Privacy Policy

Effective date: [TBD — set when published]. This version replaces the Privacy Policy last updated January 24, 2023.

This Privacy Policy explains what information Serve Source ("Serve Source," "we," "us," or "our") collects, how we use it, and the choices you have. It applies to servesource.org, app.servesource.org, and related services (the "Site"), and it supplements our Terms of Service.

1. The Short Version

We collect information you give us directly (like when you create an account, submit a testimonial, or donate), information organizations give us about their locations and contacts, and some automatic technical data (like page views, tracked in a way that doesn't identify you personally). We use it to run the Site, connect people and organizations relationally, and — with your consent — reach out through email, text, or phone.

We do not sell your contact information or data, and we do not use it to build mailing lists for anyone outside Serve Source. We may use personal contact information to help make meaningful, relationally-driven introductions between people and partner organizations, and to share publicly available disaster response opportunities (prayer, financial partnership, volunteering) on social media, from our own Serve Source accounts.

The rest of this policy explains all of this in more detail, section by section, with the plain-language summary first and the fuller legal language underneath.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account, donate, submit a testimonial, sign up for an event, or fill out a form on the Site, you may provide: your name, email address, phone number, mailing address, organization affiliation and role, and the content of whatever you're submitting (a testimonial, a community report, a prayer request message, etc.).

We also collect a few things specific to how the Site works:

Prayer submissions — an optional message, and an approximate location. If you're not signed in, we don't require your identity; we automatically apply a random offset of about two miles to any location we store from a prayer submission, so it can't be used to pinpoint you. If you check a box asking to be contacted, we'll also store the email you provide for that purpose.
Testimonials — your name, role/title, and organization (if any), plus an email we use only to follow up about your submission — never displayed publicly.
Donations — processed through Stripe; we receive your name, donation amount, and a Stripe-assigned customer reference, but never your full card number.
Volunteer interest — if you indicate interest in volunteering with a particular organization or in a particular area, we store that so we (or the relevant organization) can follow up.
Forms — we use online forms, both on our own platform and through third-party form tools (Google Forms, JotForm, Wix Forms, and Esri Survey123), to collect information you choose to submit. For example, our "Submit Community Report" form lets you tell our team about an area impacted by a disaster, so partner organizations and churches know where to respond; other forms let you register for an event. Whatever you submit through these forms is used consistent with this Privacy Policy.

Legal language: Personal Data collected under this section 2.1 is collected when you voluntarily provide it, and by providing it you consent to its use as described in this Policy.

2.2 Information Organizations Provide About Their Contacts

Some of our partner organizations provide us with information about their own contacts — for example, a list of churches an organization wants to help us engage around disaster response and relationship-building, before and after a disaster. We keep a record of where each contact record came from (for example: a form, a manual entry, an import, or a partner-provided list), and we track, per contact and per communication channel (email, text, call, or postal mail), whether that person has opted in or out of hearing from us — so we can honor their preferences regardless of how the record originated. Anyone included this way can ask us at info@servesource.org to be corrected or removed from our records at any time.

2.3 Communication Platforms

Serve Source uses communication platform(s) — such as email, text, and messaging tools — to coordinate with partner organizations. When a partner organization discloses information to us this way, that information may become part of the disaster-response data we publish on the Site.

Some of these platforms are also shared spaces that partner staff can join directly to communicate with Serve Source and with each other. If you join one, your name and the email address on your account there are visible to other participating partner organizations, and you may choose to add a phone number to your own profile within that platform — that's entirely your own choice, not something Serve Source populates or requires.

Legal language: Serve Source may use one or more third-party communication platforms to receive information from partner organizations, coordinate disaster-response activities, and facilitate connections within Serve Source's partner network. Information a partner organization discloses to Serve Source through such a platform may be used to create or update Site content, consistent with our Terms of Service. Where such a platform is a shared space that partner staff may join directly, the individual's name and account email are visible to other participants, and the individual may voluntarily add a phone number to their own profile there. Visibility and use of information within a shared communication platform is also subject to that platform's own terms and the conduct of other participants, which Serve Source does not fully control.

2.4 Organization and Location Information

Organizations that join Serve Source, or that we list because we're connected with them or believe they're mission-aligned (see our Terms of Service), provide or have associated with them information such as their name, logo, description, services, location(s), and contact details. Some of this information — such as an organization's name, logo, service area, and general contact information — is displayed publicly, so the public and other partner organizations can find and coordinate with them. Organization logos and branding remain the property of the organization, as described in our Terms of Service. (We're separately reviewing exactly which fields are public at the individual-location level, to make sure only what's meant to be public is public — this section will be refined as that review concludes.)

An organization may request an export of its own disaster-response data from us at any time — see Section 11.

2.5 Automatically Collected Information

When you visit the Site, we automatically collect some technical information: browser type, referring page, and which pages you view. We store this in a form that doesn't identify you personally — for example, we store a one-way hash of your IP address rather than the address itself. We use this first-party data to understand usage and improve the Site; we do not currently use Google Analytics or other third-party analytics or advertising trackers, though see Section 7 for our forward-looking plans on that front.

2.6 Session Recording

Serve Source uses a session-recording feature (built into our platform, Base44) that can record how visitors interact with the Site — for example, clicks, scrolling, and mouse movement — to help us understand and improve the user experience. Sensitive form inputs, such as password fields, are automatically masked and not captured. Payment information is entered directly into secure fields provided by Stripe, which are not visible to Serve Source or to the session-recording tool.

2.7 Resource Downloads

When you download a resource from our Resources section, we record which resource was downloaded. If you're signed in, that record may be associated with your account/email; if not, we associate it with a hashed (non-identifying) version of your IP address, the same way we handle other automatically collected data described in Section 2.5.

2.8 Outbound Link Tracking

Links on the Site to a partner organization's own website may include tracking parameters (for example, utm_source, utm_medium, utm_campaign) so that the organization can see, in their own website analytics, that a visitor was referred by Serve Source and roughly why (for example, a specific disaster response listing). These parameters are visible in the resulting URL; they don't carry any of your personal information — they identify Serve Source as the referrer, not you.

2.9 Information We Don't Yet Collect, But May in the Future

We're planning a feature that would let disaster survivors submit assistance requests directly through the Site. That isn't built yet. When it is, we'll add a dedicated section to this Privacy Policy (and to our Terms of Service) describing exactly what's collected and how it's used, before that feature goes live.

3. How We Use Your Information

We use the information described above to: operate and maintain the Site; create and manage accounts; process donations; respond to your questions and submissions; send administrative communications (confirmations, updates to our policies, security alerts); and, where you've opted in, send you other communications like newsletters or updates about opportunities to get involved.

Legal language: We use Personal Data in a manner consistent with the purpose for which it was provided. If we ever intend to use your Personal Data in a way materially inconsistent with this Policy, we will inform you before or at the time of collection.

4. Using Contact Information to Build Relationships

Part of Serve Source's mission is helping people and organizations make meaningful, relationally-driven connections — a church learning about a response organization working nearby, a volunteer connecting with the right opportunity, a donor learning about a specific need. We may use contact information for this purpose, consistent with each person's channel-level consent status described in Section 2.2 — we don't add someone to an email or text communication channel without their opt-in for that channel. This may include inviting you to join a shared communication platform with other partner organizations, as described in Section 2.3.

5. Public Disaster Response Data and Social Media

Serve Source publishes publicly available disaster response information — either submitted through the Site or shared with us in other communications — and shares it to help magnify the efforts of partner organizations, including opportunities to pray, give financially, or serve with a partner organization. This sharing happens through Serve Source's own social media accounts, not through your personal accounts or on your behalf. We may use software tools, including AI-assisted tools, to help draft this kind of content or match a need to a resource; any public-facing content is reviewed by our team before it's published.

6. What We Don't Do: No Selling of Contact Lists or Information

Serve Source does not sell, rent, or trade your contact information or other personal data. If Serve Source is ever involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy (or a successor policy you're notified of).

7. Who We Share Information With

We work with a small number of service providers to run the Site, and we only give each one the information it needs to do its job:

Stripe — processes donations. Stripe receives your payment details directly; we never see or store your full card number.
LocationIQ — used to convert addresses into map coordinates (geocoding) and back.
Esri / ArcGIS — used for custom mapping. Today, Esri holds a separate, manually-maintained copy of some organization data — including some individual contact information (names, emails, phone numbers) tied to organization locations — that is not automatically synced with our platform. As our mapping tools evolve, we intend to limit what's shared with Esri to organization-level display information (name, location, category) wherever possible, rather than individual contact details.
Form tools — Google Forms, JotForm, Wix Forms, and Esri Survey123, used for specific forms as described in Section 2.1.
Communication platform(s) — such as email, text, and messaging tools, used to coordinate with partner organizations; see Section 2.3 for what's visible to other participants if you join a shared one.
Base44 — the application platform Serve Source is built on; it hosts our data and application infrastructure.
Domain and security monitoring tools — see Section 8.

Advertising and analytics — forward-looking. We may in the future use advertising platforms (such as Google Ads or Meta/Facebook Ads) to promote Serve Source, and analytics tools (such as Google Analytics) to understand Site usage. If we do, we will update this Policy and our cookie consent mechanism accordingly before those tools go live.

We may also disclose information if required by law, to protect our legal rights, to protect the safety of Site users or the public, or in connection with a business transfer as described in Section 6.

8. Monitoring of Partner Organizations

Serve Source uses automated tools to monitor publicly available information about our partner organizations — their websites, social media accounts, and domain/security records — to help us identify organizations that may have stopped operating, changed ownership, or begun sharing malicious or inappropriate content, and to flag potential domain security vulnerabilities so we can notify the organization. This monitoring is about organizations' public-facing presence; it is not used to compile information about their individual staff members.

9. Cookies and Similar Technologies

The Site may use cookies and similar technologies to keep it running properly (for example, keeping you signed in) and to understand how the Site is used, including the session-recording feature described in Section 2.6. We do not currently use third-party advertising cookies. If that changes — for example, if we adopt Google Analytics or an advertising platform as described in Section 7 — we'll update this section and our cookie consent mechanism at that time.

10. Data Retention

We don't apply a fixed retention period. We keep information for as long as reasonably necessary for the purposes described in this Policy, or as required by law, and we take reasonable steps to keep it accurate and to honor correction or deletion requests.

11. Your Choices and Rights

You can ask us to correct, update, or delete your personal information, or to stop receiving communications from us, at any time by contacting info@servesource.org. You can unsubscribe from most email communications using the link included in the email itself; we may still send you transactional or administrative emails (like account or donation confirmations) even after you unsubscribe from promotional messages. For your own security, please avoid sending sensitive information (like a password or a Social Security number) to us by email. In some cases, we may need to retain certain information (for example, to comply with the law or maintain accurate financial records), in which case it will be kept separately and not used for other purposes.

Organizations: a partner organization may request an export of its own disaster-response data on the Site at any time by contacting info@servesource.org — we're happy to provide it.

California residents: you have the right to know what personal information we've collected about you, to request its deletion, and to request correction of inaccurate information. As stated in Section 6, we do not sell or share personal information for cross-context behavioral advertising. To exercise these rights, contact info@servesource.org.

Users outside the United States: Serve Source is based in the United States, and information we collect is processed and stored here. By using the Site, you understand your information will be transferred to and processed in the U.S. If the law where you live gives you additional rights, contact us at info@servesource.org and we'll do our best to accommodate your request consistent with our practices.

12. How We Protect Your Information

We take reasonable technical and organizational measures to protect personal information from unauthorized access, disclosure, alteration, or destruction, including access controls limiting who on our team can view personal information and encryption in transit. No system is completely secure, and we can't guarantee absolute security of information transmitted to us.

13. Children's Privacy

Our services are not directed to children, and creating an account requires you to be at least 18. We do not knowingly collect personal information from anyone under 13. If we learn we've collected personal information from a child under 13 without appropriate consent, we will delete it. If you believe we have such information, contact us at info@servesource.org.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we'll update the effective date at the top of this page. Your continued use of the Site after a change takes effect means you accept the revised Policy.

15. Contact Us

Questions about this Privacy Policy? Contact us at:

Serve Source 400 West Main St, Suite 3 Round Rock, TX 78641 info@servesource.org