Privacy Policy

This policy describes what Steadworthy (NPK Industries LLC, doing business as Steadworthy) collects, why, and who processes it. The short version: most of what we show you is public record; what you give us stays yours; we sell nothing to anyone.

What we collect

• Public records. IRS publications (Business Master File, Publication 78, revocation lists) and state charity registry records. These are public data about organizations, not personal data — we compile them to power the scan and monitoring.
• Scan queries. The EINs you scan, and the email address you provide if you request a full report.
• Account data. Name, email, and authentication details, handled by our sign-in provider (Clerk).
• Organization profile data. What you enter or upload to prepare filings: officers, financials, fundraising details, and documents you place in your vault.
• Payment data. Handled by Stripe. We never see or store full card numbers.

How we use it

• To run scans and show registration statuses with their sources.
• To prepare, track, and monitor registrations you ask us to manage.
• To send the emails you request: reports, deadline reminders, alerts.
• To send a limited amount of informational outreach to organizations about their public registration standing (see Outreach to organizations, below).
• To operate, secure, and improve the service.

We do not sell personal data, and we do not use your organization's private profile data for advertising.

Outreach to organizations

Separately from the emails you request, Steadworthy sometimes sends a small volume of informational email to a nonprofit organization when its own registration record in a public state charity registry shows a non-current status, offering that organization a free report of its public standing. These messages are about the recipient organization and are sent to a business or role contact address for it, not to consumers.

• Where the contact comes from.The organization is identified from public government records (state charity registries and the IRS Business Master File), matched by EIN. A contact email address is obtained from the organization's own public information or a business contact-lookup provider (listed on our Subprocessors page). We do not buy, rent, or sell contact lists.
• What the message says.It states the registry's own status term and the date we observed it, makes no legal conclusion, and identifies Steadworthy as a private monitoring service that is not a government agency. These emails are sent from a dedicated Steadworthydomain.
• How to stop them. Every message carries a one-click unsubscribe link and honors list-unsubscribe headers; opting out is immediate and permanent across all future contact. Replying also stops automated contact and reaches a person. You can also email support@steadworthy.org to be removed.

We maintain a suppression list of addresses that have unsubscribed, complained, bounced, or asked not to be contacted, and we check it before every send.

Who processes it

We use a small set of infrastructure providers, each listed with its role on our Subprocessors page. Beyond those: we share filing information with state agencies when you direct us to file, and we disclose data if legally required.

Storage and security

Data is stored in the United States. Documents in your vault live in private cloud storage, accessible only through short-lived signed links. State portal credentials, where you provide them, are encrypted with envelope encryption and are never written to logs. Traffic is encrypted in transit.

Retention and your rights

Account and organization data is kept while your account is active and for a reasonable period after, to support re-activation and legal obligations. You can export your documents at any time, and you can ask us to delete your account and its data by emailing support@steadworthy.org. Public-record data about organizations remains in our systems — it is public and not yours or ours to delete.

Children

Steadworthy is a business service; it is not directed to children and we do not knowingly collect data from anyone under 16.

Changes

If this policy changes materially, we will notify account holders by email before the change takes effect. The date at the top is the date of the current version.