Privacy Policy

The Evolor platform is operated by Freedom Family Holdings LLC, d/b/a SmartOrg, a Missouri limited liability company. In this policy, “Evolor,” “SmartOrg,” “we,” “us,” and “our” refer to that entity, which is the party responsible for the personal information described here. You can reach us at any time at help@evolor.one.

This policy covers the Evolor marketing site, the Evolor web application, our APIs, embeddable widgets such as opt-in forms and impact tickers, and the integrations Evolor offers. It applies to three groups: nonprofit organizations that subscribe to Evolor (“Customers”), the staff and volunteers who use it (“Authorized Users”), and the donors and supporters whose records Customers maintain in it (“Supporters”).

Use of Evolor is also governed by our Terms and Conditions and, for Customers, our End User License Agreement.

The distinction matters, because it determines who you contact about your data.

• We are a processor for Supporter information. A Customer decides what donor and supporter data to collect and why. We process it on that Customer’s instructions, to provide the platform. If you are a Supporter and want your data accessed, corrected, or deleted, contact the organization you support. We will assist that organization in responding.
• We are a controller for our own business data: Customer account records, Authorized User profiles, billing information, support correspondence, product analytics, security logs, and marketing-site visitors.

Information Customers and Authorized Users give us

• Account and profile: name, work email, phone, role, organization name, time zone, and authentication data managed by our auth provider. We store a profile and role, never a raw password.
• Billing: plan, seats, Modules, subscription status, and a payment processor reference. We do not receive card numbers.
• Support and feedback: messages you send us and in-product feedback.

Customer Data placed in the platform

• Supporter records: name, email, phone, postal address, household or organization links, tags, and notes.
• Gift and financial records: amount, date, designation or fund, recurrence, processor fees, and receipt status.
• Communications and engagement: emails and text messages sent through the platform, replies, opens and clicks, opt-in and opt-out state and its timestamp, event registrations and attendance.
• Content and media: stories, images, documents, field reports, and audio a Customer uploads, including meeting recordings and voice memos submitted for transcription.
• Integration data: records exchanged with connected services, described in sections 5 and 6.

Information collected automatically

• Usage and device: pages and features used, IP address, browser and device type, referring page, and timestamps.
• Diagnostics: error reports and performance traces used to find and fix defects.
• Security: sign-in events, rate-limit and abuse signals, and bot detection results on public forms.

• Provide, operate, secure, and support the platform.
• Perform the functions a Customer asks for: sending email and SMS, issuing receipts, running events, syncing accounting records, generating dashboards and reports.
• Authenticate users, enforce seat and plan limits, and bill Customers.
• Detect, investigate, and prevent fraud, abuse, spam, and security incidents.
• Diagnose defects and improve reliability and usability, using aggregated and de-identified data wherever it is sufficient.
• Communicate with Customers about service notices, security, billing, and product changes. Marketing email to Customers is separate and can be declined at any time.
• Comply with law and enforce our agreements.

A Customer may connect Evolor to Intuit QuickBooks Online so that donations recorded in Evolor become accounting entries in their books. The connection is optional, is initiated by the Customer, and uses Intuit’s OAuth 2.0 authorization flow. We request a single scope, com.intuit.quickbooks.accounting. We do not request payroll, payments, or OpenID profile scopes.

What we read from QuickBooks

• The QuickBooks company identifier (realm ID) of the company being connected.
• Chart of accounts entries, service items, and classes, so the Customer can map gifts and processor fees to the correct income and expense accounts.
• Customer records, looked up by display name, so that an existing QuickBooks customer is reused instead of duplicated.
• Invoice records we previously created, to confirm sync status and avoid duplicates.

What we write to QuickBooks

• Customer records derived from a donor: display name, and where present given name and family name or company name, primary email address, and primary phone number.
• Service items mapped to the income account the Customer selects.
• Invoices representing gifts, including amount, date, designation, and a line recording the payment processor fee.

What we store on our side

• The OAuth access token, refresh token, realm ID, and their expiry timestamps. Intuit rotates the refresh token on every refresh and we persist the rotated value.
• The QuickBooks customer identifier cached on the matching donor record, and the QuickBooks invoice identifier on the matching gift record, so records are linked rather than duplicated.
• A sync log of actions taken (customer created, item created, invoice created, token refreshed, error), with the affected entity type and identifier, for troubleshooting and audit.

Disconnecting and deletion

• A Customer can disconnect QuickBooks at any time under Settings, then Integrations. Disconnecting revokes and removes the stored tokens and stops all further sync.
• On disconnection we delete the stored access and refresh tokens. Cached QuickBooks identifiers and sync logs are deleted on request, and otherwise on the schedule in section 14.
• Records already written into the Customer’s QuickBooks company remain there. They are the Customer’s books, and we cannot remove them once written. Deleting them is done in QuickBooks.
• To request deletion of QuickBooks-derived data held by us, email help@evolor.one. We respond within thirty (30) days.

Your use of QuickBooks Online is governed by your agreement with Intuit, including the Intuit Terms of Service and Intuit’s privacy statement. This policy covers only what Evolor does with the data.

Evolor offers two optional Google connections. Both are initiated by the Customer, authorized through Google’s OAuth 2.0 flow, and read-only. We request exactly two scopes and no others. We do not request permission to send, compose, modify, or delete anything in a Google account.

• gmail.readonly is connected per Authorized User, so a fundraiser can see their own donor correspondence on the donor record.
• drive.readonly is connected once per organization, for importing meeting recordings and staff-selected data files.

What we read from Gmail

• The email address of the connected mailbox, and a Gmail history identifier used to fetch only what changed since the last sync.
• Messages returned by a search we scope to the organization’s known donor addresses, bounded to roughly the last year. We do not scan the whole mailbox.
• For each such message, its Message-ID, subject, From, To, Cc, date, and plain-text body.

What we store from Gmail

• Only messages matched to a known donor. After fetching a message we check whether a participant other than the connected user is a donor in that organization’s records. If none is, the message is discarded immediately and never written to our database.
• For a matched message, we store an interaction record on that donor containing the subject, the plain-text body truncated to 20,000 characters, the direction (inbound or outbound), the From and To addresses, the Gmail message identifier, and the timestamp.
• Attachments are not downloaded or stored. We extract the text body only.
• The OAuth access token, refresh token, expiry, connected email address, sync position, and connection status, so syncing can resume without re-authorizing.

What we read from Google Drive

• The email address of the connected account, shown on the settings card so staff know which account is linked.
• A list of recent audio and video files, by name, type, size, and modified date, so staff can pick a meeting recording to import.
• A list of folders, and the data files inside a folder that staff explicitly select, for the Impact Statistics import.
• The contents of a file only when a staff member chooses to import that specific file. Google Sheets are exported as CSV and Google Docs as plain text.

The drive.readonly scope is broad, because Google does not currently offer a narrower scope that supports the recording and folder import this feature needs. We only ever read file listings and the specific files a staff member selects. We do not crawl or index a Drive, and content we do not import is never stored.

Human access

We do not allow our personnel to read Google user data unless we have the connecting user’s affirmative consent for specific messages, it is necessary for security or to comply with applicable law, or the data has been aggregated and de-identified. Gmail and Drive credentials are held in access-restricted tables that our client application cannot read, reachable only by our server using a privileged credential and encrypted at rest by our database provider.

Disconnecting and deletion

• A user or Customer can disconnect at any time under Settings, then Integrations. We revoke the token with Google and delete the stored credentials, and syncing stops.
• Access can also be revoked directly from the user’s Google account permissions page. If that happens, our next sync fails and the connection is marked as needing reconnection.
• Interaction records already created from matched email remain on the donor record as part of the organization’s history. They can be deleted individually in the app, or in bulk on request to us.
• To request deletion of Google-derived data held by us, email help@evolor.one. We respond within thirty (30) days.

Your use of Google services is governed by your agreement with Google, including the Google Terms of Service and Google Privacy Policy. This policy covers only what Evolor does with the data.

• Zoom. If connected, we import meeting recordings and metadata that the Customer selects, so meetings can be transcribed and summarized against the correct donor record.
• Stripe. Used for donation processing and subscription billing. See section 9.

We request the narrowest scopes that make each feature work, and we do not use data from one connected service to enrich a Customer’s data for any purpose the Customer did not configure.

Evolor uses AI to transcribe audio, summarize meetings and interactions, draft communications for staff review, parse field reports, and surface suggestions. To do this, the relevant Customer Data, which can include Supporter names, contact details, giving history, and message content, is transmitted to our AI providers and processed to return the output.

• We use these providers under commercial terms that prohibit training their models on our customers’ data.
• AI output is a draft. A human reviews AI-assisted communications before they are sent.
• We do not use AI to make automated decisions about individuals that produce legal or similarly significant effects.

Donations and subscription payments are processed by Stripe, Inc. Card details are entered directly into Stripe’s secure fields and transmitted to Stripe, not to us. We never see or store full card numbers. We retain a transaction record: amount, date, status, last four digits where Stripe provides them, and a Stripe reference identifier.

Where a Customer accepts donations, funds settle to that Customer’s own connected Stripe account. Stripe processes payment data as a controller under Stripe’s privacy policy.

We use the providers below to operate the platform. Each processes personal information only to provide its service to us, under contractual confidentiality and security obligations.

We may also disclose information to professional advisors, or if required by law, legal process, or to protect the rights, safety, and property of Evolor, our Customers, or the public. If we are involved in a merger, acquisition, or transfer of assets, information may transfer as part of that transaction, and we will give notice before it becomes subject to a materially different policy.

We do not sell, rent, or trade personal information, and we do not share it for cross-context behavioral advertising. We do not run third-party advertising on the platform. We have no financial incentive program tied to personal information.

• Strictly necessary cookies keep you signed in, maintain session state, and protect forms from abuse. The platform does not work without them.
• Product analytics from PostHog help us understand which features are used and where people get stuck. These are first-party and are used for product improvement, not advertising.
• Diagnostics from Sentry capture errors and performance traces.

We do not use third-party advertising cookies or ad-network trackers. You can block cookies in your browser, though strictly necessary cookies are required to sign in. We honor Global Privacy Control signals where applicable law requires it.

• Encryption in transit using TLS, and encryption at rest by our database and storage providers.
• Row-level security in the database so that one organization’s records are not accessible to another.
• Role-based access control for staff features, and optional multi-factor authentication that is enforced once a user enrolls.
• Integration credentials held in tables the client application cannot read, reachable only by our server.
• Rate limiting, bot protection on public forms, signed webhooks, and card-testing defenses on donation endpoints.
• Least-privilege access for our personnel, granted only as needed to operate and support the platform.

No system is perfectly secure. We work to safeguard data and to respond quickly when something goes wrong.

• Customer Data is retained while the Customer’s account is active. After termination, it is available for export for thirty (30) days, then deleted or de-identified within ninety (90) days.
• Gift and financial records may be retained by the Customer for at least seven (7) years to meet tax, audit, and IRS substantiation requirements. Retention of those records is the Customer’s decision, and we honor it.
• Integration tokens are deleted when the integration is disconnected or the account is closed.
• Security and audit logs are retained up to twenty-four (24) months. Diagnostic and analytics data are retained up to twelve (12) months.
• Backups expire on their normal rotation, generally within thirty-five (35) days, after which deleted data is gone from backups as well.
• We retain what we must to comply with law, resolve disputes, and enforce our agreements.

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, to opt out of certain processing, and to appeal a decision we make on your request. We do not discriminate against anyone for exercising these rights.

• Customers and Authorized Users can exercise these rights directly in the product, or by emailing us.
• Supporters should contact the organization whose records they appear in, since that organization decides what is kept. If you contact us instead, we will forward your request to that organization and support them in responding.

Email help@evolor.one to make a request. We verify requests before acting, and respond within thirty (30) days or as applicable law requires. An authorized agent may act for you with written proof.

• Every marketing email sent through the platform includes an unsubscribe link.
• Reply STOP to any text message to opt out, and HELP for assistance.
• Transactional messages such as donation receipts, password resets, and security notices are not marketing and continue after a marketing opt-out.
• Opt-out state and its timestamp are recorded on the Supporter record so the preference is durable.

You most likely reached this page from a link in an email, a text message, or a donation or signup form. Evolor is the software the organization uses. We hold their records on their behalf and act on their instructions.

For access, correction, or deletion, contact that organization directly. Their own privacy policy governs how they decide to use your information. To opt out of messages immediately, use the unsubscribe link in an email or reply STOP to a text.

Evolor is a business tool intended for adults. We do not knowingly collect personal information directly from children under 13. A Customer may maintain records about minors served by its programs, and that Customer is responsible for the legal basis and consents behind those records. If you believe a child’s information reached us improperly, contact us and we will work with the relevant organization to address it.

Evolor is operated from the United States, and personal information is stored and processed there and in other countries where our sub-processors operate. If you access the platform from outside the United States, you understand that your information is transferred to the United States, which may have different data protection rules than your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.

If we become aware of a breach of security leading to unauthorized access to personal information, we will notify affected Customers without undue delay, describe what we know, and cooperate with them so they can meet their own notification obligations. Report a suspected vulnerability or incident to help@evolor.one.

We may update this policy. We will revise the “Last updated” date above, and for material changes we will give notice by email or in-product notice before they take effect. Continuing to use the platform after that means you accept the updated policy.

Questions, requests, and complaints about privacy can go to help@evolor.one.

Freedom Family Holdings LLC, d/b/a SmartOrg