Privacy policy

1. What we collect

Account information: your name, email address, and password (stored as a salted hash — we never see it in plain text).

Campaign information: the content you publish, including story text, photos, location, and beneficiary details.

Donation information: amounts, optional messages, and your choice to remain anonymous. Card numbers are collected directly by our PCI-DSS certified payment processors and never touch Northlight's servers.

Technical information: IP address, browser type, and usage data that help us keep the Platform secure and improve it.

2. How we use it

To operate the Platform: processing donations, displaying campaigns, sending receipts and updates you've asked for.

To keep people safe: verifying organizer identities, detecting fraud, and enforcing our Terms.

To improve Northlight: aggregate, de-identified analytics about how features are used.

We do not sell your personal information. Ever. We do not share it with advertisers.

3. When we share

Payment partners (for processing and identity verification, as required by US KYC/BSA and Canadian FINTRAC regulations); service providers under strict confidentiality (hosting, email delivery); and authorities when legally required by valid process in the US or Canada.

Public by design: your campaign content, your name on non-anonymous donations, and your messages of support are visible to anyone who visits the campaign page.

4. Cross-border data

Northlight operates in both the United States and Canada, and your information may be processed in either country. We apply the same protections regardless of where data is stored, and we comply with PIPEDA in Canada and applicable state privacy laws in the US (including the CCPA/CPRA for California residents).

5. Your rights

You can access, correct, export, or delete your personal information. Deletion requests are honoured within 30 days, subject to records we must keep for financial compliance (typically 7 years for transaction records).

To exercise any right, email support@north-light.org from your account address. Canadian users may also contact the Office of the Privacy Commissioner of Canada; California residents may exercise CCPA rights without discrimination.

6. Cookies

We use strictly necessary cookies for sign-in sessions and security, and a small number of first-party analytics cookies to understand aggregate usage. We don't use third-party advertising cookies or cross-site trackers.

7. Retention & security

Account data is kept while your account is active. Transaction records are retained as required by financial regulations. All data is encrypted in transit (TLS 1.3) and at rest, with access limited to employees who need it and logged when it happens.

8. Children

Northlight is not directed at children under 18, and we do not knowingly collect their personal information. Campaigns that benefit a minor must be organized by an adult.

9. Changes & contact

We'll announce material changes 14 days in advance. Questions or concerns: support@north-light.org, or write to either office listed on our contact page.