In short. We collect what we need to move money safely and lawfully: who gave, who received, and, for those who raise money, who they are. We do not sell personal information. Card numbers go to our payment processor, not to us. Face measurements used to verify identity are taken only with consent, never shared or sold, and deleted on a fixed schedule.
This policy explains how GoodForUs, a d/b/a of SolutionsAe, Inc., on a platform owned by SolutionsAe, Inc. and The Solutions Foundation ("we", "us"), handles personal information about people who give, people who raise money and the people who work for them, people who apply to use GoodForUs, account holders, people who receive gifts, and visitors to GoodForUs pages. Organizations that raise money on GoodForUs also use the information of their own donors; they are responsible for their own use of it.
A child can sell in a school or organization's fundraising drive only if their parent or legal guardian enrols them. The parent gives their own name and email, agrees to a consent that we record with the time, the version they agreed to and the address it came from, and confirms from an email we send. The parent sets up the child's page. We hold the child's first name, their class or group, any photo and description the parent adds, and their sales. The page shows the first name and any photo, and stays hidden until the parent confirms. A child has no account and cannot move money, and a parent can remove them at any time. Children's information is used only for the drive and never for advertising.
Our own first-party analytics record a random visitor ID, the kind of device (phone, tablet or computer), the site that sent you, campaign tags in the link, and, where our network provider supplies it, your country. They do not record your IP address.
What. To confirm that a person applying to raise money, or an owner or controller of an organization, is the person on their identity document, we record a short video and photo of their face and compare it with the photo on the document. The comparison uses measurements of the face (biometric identifiers). It is done on our own servers. No outside company receives these images or measurements for this purpose.
Consent. We do this only after the person gives written consent, which we record with the time and the version of the wording they agreed to.
Use. Only to verify identity for the application. We never sell, lease, trade or otherwise profit from biometric information, and we do not disclose it except where the law requires.
Retention and destruction. The face video and photo are permanently deleted three years after the person's last interaction with GoodForUs, or sooner when the purpose has been met. The measurements taken for the comparison are not stored. Identity document images and the result of the check are kept while the account is open and for five years after it closes (five years after the decision if not approved), as anti-money-laundering law requires of identity records, and then deleted.
Everywhere. This notice, the consent and this schedule apply to everyone, in every state. We wrote them to meet the strictest state biometric privacy laws, including Illinois, Texas and Washington, as well as the law of Georgia, where GoodForUs is based and whose law governs our terms.
Storage. Face videos, photos and identity documents are encrypted where they are stored. Our encrypted backups are kept for 14 days, so a deleted file may remain in a backup until that backup expires.
Signing in with a passkey or Face ID uses your device's own biometrics. Your face or fingerprint stays on your device; we receive only a cryptographic key.
We do not sell personal information, and we do not use it for third-party advertising.
We check organizations, their people, donors and anyone sending or receiving money against government sanctions lists and other compliance sources, before and after money moves, and we watch for patterns that may indicate fraud or money laundering, such as unusually large gifts. This can result in a payment or funds being held. Where the law requires it, we report suspicious activity to the authorities, and the law may prohibit us from telling the person concerned.
| Who | What and why |
|---|---|
| The organization or fundraiser you give to | Your name, email, gift and note, so they can thank you and keep their records. |
| Payment processors (Stripe) | Payment details and, for organizations, the owners' and controllers' identity details the processor must verify. Card numbers are given by you directly to the processor. |
| Stripe and its partner bank, for GoodForUs cards | GoodForUs issues cards through its Stripe Issuing program. For an organization card, the cardholder and organization details needed to issue and run the card, as the program and the law require. |
| Plaid | If you choose to link a bank account. |
| Email and text message providers | Your email or phone number and the message, to deliver receipts, codes and notices. |
| Hosting and storage providers | All the information we hold, stored on our behalf. |
| Public records and screening sources | An organization's and its principals' names, to search state business registers and news sources. Sanctions and politically exposed persons lists are downloaded and checked on our own systems. |
| AI provider (Anthropic) | An organization's own total figures and campaign names, to write its fundraising summary. Never donors' names or contact details. |
| Authorities | Where the law requires, or to protect people and funds. |
Documents are read, and faces compared, on our own servers. If we ever use an outside service to read documents or to monitor our systems' security, it will act only on our instructions, under contract, and we will list it here.
We use only our own first-party cookies. We do not use advertising or third-party tracking cookies.
| Cookie | Purpose | Lasts |
|---|---|---|
| gfu_session | Keeps you signed in | 12 hours |
| gfu_apply, gfu_person, gfu_registration | Continue an application, an identity check or sign-up | 60 days, 30 days, 30 minutes |
| gfu_basket, gfu_bidder, gfu_seller | A shop basket, an auction bidder, a drive seller's link | 24 hours, 90 days, 180 days |
| gfu_vid, gfu_sid, gfu_src | Our own visit counts and where visitors came from | 1 year, 30 minutes, 30 days |
Some pages load fonts from Google Fonts, and an organization may embed a YouTube or Vimeo video; those services receive your IP address when they are loaded.
| Information | Kept for |
|---|---|
| Face video and photo | 3 years after your last interaction |
| Identity documents and verification records | While the account is open and 5 years after it closes, or 5 years after a decision if not approved |
| Suspicious activity records | 5 years after filing |
| Gift, payment and receipt records | At least 7 years, for tax and anti-money-laundering record-keeping |
| Raw visit analytics | 90 days (daily totals kept) |
| Emails we have sent | 30 days |
| Backups | 14 days |
We protect information with encryption in transit, encryption at rest of our whole database, its backups, identity documents and face videos, separate encryption of sensitive fields such as bank account numbers and ID numbers, one-way hashing of passwords, access controls, audit logging and monitoring. See our Security page. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
GoodForUs is operated from the United States and information is stored there. If you use it from elsewhere, your information is transferred to the United States.
We will post any change to this policy here with its effective date, and tell account holders about significant changes before they take effect.
Privacy questions and requests: legal@solutionsae.com, GoodForUs (a d/b/a of SolutionsAe, Inc.), 236 Auburn Avenue, Atlanta, GA 30303.