Privacy Policy

Neighborhood Harvest ("we," "us," or "our") is a California nonprofit corporation committed to protecting your privacy. This Privacy Policy describes how we collect, use, and disclose personal information when you visit neighborhood-harvest.org (the "Site"). This policy has been prepared in accordance with the California Online Privacy Protection Act (CalOPPA, Cal. Bus. & Prof. Code §§ 22575–22579).

1. Information We Collect

We may collect the following categories of personally identifiable information ("PII") when you interact with our Site:

• Contact information: full name, email address, phone number, and mailing address, when you donate.
• Contact form: when you send us a message through our contact form, we collect your name, email address, an optional subject line, and your message. We use this information to respond to your inquiry.
• Mailing list subscription: first name, last name (both optional), and email address, when you sign up for our newsletter or mailing list through the Site.
• Payment information: if you make a donation or purchase online, payment details (such as credit or debit card information) are collected and processed directly by our payment processor (Stripe). We do not store full payment card numbers on our servers.
• Monthly donations: if you set up a monthly gift, Stripe stores your card and charges it each month. We keep your name, email address, the monthly amount, whether the gift is active, and a record of each payment, so we can email you a tax receipt for every payment, tell you if a payment fails, and send you a private link to change or stop your gift. These records stay with our donation records after a gift ends, for tax and accounting purposes.
• Shop orders: if you place an order through our online shop, we collect your name, email address, phone number, billing address, and shipping address, along with the items ordered and order total, so we can process, fulfil, and ship your order and communicate with you about it.
• Youth Harvest Crew applications: applicant and (where applicable) parent or guardian contact details, age, school, areas of interest, availability, and any additional information you provide. This information is collected through a form embedded from JotForm and is processed by JotForm on our behalf.
• Event and vendor registration forms: when you register through one of our event forms (such as the Bigfoot Bowl Bash vendor registration), we collect your business name, contact name, email address, phone number, website and social media links, a description of what you plan to sell, any files you choose to upload (such as a logo), and an electronic signature you draw to accept the event terms. If you register as a paid vendor, payment is handled by our payment processor (Stripe) as described below.
• Volunteer interest and waiver forms: when you sign up to volunteer through our Volunteer Interest & Waiver form, we collect your first and last name, full address, email address, phone number, the types of volunteering and times you are interested in, the areas you are willing to travel to, any comments you share, and an electronic signature you draw to accept our volunteer participation and assumption of risk waiver. We use this information to match you with volunteer opportunities and to contact you about them.
• Property gleaning agreements: when a property owner signs our Private Property Gleaning Agreement/Waiver, we collect the property owner's name, the harvest site or property address, email address, phone number, details about the property, what you would like harvested and the days that suit you (both optional), and an electronic signature you draw to accept the agreement and liability waiver. We use this information to contact you, schedule and carry out harvest visits, and keep a record of your agreement. We may also add your name, address, phone number, email address, and the notes you gave us to our donor records, where we log what is harvested from your property.
• Calendar model releases: when you sign our Harvest Calendar Model Release, we collect your full legal name, the name you go by (optional), email address, phone number, your Instagram handle (optional), how you would like to be credited, anything you tell us about your comfort and boundaries (optional), your confirmation that you are 18 or older, and an electronic signature you draw to accept the release. We use this information to organize the photo shoot, share your photos with you, credit you the way you chose, and keep a record of your release.
• Technical information: IP address, browser type and version, operating system, referring URLs, and pages visited, collected automatically through server logs and analytics tools when you visit the Site.
• Cookies and similar technologies: see Section 7 (Cookies) below.

2. How We Use Your Information

We use the information we collect to:

• Respond to your inquiries and volunteer sign-up requests.
• Process event and vendor registrations, confirm your registration by email, share event and setup details, feature registered vendors in event marketing and social posts, and keep a record of your acceptance of the event terms (including your electronic signature).
• Process donations and send donation receipts.
• Process, fulfil, and ship shop orders, send order confirmations and shipping notifications (including tracking information), and handle returns or refunds.
• Send administrative communications related to your interaction with us (e.g., confirmation emails).
• Send newsletter and mailing list emails (seasonal updates, harvest news, event announcements, and community information) to subscribers who have opted in. You may unsubscribe at any time via the link in any email we send.
• Improve the Site's content and user experience.
• Comply with legal obligations.

We do not sell, trade, or rent your PII to third parties for their marketing purposes.

3. Disclosure to Third Parties

We may share your information with trusted third parties only as necessary to operate the Site and our programs:

• Stripe: our online payment processor for donations (one-time and monthly) and shop purchases. Stripe collects and processes payment card data directly, keeps the card on file for a monthly gift, and hosts the page where you update that card or stop the gift. For shop orders it collects your billing and shipping address as part of secure checkout. See Stripe's privacy policy at stripe.com/privacy.
• Cloudflare: provides content delivery and DDoS protection for the Site. Cloudflare may process request metadata including IP addresses. See cloudflare.com/privacypolicy.
• Email service providers: we use SMTP-based services to send transactional emails (such as form confirmations). For our mailing list, we use Mailjet to manage newsletter subscribers and send email campaigns. Your email address and name are shared with Mailjet solely to deliver emails and manage your subscription preferences. See Mailjet's privacy policy at mailjet.com/legal/privacy-policy.
• JotForm: we embed a JotForm-hosted application form on our Youth Harvest Crew page. Information you submit through that form (including any applicant and parent or guardian contact details) is transmitted to and stored by JotForm, which acts as our data processor for those submissions. See JotForm's privacy policy at jotform.com/privacy.
• Staff messaging tools: to keep up with new submissions, our staff may connect a private team chat space (such as Google Chat, Slack, or Microsoft Teams) that receives a short internal alert when someone contacts us, donates, places a shop order, joins the mailing list, or submits a form. The alert includes your name and, depending on what you sent, your email address or the amount of a donation or order. These messages go only to a private space for our staff, and the chat provider processes them the way it processes any other message in that space. We do not use these tools for marketing.
• AI assistant for our administrators: our administrators can use an AI assistant inside our private staff tool to look up and update our records, for example to finish the harvest details a grant asks for. Before anything is sent to the AI service (currently Anthropic), names, email addresses, phone numbers and street addresses are removed and replaced with placeholders, so the service sees the work (crops, weights, dates, towns) rather than who you are. The assistant cannot change a record on its own: a staff member approves every change. Its conversations are deleted after 30 days. Automatic removal is a strong safeguard but not a perfect one, which is why we also limit the assistant to administrators.
• AI apps our staff connect: our editors and administrators can connect an AI app of their own (such as Claude, from Anthropic) to our private staff tool, to ask questions about our records in their own words. The app reads only what that staff member could read themselves, under their account with the app's provider. Unlike the assistant above, names are not replaced with placeholders, because the staff member reads the answers directly; email addresses, phone numbers and street addresses are hidden unless the staff member chooses to share them. The app cannot change a record: any change it suggests waits until an administrator approves it. Staff can disconnect an app at any time, and an administrator can disconnect anyone's.
• Analytics services: the Site may use third-party analytics tools that collect aggregated usage data (such as page views and traffic sources). These tools may use cookies or similar technologies. See Section 7 for details.

We do not share your PII with government entities except as required by law or valid legal process.

4. Do Not Track (DNT) Disclosure

Our Site does not currently respond to Do Not Track signals sent by your browser. CalOPPA requires us to disclose our DNT policy, but does not require us to honor DNT signals. We are committed to transparency about our data practices as described in this policy.

5. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this policy or as required by applicable law. Volunteer inquiry records are retained for up to three years. Volunteer records, including harvest sign-ups and signed participation agreements, are retained while you volunteer with us and for up to three years after your last volunteer activity. You can ask us to remove your volunteer record at any time. Donation records may be retained for up to seven years for tax and accounting purposes.

Mailing list subscriber records are retained for as long as you remain subscribed. If you unsubscribe, your record is marked inactive and may be retained for up to one year to honor re-subscribe requests and maintain unsubscribe history, after which it may be deleted.

6. Your Rights: Reviewing and Correcting Your Information

You may contact us to request access to, correction of, or deletion of personal information we hold about you. We will respond to reasonable requests within 30 days. To submit a request, contact us using the information in Section 9 below.

Note: The California Consumer Privacy Act (CCPA/CPRA) does not apply to nonprofit organizations. However, we are committed to honoring reasonable privacy requests as a matter of good practice.

7. Cookies and Tracking Technologies

Our Site uses cookies and similar technologies. A cookie is a small text file stored on your device when you visit a website.

We use the following types of cookies and tracking technologies:

• Essential cookies: required for the Site to function correctly, including session management and security features.
• Stripe: if you initiate a donation or a shop purchase, Stripe may set cookies on our Site for fraud prevention and payment processing purposes.
• JotForm: when you visit the Youth Harvest Crew page, the embedded JotForm iframe may set cookies or use browser storage for form functionality, anti-spam, and analytics on JotForm's behalf.
• Analytics cookies: we may use analytics tools (such as traffic analytics provided by Cloudflare) that collect aggregated, anonymized information about how visitors use the Site. These tools may use cookies or browser storage technologies.

You can control cookie settings through your browser's privacy settings. Note that disabling certain cookies may affect the functionality of the Site.

This Site does not currently use Meta Pixel, Google Analytics, or other advertising-based tracking technologies. If we add such technologies in the future, we will update this policy.

8. Children's Privacy

This Site is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at the address below and we will promptly delete the information.

9. Security

We implement reasonable technical and organizational measures to protect your personal information from unauthorized access, disclosure, or loss. However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the Effective Date at the top of this page. We encourage you to review this policy periodically. Continued use of the Site after any changes constitutes your acceptance of the revised policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us: