Privacy Policy

Effective date: June 24, 2026 · Last updated: June 24, 2026

Drip Donations ("Drip", "we", "our", "us") is operated by Drip Financial, a New Mexico business. This Privacy Policy describes how we collect, use, store, share, and protect information when you use our platform at dripfinancial.org and through the Drip Donations app on the Stripe App Marketplace.

By using Drip, you agree to the terms of this policy. If you do not agree, do not connect a Stripe account or register as a charity.

1. Information we collect

From business merchants (Stripe Connect):

Stripe account ID, business name, and account country
Transaction metadata required to calculate the donation percentage (amount, currency, timestamp, transaction ID)
Merchant-configured donation settings (selected charities, donation rate)

From charities:

Organization name, EIN, and registered address
Authorized representative name, role, and email
Payout bank or Stripe Connect account ID
IRS 501(c)(3) verification status pulled from public IRS data

From all users:

Account credentials (email, hashed password if applicable)
Communications you send us (support tickets, emails)
Device and access logs (IP address, browser type, timestamps) used for security and abuse prevention
Cookies (see Section 6)

We do not collect full payment card numbers, bank account numbers, or end-customer personal data. Stripe processes payments; Drip only sees the metadata Stripe Connect makes available.

2. How we use information

To calculate, batch, and route donations
To verify charity 501(c)(3) status against IRS Pub 78
To produce summaries and reports for merchants and charities
To send transactional emails (payout notifications, weekly summaries)
To detect and prevent fraud, abuse, and security incidents
To comply with legal obligations (tax reporting, subpoenas, regulatory inquiries)
To improve the product

We do not sell your data. We do not use your data to train AI models.

3. How we share information

With Stripe to process payments and payouts. Stripe's Privacy Policy applies independently: stripe.com/privacy
With the charities you selected — only the donation amount, period, and your business name (if you opt in to attribution)
With service providers under contract (cloud hosting, email delivery, analytics), who are bound by confidentiality and data-protection terms
As legally required (subpoena, court order, regulatory request)

We do not share data with advertisers and we do not run advertising on Drip.

4. Data retention

Data type	Retention period
Active account records	Duration of the account + 7 years (tax record minimum)
Transaction and donation records	7 years from the transaction date
Support tickets and emails	3 years from last interaction
Access logs	90 days, then aggregated/anonymized
Backups	Rolling 30 days

After the retention window, records are deleted or irreversibly anonymized.

5. Your rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete personal data
Delete your personal data (subject to the legal retention requirements above)
Restrict or object to certain processing
Portability — receive a machine-readable copy of your data
Withdraw consent where we rely on consent

To exercise any right, email support@dripfinancial.org. We respond within 30 days. For California residents, this includes rights under the CCPA. For EU or UK residents, this includes rights under the GDPR.

We do not "sell" personal information as that term is defined under California law.

6. Cookies and tracking

Drip uses strictly necessary cookies (session, CSRF protection) and basic, privacy-respecting analytics — no third-party ad cookies. You can disable cookies in your browser; some features will not work without them.

7. Children's privacy

Drip is not intended for users under 18. We do not knowingly collect data from children. If you believe we have, contact support@dripfinancial.org and we will delete it.

8. Data security

TLS in transit and encryption at rest
Managed PostgreSQL with automated backups
API keys and Stripe secrets stored as managed environment secrets, never hard-coded in source
Periodic access review and least-privilege, role-based access

No system is 100% secure. We will notify affected users without undue delay in the event of a data breach affecting their information.

9. International data transfers

Drip operates from the United States. If you access Drip from outside the U.S., your data will be transferred to and processed in the U.S. By using Drip, you consent to that transfer.

10. Changes to this policy

We will post any changes to this policy on this page and update the "Last updated" date. Material changes will be emailed to active account holders.

11. Governing law

This Privacy Policy is governed by the laws of the State of New Mexico, without regard to its conflict of laws principles.

12. Contact

support@dripfinancial.org
Drip Financial, Albuquerque, New Mexico, USA