Privacy Policy

1. Who we are

1.1This Privacy Policy explains how HookPilot Inc. ("HookPilot", "we", "us" or "our"), with its office at 100 Harrison Garden Blvd, Toronto, Ontario, collects, uses, discloses and protects personal information through our website at hookpilot.ca and its subdomains (the "Website") and our donor analytics platform, dashboards, reports, exports and related emails (the "Platform", and together the "Services").

1.2This policy should be read with our Terms of Use.

1.3We comply with applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Quebec's Act respecting the protection of personal information in the private sector.

2. Two roles: when we decide, and when our clients decide

2.1Information about you. When you visit our Website, contact us, apply to a program, subscribe to updates or use a HookPilot account, we decide how your personal information is used. This policy explains how.

2.2Donor data uploaded by our clients. When a nonprofit, charity, foundation, faith community or consultant (a "Client") uploads donor and gift records to the Platform ("Client Data"), the Client decides why and how that data is processed. We act as the Client's service provider and process Client Data only to provide the Services to that Client, under our agreement with them.

2.3If you are a donor to one of our Clients and have questions about your information, please contact that organization directly. We will help our Clients respond to your requests.

3. Information we collect

3.1 Information you give us

(a)Contact and enquiry forms: name, role or title, organization name, work email, phone number (optional), province or country, and your message.

(b)Sign-up and founding partner applications: the details above plus organization type, approximate number of donors, the CRM or donor system you use, years of gift history available, and your answers to our questions.

(c)Newsletter and updates: your email address and your consent choice.

(d)Accounts: your name, work email, organization and assigned role (for example Client, Client Admin, Analyst or Reviewer).

(e)Communications: the content of emails, calls, meetings and feedback you share with us.

3.2 Client Data uploaded to the Platform

(a)The Platform is designed to work with donor identifiers and giving history, not donor names or contact details. Client Data typically includes: donor or giving-unit ID, gift date, gift amount, gift type, fund, campaign, appeal, donor type, acquisition source, first gift date, a shortened postal code prefix, interaction dates and types, and flags such as deceased, estate or do-not-contact.

(b)Before upload, our upload process is designed to remove names, email addresses, street addresses, phone numbers, free-text notes and full postal codes in the user's browser, so this information is not sent to us.

(c)Clients must not intentionally upload information that is not needed for the Services. Our Terms of Use describe this in more detail.

(d)Although donor IDs are not names, Client Data can still relate to identifiable individuals when combined with the Client's own records, so we treat it as personal information and protect it accordingly.

(e)Some Clients, such as faith communities, may hold data that could reveal sensitive information about donors (for example, religious affiliation). We treat all Client Data as sensitive.

3.3 Information collected automatically

(a)Technical data: IP address, browser type, device type, operating system, pages visited, referring page, and date and time of visits.

(b)Security and audit logs: sign-in events, account actions, approvals, edits and releases within the Platform, with the user and time.

(c)Cookies and similar technologies: see section 9.

3.4 Information from others

We may receive your contact details from a colleague who adds you as a user, from a consultant who introduces your organization, or from public sources such as an organization's website or charity registry listing, when we are reaching out about our Services.

4. How we use information

We use personal information to:

(a)provide, operate and maintain the Website and Platform, including signing you in with one-time codes;

(b)process uploads, calculate reports, prepare donor priority lists and 90-day action plans for the Client that uploaded the data;

(c)draft explanations of calculated results with the help of an artificial intelligence provider, and have them reviewed by a person before release (see section 6);

(d)respond to enquiries, applications and support requests;

(e)send service messages such as sign-in codes, report and plan notifications, and security or policy notices;

(f)send newsletters and marketing emails, only with your consent;

(g)assess and administer applications to programs such as our Founding Partner Program;

(h)secure the Services, prevent misuse and investigate incidents;

(i)improve the Services, using aggregated or de-identified information where possible;

(j)comply with legal obligations and enforce our agreements.

We do not use Client Data to train artificial intelligence models, and we do not use one Client's data to provide services to another Client.

Back to top

5. Consent

5.1We collect, use and disclose personal information about you with your consent, which may be express (for example, ticking a box to receive our newsletter) or implied where appropriate (for example, using your email address to reply to your enquiry), except where the law allows otherwise.

5.2Clients are responsible for having the consent or other lawful authority needed to share Client Data with us for the Services.

5.3You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us at hello@hookpilot.ca or using the unsubscribe link in our emails. Withdrawing consent may mean we cannot provide some Services.

6. Artificial intelligence and automated processing

6.1The Platform uses defined rules to calculate fundraising measures and to place donors into priority groups (for example, overdue loyal donors or lapsed donors). These results support decisions by our Clients; they do not make decisions about individuals on their own.

6.2To draft plain-language explanations, we send calculated figures and anonymized donor IDs to our artificial intelligence provider. We do not send donor names or contact details.

6.3Every explanation is reviewed by a person before it is released to the Client, and the Client decides what action to take.

6.4If you would like to know more about how a result was produced, contact our Privacy Officer.

7. How we share information

7.1We do not sell or rent personal information.

7.2We share personal information only as follows:

(a)Service providers who help us run the Services, under contracts that require them to protect it and use it only for our instructions. These include providers of: website building and hosting (Wix, wix.com); cloud infrastructure and data storage (Amazon Web Services, region: Ontario); email delivery (GoDaddy, godaddy.com); artificial intelligence for drafting explanations (Anthropic); and website analytics (Google).

(b)Reviewers who help produce reports, who are bound by confidentiality obligations.

(c)Within a Client organization, according to the roles that organization assigns to its users.

(d)Professional advisors, such as lawyers and accountants, under duties of confidentiality.

(e)In a merger, acquisition or sale of all or part of our business, subject to protections at least equivalent to this policy.

(f)Where required or permitted by law, including to respond to lawful requests from authorities, or to protect the rights, safety or property of HookPilot, our Clients or others.

8. Where information is processed

8.1HookPilot is based in Ontario, Canada. Some of our service providers, including our artificial intelligence provider, may store or process personal information outside Canada, including in the United States.

8.2When information is outside Canada it is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities.

8.3We assess providers before using them, limit what they receive to what they need, and require contractual protections.

Back to top

9. Cookies and similar technologies

9.1We use cookies and similar technologies that are necessary to run the Website and Platform, such as keeping you signed in and remembering your preferences.

9.2We do not use advertising or tracking cookies.

9.3You can also block or delete cookies in your browser settings. Blocking necessary cookies may stop parts of the Services from working.

10. How long we keep information

10.1We keep personal information only as long as needed for the purposes in this policy or as required by law.

10.2As a guide:

(a)Enquiries and applications that do not become a client relationship: up to 12 months after our last contact.

(b)Account information: for as long as the account is active, then up to [12] months.

(c)Client Data: for the term of the Client's agreement. On termination, the Client may request deletion and we delete it within 30 days, except where the law requires us to keep it, and except for routine backups, which are overwritten within 90 days.

(d)Released reports, approvals and audit logs: for the term of the Client's agreement plus 12 months, to keep an accurate record of what was released.

(e)Newsletter subscribers: until you unsubscribe.

10.3When information is no longer needed, we securely delete it or make it anonymous.

11. How we protect information

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:

(a)removing names and contact details in the browser before upload;

(b)separating each Client's data so it is visible only to that Client's authorized users;

(c)role-based access within the Platform;

(d)sign-in with one-time codes sent by email;

(e)encryption of data in transit;

(f)an audit trail of approvals, edits and releases;

(g)limiting staff and reviewer access to what they need, under confidentiality obligations.

No method of transmission or storage is completely secure, but we work to protect your information and review our safeguards regularly.

12. Privacy breaches

If a breach of security safeguards involving personal information under our control creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and, where applicable, the Commission d'accès à l'information du Québec) as required by law, and keep a record of the breach. If a breach affects Client Data, we will notify the affected Client without undue delay and help them meet their own obligations.

Back to top

13. Your rights

13.1Subject to the law, you can ask us to:

(a)tell you what personal information we hold about you and how it has been used and shared;

(b)give you access to it;

(c)correct it if it is inaccurate or incomplete;

(d)delete it or stop using it, where we no longer need it or you withdraw consent;

(e)explain how an automated result about you was produced (see section 6).

13.2To make a request, contact our Privacy Officer at hello@hookpilot.ca. We may need to verify your identity. We respond within 30 days, or tell you if we need more time as the law allows.

13.3If your information is part of Client Data, we will forward your request to the Client and help them respond.

13.4If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).

14. Children

Our Services are intended for organizations and adults. We do not knowingly collect personal information from anyone under 18 through the Website or accounts. If you believe a minor has given us personal information, contact us and we will delete it.

15. Visitors outside Canada

Our Services are designed for Canadian organizations. If you access them from another country, your information will be processed as described in this policy. If we provide Services to organizations in other countries, additional terms may apply under our agreement with them and the laws of their country.

16. Links to other websites

The Website may link to other websites. We are not responsible for their privacy practices. Please read their privacy policies.

Back to top

17. Email marketing

We send marketing emails only with your consent, in line with Canada's Anti-Spam Legislation (CASL). Every marketing email includes an unsubscribe link and our contact details. Service emails, such as sign-in codes and report notifications, are part of the Services and are not marketing.

18. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "Last updated" date, and for material changes we will notify account holders by email or in the Platform before they take effect.

19. Contact our Privacy Officer

Our Privacy Officer is responsible for our compliance with this policy.

Nicole Hayward, Privacy Officer

HookPilot Inc.

100 Harrison Garden Blvd, Toronto, Ontario

Email: hello@hookpilot.ca

Back to top