketing: Unsubscribe from marketing emails at any time by clicking the unsubscribe link or emailing us
Additional Rights for EEA / UK Users (GDPR)
- Restriction of Processing: Request that we restrict processing of your data in certain circumstances
- Object to Processing: Object to processing based on legitimate interests or for direct marketing
- Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing
- Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority (DPA)
We will respond to all verifiable requests within 30 days. In complex cases, we may extend this by an additional 60 days with notice. We will not discriminate against you for exercising your privacy rights.
12. California Privacy Rights (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights:
- Right to Know: Know what personal information we collect, use, disclose, and sell
- Right to Delete: Request deletion of your personal information (with certain exceptions)
- Right to Correct: Request correction of inaccurate personal information
- Right to Opt-Out of Sale: We do not sell personal information. There is nothing to opt out of.
- Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary to provide our services
- Non-Discrimination: We will not discriminate against you for exercising any of these rights
To submit a CCPA request, email privacy@givalgo.ai with "CCPA Request" in the subject line. We will verify your identity before processing the request.
13. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:
- Update the "Last updated" date at the top of this policy
- Send an email notification to registered users at least 14 days before the change takes effect
- Post a prominent notice on our website for 30 days following the change
Your continued use of our services after the effective date of any updated policy constitutes your acceptance of the revised terms. If you disagree with the changes, you may close your account and request deletion of your data.
We maintain an archive of previous versions of this Privacy Policy available upon request.