Privacy Policy

During crises, the data we handle is sensitive. Location data, medical need descriptions, and contact information can put people at risk if mishandled. AidGrid takes this seriously:

• Location data is used only to route requests and match resources.
• Contact info is used only if a coordinator needs more information.
• No personal data is shared between organizations without consent.
• You can request deletion of your submission at any time.

What you submit (Intake Form)

• Location data (address or coordinates) — used for triage proximity and resource matching.
• Need type and description — used for AI triage and case categorization.
• Contact information (name, phone, email) — optional, used only if a coordinator needs follow-up.
• Photos — stored securely, accessible only to your organization's coordinators.
• Source channel — recorded for audit trail (web, phone, WhatsApp, etc.).

What you provide when creating an account

• Name and email address
• Organization name and type
• Role within organization (admin, coordinator, viewer)
• Team member information (for admins inviting coordinators)

What we collect automatically

• Device and browser information (for security and optimization)
• IP address (for security, not stored long-term)
• Usage data — which features are used, case volume, response patterns (privacy-safe, no case content)
• Cookie data (per your cookie preferences)

Special categories

Crisis-related location data is sensitive. We handle it with additional care: stored encrypted, scoped to your organization, not shared without consent, and deletable on request.

We do not collect health information as a primary category. If a help request mentions a medical need, it is treated as operational coordination data — not a health record — and is not used for any clinical purpose.

Operational uses

• Process and triage help requests
• Score urgency and detect duplicates
• Match cases to nearby resources
• Route cases within your organization
• Track case status and history
• Send case alerts and notifications to your team
• Generate coordination reports

Administrative uses

• Authenticate and manage user accounts
• Manage organization and team access
• Send transactional emails (case alerts, team notifications, security notices)
• Send mission updates and newsletters (only with explicit consent)

• AI triage outputs are generated from your submission text. They are stored alongside the request and are reviewed by human coordinators.
• AI training data is reviewed for bias and accuracy. Field feedback improves the system over time.
• No AI decision is final without human review.
• All help request text is processed by AidGrid's AI triage engine to generate urgency scores, duplicate clusters, resource suggestions, and missing-information flags.

• Volunteer applications are stored securely and used only for volunteer coordination.
• Volunteer contact details are never shared outside the volunteer program without consent.
• Donation records are handled by our donation processor — AidGrid does not store full payment details.
• Donor names are only listed publicly with explicit consent.
• You can request deletion of your volunteer or donor record at any time by emailing our privacy team.

We do NOT

• Sell your personal data
• Share your case data with other organizations without your explicit consent
• Share your organization data with third parties for marketing
• Use your case data to train AI models shared with third parties
• Share individual case information with emergency services automatically

We DO share in specific circumstances

1. Cross-org referrals. When you explicitly route a case to a partner organization, that specific case's information (location, need, contact if provided) is shared with the partner. Only the referred case — not your full case history.
2. Service providers. We use Supabase (database, auth, storage), Resend (email), and a donation processor. These providers process data only on our instructions, under data processing agreements.
3. Legal requirements. If required by law, court order, or government request, we may disclose data. We will notify you when legally permitted.
4. Fraud and abuse. If we detect patterns suggesting fraudulent or abusive use of the intake system, we may review and restrict access. This does not involve sharing data with third parties.

• Encryption in transit: TLS 1.2+
• Encryption at rest: AES-256
• Role-based access control (RBAC)
• Organization-scoped data isolation (row-level security)
• Audit log of all case actions (who did what, when)
• Least-privilege access for service accounts
• Regular security review and testing

• Case data: Retained while your account is active. Deleted within 30 days of account closure (or exported if you request it before deletion).
• Account data: Retained until account deletion. Deleted within 30 days.
• Audit logs: Retained for 12 months.
• Marketing data (email consent): Retained until you unsubscribe or delete your account.
• Photo uploads: Deleted when the associated case is deleted or when you request deletion.

Depending on your location, you may have:

• Right to access: See all data AidGrid holds about you.
• Right to correct: Update inaccurate data.
• Right to delete: Request deletion of your data.
• Right to export: Download all your data.
• Right to restrict processing: Limit how we use your data.
• Right to object: Opt out of marketing emails and, where applicable, certain processing.

To exercise any right, email privacy@aidgrid.org. We respond within 30 days.

For nonprofit and NGO users: We recognize that crisis coordination data may be subject to additional legal protections in your jurisdiction. Contact us to discuss specific requirements.

AidGrid uses a small number of cookies for essential, functional, analytics, and performance purposes. Essential cookies are always on; the others can be toggled at any time.

See the full breakdown on the Cookie Policy page, or open the cookie preferences from the link in the footer.

AidGrid is not designed for or directed at children. We do not knowingly collect information from children under 16. If you believe a child has submitted a help request, contact us and we will remove it.

If you use AidGrid from outside the United States, your data is transferred to and processed in the United States. We use standard contractual clauses and data processing agreements where required.

We may update this policy periodically. Changes take effect 30 days after posting. For significant changes, we will notify account holders via email.

• Data privacy questions: privacy@aidgrid.org
• Data deletion requests: privacy@aidgrid.org
• Security concerns: security@aidgrid.org
• Mailing address: AidGrid, 7250 Dallas Pkwy Suite 400, Plano, TX 75024, United States