Privacy Policy
Updated last month
Last updated: October 3, 2026
1. Information We Collect
We collect information you provide directly to us, such as when you create an account, make a donation, or contact us for support. This includes names, email addresses, payment transaction and processor information, and organizational details.
Organizations that use Gratona may also store donor, sponsorship, recipient or beneficiary, donation, stewardship note, activity log, saved view, saved report, and administrative account information in the Service.
2. How We Use Your Information
We use the information we collect to:
Provide, maintain, and improve our services
Process donations and sponsorship payments
Send transaction confirmations and receipts
Respond to support requests
Protect against fraud and abuse
Power authorized integrations and connected apps that your organization chooses to use
Research and development
Your records remain yours. We do not use personal data to train general-purpose AI models.
We may use, share or license anonymised insights and datasets for research, benchmarking and developing technology, including AI training and evaluation. This information must not identify your organisation or any individual, or reveal your confidential information.
You can opt out of future contributions by contacting support, without affecting your access to Gratona. The Terms of Service explain the anonymisation requirements and how the opt-out works. Google Workspace data is excluded from these optional activities, and restrictions on data from other connected services still apply.
3. Connected Apps and AI Assistants
If your organization enables a connected app, API integration, or AI assistant such as the Gratona ChatGPT or Codex connector, the Service may share Gratona data with that connected service at the request of an authorized admin. The connector is designed to return only data available to the connected admin under that admin's Gratona workspace permissions.
Depending on the admin's request and permissions, connected apps may access donor names, contact details, household or profile fields, giving history, commitments, sponsorship relationships, custom donor fields, recipient or beneficiary profile fields, program membership, sponsorship status, donation records, payment/refund status, saved filters, saved reports, stewardship notes, and activity-log details.
4. Data Security
We use administrative, technical, and organizational safeguards designed to protect personal information. These include HTTPS/TLS for our public services and encryption controls for certain sensitive credentials and stored files. Payment-data handling and PCI responsibilities vary by the payment provider configured by your organization and the checkout flow. Contact us for current security information relevant to your configuration.
5. Data Sharing
We do not sell, rent, or share your personal information with third parties for marketing purposes. We may share data with service providers who assist us in operating the platform, such as payment processors, under the contractual and legal terms that apply to those services.
We may also share data with third-party services that your organization or an authorized admin connects to Gratona, such as payment processors, email tools, reporting tools, or AI assistant connectors. Those services process data according to their own terms and privacy policies.
6. Google Workspace Data
If you connect a Google account to Gratona, we request access only to the Google data needed to provide email and calendar relationship sync.
Depending on the features enabled by your organization, Gratona may access your Google account email address and profile, read Gmail message metadata and message content, send email only when you explicitly initiate a send action in Gratona, read Google Calendar event metadata and event details, and create or update Google Calendar events created from Gratona only after you explicitly schedule or update them in Gratona.
Gratona uses this Google user data to match emails and meetings to existing donor records, display relationship history, support follow-up workflows, and perform staff-initiated email or calendar actions. Gratona does not sell Google user data, use it for advertising, or use it to train generalized AI models.
Google-derived email bodies and calendar descriptions are private by default. Your organization may configure whether metadata or selected content is visible to other authorized staff. Gratona stores OAuth tokens using application encryption controls and does not expose tokens to the frontend.
Gratona retains synced Google-derived data as needed to provide the service, maintain audit and security records, and meet applicable legal obligations. You may disconnect your Google account in Gratona. Gratona handles provider revocation and local credential cleanup according to the connection status and applicable security requirements. You or your organization may request deletion of synced Google-derived data, subject to backup, audit, security, and legal retention requirements.
Gratona's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
7. Privacy Rights
Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to certain processing, or export your personal information. Gratona and your organization may have different responsibilities for a request. Contact us using the method below; we will respond after verifying the request and as required by applicable law.
8. Data Retention
We retain information as needed to provide the service and for legitimate business, legal, security, audit, and contractual purposes. Retention periods vary by data type, backup lifecycle, connected service, and applicable law. You or your organization may request an export or deletion; we will disclose any limits that apply to the request.
9. Cookies
We use essential cookies to maintain sessions and preferences. We may also use measurement technologies to understand use of our public website and improve the service. We do not use those technologies to serve third-party behavioral ads. Browser settings can limit cookies, but some functions may be affected.
10. Contact
For privacy-related inquiries, please use our contact form.