Ember — Product Privacy Policy

The short version

Your organization's data belongs to your organization. We store it so the software works. We do not sell it, we do not share it with other organizations, and we do not use it to train anything. You can export everything or delete it at any time without asking us. The only exception is statistics combined across many organizations, which identify no organization and no person (see section 4).

1. Who is responsible for what

When your organization uses Ember, your organization decides what information to collect about the people it works with (volunteers, staff, donors, board members and the people in its stories), and why. We store and process that information on your organization's instructions. In data-protection terms, your organization is the controller and AYNI TX LLC (operating as Ember / Done With Ember) is the processor.

If you are a volunteer or staff member and want to see, correct, or remove what an organization holds about you, ask that organization. They can do it in a few clicks. We generally cannot act on your request without them, because the data is not ours to change.

For information about the person who signs up and administers the account, we are the controller.

2. What the app stores

About the people your organization works with (whatever the organization chooses to enter or import): name and display name; email address and phone number; emergency contact name and phone; date of birth (used to determine whether someone is a minor); for volunteers under 18: guardian name, guardian email, guardian phone, and whether consent is on file; whether a media release is on file; skills, availability, and notes the organization writes; shift signups, attendance, and hours served; for donors: mailing address, gifts (amount, date and what they were for), and thank-yous recorded; for board members: officer role, term dates, committees, and conflict-of-interest status; for staff: employment type, expected hours, hourly pay rate and timesheets; for people in stories: the story, any photo, and the release recorded (with a guardian's name for a minor); profile photos; documents the organization records as held (we record that a document exists; we do not store the file itself).

About account holders (staff and volunteers who sign in): email address, name, role in the organization, and sign-in activity. For the person who signs up an organization, also how they found Ember: the page they signed up from, any ad or campaign tags on the link, and their answer if they tell us how they heard about us. Each sign-up request is logged with its IP address and device details, which we clear after 90 days.

About organizations: name, address, EIN, category, mission text, and the self-attested tax status the account holder provided. Files and images the organization uploads, such as its logo, program photos, and receipts for its filings.

Automatically: log data needed to run and secure the service — IP address, browser type, timestamps, and actions taken in the account (an append-only audit log).

We do not collect payment card details. Paid plans are billed through Stripe. Stripe collects and processes payment card and billing details on its own checkout page; we never see or store full card numbers. We keep the organization's plan, its billing status, and Stripe's reference numbers for the organization's customer record and subscription. We also do not collect government identification numbers for individuals or health information. Ember is not designed to hold health records. Organizations must not enter health records or any other prohibited categories of data.

3. Children and young volunteers

Many organizations that use Ember work with volunteers under 18, and Ember supports that.

We do not knowingly collect information directly from a child. Where a volunteer is under 18, the organization records a guardian's contact details and whether consent is on file. Sign-up forms an organization shares publicly do not ask for a date of birth or guardian details — an organization records those privately after accepting a volunteer.

If you believe a child's information is in Ember and should not be, contact the organization directly, or email us at hello+privacy@donewithember.org and we will help you reach them.

4. Why we process it

To provide the service: to run the features your organization uses, to send the messages the software is asked to send, to keep the service secure and available, and to support your organization when it asks for help. We also use it, combined and de-identified, to understand how Ember is used and to publish statistics (see "Combined statistics" below).

We do not: sell or rent personal information, ever; share one organization's data with another organization; use your data to train machine-learning models; show advertising in the product, or let advertising or tag-management scripts run inside the application.

Combined statistics. We may combine information from many organizations into statistics, such as typical volunteer hours by type of program or how long organizations take to file, and publish them, for example in an annual report on how nonprofits work. Before we do, we remove names, contact details, notes, anything typed in free text, and anything else that could identify an organization or a person. We publish a figure only when at least 10 organizations contribute to it, so none can be picked out. We do not try to re-identify anyone from these statistics.

5. Email we send

Sign-in links and security notices — required for the service to work. These cannot be turned off.

Operational messages the organization configures — shift reminders, confirmations, recognition notes, summaries. Each of these can be turned off independently by the recipient or by the organization.

Getting-started emails to the person who set up an organization: a few emails in the first week to help them get going, and a short optional survey. They can be turned off from the link at the bottom of any of them. When a link in one of these emails is clicked, we note it, so we can tell which emails help.

6. Who else is involved

We use a small number of vendors to run the service. Each is bound to process data only on our instructions.

No analytics, advertising or tag-management scripts load in the application's pages. Our servers send PostHog a short record of certain events, such as signing in, creating an organization, turning on an app or choosing a plan, tagged with the account's ID and the organization's ID. For a sign-up that has no account yet, the tag is the email address entered. These records do not include the names, contact details or notes an organization keeps about its people. We use them only to understand how Ember is used and to improve it. Marketing-site analytics stays on the marketing site and never loads on a page showing volunteer information.

Services you or your organization choose to connect. If an administrator connects the organization's Google Drive, Ember saves the documents and photos it creates to that Drive, and keeps an encrypted key that lets it add files to its own folders there and nowhere else. If an administrator connects a Slack channel, Ember posts short notices to it. If you sign in with Google, Google tells us your name, email address and profile picture. These services are the organization's (or yours), under their own terms and privacy policies. Disconnecting stops Ember from sending anything more.

Using Ember from your own AI assistant. You can connect an AI assistant you already use, such as Claude or ChatGPT, to your Ember account. It works only after you sign in to Ember and press Allow, and it can see and change only what your role in the organization already lets you see and change. When you ask it about your Ember work, Ember sends the answer to that assistant: for example your organization's programs, the names and roles of its team members, and tasks. The assistant's provider (such as Anthropic for Claude, or OpenAI for ChatGPT) then handles that information under your own agreement with them and their privacy policy, not ours, including whether it is kept or used to train their models. That provider works for you, not for us, and is not one of our vendors. You can disconnect an assistant at any time in your account settings, under Sign-in & security, and it loses access at once.

Ember's in-app assistant. Ember's in-app assistant, Flint, answers questions about using Ember. When someone asks it a question, we send Google, through its Gemini service on Google Cloud Vertex AI under paid terms, with processing in the United States, the question, the page it was asked from, the parts of Ember's Help pages needed to answer it, and facts about the organization's setup (which apps are turned on, which setup steps are done, and which items need attention). Flint can also set up an organization's first program: when someone describes their organization in a sentence, we send that sentence (exactly as typed) to Google the same way, to suggest the program's name. Do not include anyone's name or other personal information in the description. We do not send the names of, or records about, the people the organization works with. Google uses this information only to produce the answer and, under those terms, does not use it to train its models. We keep each question and answer for 12 months so we can improve Help and the assistant.

7. Where data is stored and for how long

Data is stored in the United States. While the account is active, we keep data until the organization deletes it.

Deleting an organization starts a 30-day window during which the data is hidden from everyone but recoverable by the owner. After 30 days it is permanently deleted from production systems.

Anonymizing a person removes their identifying details permanently while keeping historical totals intact.

Backups are retained for 7 days after permanent deletion (or such shorter or longer period as our database provider's then-current plan provides), after which deleted data ages out of them as well.

The audit log is append-only. It records actions taken in the account and cannot be edited or deleted by anyone, including us. It is retained as necessary for security, legal compliance, and dispute resolution.

8. Your choices

If your organization uses Ember: export everything at any time in full without asking us. Delete your organization at any time. Correct or remove any person's record.

If you are a volunteer or staff member: see and correct your own information in your account, turn off any non-essential email, and ask your organization to remove you. Depending on where you live, you may have additional rights under applicable U.S. state law (for example, the California Consumer Privacy Act). Contact the organization that holds your data, or email us at hello+privacy@donewithember.org and we will help route the request.

9. Security

Access is restricted at the database level so that one organization cannot read another's data — enforced by the database itself, not only by the application, and verified automatically on every change we make. Sign-in is passwordless. Data is encrypted in transit (TLS) and at rest.

No system is perfectly secure. If a breach affects your information, we will notify affected organizations without unreasonable delay and in accordance with applicable law.

10. Changes and contact

We will post changes here and, for anything material, notify account holders by email or with a notice in Ember before the change takes effect.

Contact: hello+privacy@donewithember.org · AYNI TX LLC · 12005 Mystic Forest Ln, Austin, TX 78738