1. Who We Are
This Privacy Policy describes how A Step Ahead Media, doing business as All In One Nonprofit ("we," "us," or "our"), collects, uses, and protects your information when you use our website at allinonenonprofit.com and our suite of nonprofit management applications (collectively, the "Service"). Your use of the Service is also governed by our Terms of Service.
If you have questions about this policy, contact us at [email protected].
2. Information We Collect
2.1 Information You Provide Directly
- Account information: When you create an account, we collect your name, email address, and the organization information you choose to provide (organization name, role, address, etc.).
- Content you create: Any information you enter into our apps (board minutes, donor records, volunteer rosters, policy documents, etc.) is saved to your organization's account so that it is backed up and available when you sign in on another device. It is stored on our hosting infrastructure (Cloudflare) and is not shared outside your organization unless you explicitly export or share it. For speed, some apps keep a working copy in your browser that syncs to your account in the background.
- Communications: When you contact us by email, we retain those messages and your contact information to respond to and follow up on your inquiries.
2.2 Information Collected Automatically
- Usage data: Basic browser information (browser type, device, screen size, referring URL) collected by our hosting provider, Cloudflare, whose Web Analytics is privacy-first and cookieless.
- Analytics: We use Google Analytics 4 and PostHog to understand which pages are visited and how features are used, so we can improve the Service. This information is used in aggregate. These analytics run only with your consent where consent is required, and you can accept or decline analytics cookies through the consent banner shown on your first visit.
- Cookies: We use essential cookies required for the Service to function (for example your sign-in session and your saved cookie choice), and optional analytics cookies (Google Analytics 4 and PostHog) that are set only with your consent. For the full list and how to control them, see our Cookies Policy.
2.3 Payment Information
When you purchase a product or start a paid subscription, payments are processed through Stripe (for card payments) or PayPal, with A Step Ahead Media acting as the seller of record. We do not collect or store your full credit card number, security code, or bank account information on our servers. We receive only a confirmation of payment, your billing name and email, and a transaction or subscription identifier. For details on how these processors handle your information, see Stripe's Privacy Policy and PayPal's Privacy Statement.
2.4 Email Marketing Information
If you subscribe to our email list (newsletters, product updates, educational content), we collect your email address and, if you provide it, your name and organization. We use an email service provider (MailerLite) to send these messages. You can unsubscribe at any time using the link in any email we send.
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Service.
- Process payments and manage your purchases.
- Send you transactional emails (account confirmations, password resets, invoices, important Service notices).
- Send you marketing communications when you have opted in.
- Respond to your support inquiries.
- Detect, prevent, and address technical issues, fraud, or violations of our Terms of Service.
- Comply with legal obligations.
3.1 AI-Powered Features and Automations
Many tools in the Service include optional AI automations that draft documents for you (for example, thank-you letters, board reports, grant narratives, appeals, and meeting minutes) from the information you choose to enter. When you run one of these automations, the specific content you submit for that task, which can include the names and contact details of donors, members, volunteers, or board members, and the notes and figures you type into that tool, is sent to our AI subprocessor, Anthropic (the Claude API), solely to generate the requested draft, which is then returned to you to review and edit. The following safeguards apply:
- Only what you submit for that task is sent. An automation receives the fields you entered for that specific document, not your entire database. AI features do not run in the background across your records; they run only when you click to generate a draft.
- Not used to train models. Under our commercial terms with Anthropic, the content you submit through these features is not used to train their models.
- Transient processing. The content is processed to produce your draft and is not retained by us to build a separate AI dataset. Your underlying records continue to live in your own account and Document Library.
- Optional and under your control. AI automations are optional. If you prefer not to send a particular document's contents to the AI subprocessor, simply do not use the AI drafting button for that document; the rest of the Service works without it.
Anthropic is listed in our subprocessor list and covered by our Data Processing Addendum. You remain the controller of the donor and constituent data you enter; we and our AI subprocessor act as processors for that content.
4. How We Share Your Information
We do not sell your personal information. We share information only in these limited circumstances:
- Service providers (subprocessors): We share information with vendors who help us operate the Service: Cloudflare (website and application hosting, and encrypted document storage via Cloudflare R2 for the Document Library), Stripe and PayPal (payment processing), Google (sign-in), MailerSend / MailerLite (email delivery), and Anthropic (the Claude API that powers the optional AI drafting automations described in section 3.1). These vendors are bound by contract to use your information only to provide their service. See our full subprocessor list and our Data Processing Addendum.
- Legal compliance: We may disclose your information when required by law, court order, or government request, or to protect our legal rights.
- Business transfer: If we sell or transfer the business, your information may be transferred to the acquirer, subject to this Privacy Policy.
- With your consent: Any other sharing requires your explicit consent.
5. Data Retention
We retain your account information for as long as your account is active. If you cancel your account, we will delete your account information within 90 days, except where we are required to retain it longer to comply with legal obligations (e.g., tax records). Data you have stored locally in your browser is under your control and is not retained by us when you log out or clear your browser data.
Files you upload to or generate into the Document Library are stored on our infrastructure (Cloudflare R2) and are retained until you or your organization delete them. When an account or organization is closed, its Document Library files are deleted within 90 days, except where a longer period is required by law.
6. Your Rights
Depending on where you live, you may have the following rights regarding your information:
- Access: Request a copy of the personal information we hold about you.
- Correction: Ask us to correct inaccurate information.
- Deletion: Ask us to delete your information (subject to legal retention requirements).
- Opt-out of marketing: Unsubscribe from our marketing emails at any time.
- Data portability: Receive your information in a portable format.
To exercise any of these rights, email [email protected]. We will respond within 30 days.
7. Children's Privacy
The Service is intended for use by adults running or supporting nonprofit organizations. You must be at least 18 years old to create an account. We do not knowingly collect personal information directly from anyone under 18. If you believe we have collected information directly from someone under 18, please contact us immediately and we will delete it.
8. Security
We use reasonable technical and organizational measures to protect your information, including encryption in transit (HTTPS), restricted access controls, and reputable service providers. However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security and encourage you to use strong, unique passwords and to log out of shared devices.
9. International Users
The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States. By using the Service, you consent to this transfer.
If you are a resident of the European Economic Area, United Kingdom, or other regions with comprehensive data protection laws (e.g., GDPR, UK GDPR), you have additional rights. Contact us to exercise them.
10. California Residents (CCPA)
California residents have specific rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete personal information, and the right to opt-out of the sale of personal information (we do not sell personal information). To exercise these rights, contact [email protected].
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if we have your email address) or by posting a prominent notice on the Service. The "Last updated" date at the top of this page reflects the most recent revision.
12. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your information:
A Step Ahead Media, DBA All In One Nonprofit
Email: [email protected]
Website: allinonenonprofit.com