Privacy Policy

This policy describes what Steadworthy collects, why, and who processes it. The short version: most of what we show you is public record; what you give us stays yours; we sell nothing to anyone.

What we collect

• Public records. IRS publications (Business Master File, Publication 78, revocation lists) and state charity registry records. These are public data about organizations, not personal data — we compile them to power the scan and monitoring.
• Scan queries. The EINs you scan, and the email address you provide if you request a full report.
• Account data. Name, email, and authentication details, handled by our sign-in provider (Clerk).
• Organization profile data. What you enter or upload to prepare filings: officers, financials, fundraising details, and documents you place in your vault.
• Payment data. Handled by Stripe. We never see or store full card numbers.

How we use it

• To run scans and show registration statuses with their sources.
• To prepare, track, and monitor registrations you ask us to manage.
• To send the emails you request: reports, deadline reminders, alerts.
• To operate, secure, and improve the service.

We do not sell personal data, and we do not use your organization's private profile data for advertising.

Who processes it

We use a small set of infrastructure providers, each listed with its role on our Subprocessors page. Beyond those: we share filing information with state agencies when you direct us to file, and we disclose data if legally required.

Storage and security

Data is stored in the United States. Documents in your vault live in private cloud storage, accessible only through short-lived signed links. State portal credentials, where you provide them, are encrypted with envelope encryption and are never written to logs. Traffic is encrypted in transit.

Retention and your rights

Account and organization data is kept while your account is active and for a reasonable period after, to support re-activation and legal obligations. You can export your documents at any time, and you can ask us to delete your account and its data by emailing support@steadworthy.org. Public-record data about organizations remains in our systems — it is public and not yours or ours to delete.

Children

Steadworthy is a business service; it is not directed to children and we do not knowingly collect data from anyone under 16.

Changes

If this policy changes materially, we will notify account holders by email before the change takes effect. The date at the top is the date of the current version.