Privacy Policy
Your privacy is important to us. This policy explains how The Chahal Foundation collects, uses, and protects your personal information.
Last updated: July 18, 2026
Introduction
The Chahal Foundation ("we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website at chahalfoundation.org or make a donation to our organization.
The Chahal Foundation is a 501(c)(3) public charity (EIN: 39-5160137).
Information We Collect
Donation Information
- Name and contact information (email, phone, address)
- Payment details (processed securely by Stripe)
- Donation amount, frequency, and designation
- Employer matching information
Form Submissions
- Contact form inquiries
- Volunteer and event registration
- Newsletter update requests and managed subscriptions
- Fundraiser creation details
Advocacy & Participation
- Contact details you choose to enter into a message to an elected official
- Action, target, and action type used for a privacy-minimized participation receipt
- A one-way pseudonymous identifier used to recognize repeat participation
- The Foundation does not store the advocacy message, subject, name, raw email, ZIP code, IP address, or browser user-agent in that receipt
Analytics & Usage Data
- Pages visited and time spent
- Device type, browser, and operating system
- IP address and approximate location
- Referral source and search terms
How We Use Your Information
We use the information we collect for the following purposes:
Advocacy Messages and Action Receipts
When an advocacy tool prepares an email, the message, subject, name, and contact details remain in your own email application for you to review and send. The Foundation does not receive or store that message through the action-receipt endpoint.
If you ask the site to record participation, your email address and ZIP code are processed transiently for validation, abuse prevention, and creation of a pseudonymous receipt. The stored receipt contains the action, target, action type, time, and a one-way keyed identifier. It does not contain your raw email address, ZIP code, name, letter text, subject, IP address, or browser user-agent.
Calling an office or opening a social post may be measured as a consent-dependent, non-identifying website event, but those tools do not create a durable action receipt unless the page clearly says they do.
AI Education & Training and Student Data
When we run AI literacy, coding, mentorship, career-navigation, or student support programs, we may collect information needed to operate those programs, such as participant registration details, school or partner affiliation, mentor matching preferences, attendance, session notes, skills interests, project progress, and outcomes voluntarily reported by participants.
We use this information to provide program access, match students with appropriate mentors, improve curriculum, report aggregate impact, protect participants, and satisfy donor or grant reporting requirements. We do not sell participant data.
If a program involves minors, we use age-appropriate safeguards and collect only the information necessary for participation, safety, communication, and impact reporting. Program partners may have additional consent, school, parent, or guardian processes.
Third-Party Processors for Program Delivery
To deliver labs, interactive learning tools, and program infrastructure, we may engage third-party AI, API, and cloud service providers. We minimize the student data shared with any processor to only what is required for the specific service, and we work with providers whose data practices meet our standards. The categories of processors we may use include:
The specific providers used may change as our programs evolve. We will update this section when we add a materially new category of processor for student data.
Data Retention — Student Program Records
Student program participation data (registration details, attendance, session notes, and progress records) is retained only as long as needed to run the program and meet any applicable legal or grant-reporting obligations. As a default, routine participation records are deleted or anonymized within 24 months of a participant's last activity in a program, unless a longer period is required by law, a funder's reporting terms, or a participant's own request for continued access.
Your Choices — Access, Correction, Deletion & Opt-Out
Any participant — or a parent or guardian acting on behalf of a minor — may request access to, correction of, or deletion of their program data. You may also opt out of having your data processed by any specific AI or cloud tool used in a program. To make any of these requests, please contact us. We will respond within the period required by applicable law. Exercising these rights will not affect your ability to participate in the program where operationally feasible.
Minors & data minimization: We apply heightened care when programs serve participants under 18. We collect only the minimum data necessary, do not share minors' personally identifiable information beyond what is needed for program operation and safety, and do not use student data for advertising or unrelated profiling. These commitments apply regardless of where a participant is located.
Third-Party Services
We use trusted third-party services to help operate our website and process donations. These services may collect data as described below:
Google Analytics 4
Website analytics and traffic analysis
Data collected: Consent-dependent page views without URL query strings, session data, browser and device information, and analytics identifiers
Microsoft Clarity
User experience analysis through heatmaps and session recordings
Data collected: Clicks, scrolling, and session-replay data subject to Clarity masking and site configuration
Google Ads
Advertising visit and donation-conversion measurement after marketing consent
Data collected: Consent-dependent ad click identifiers and verified donation conversion details such as transaction reference, amount, currency, campaign, and recurring status; the current website does not send donor email, phone, or name to Google Ads
Stripe
Secure payment processing for donations
Data collected: Payment card information (we never see your full card number)
Brevo (Sendinblue)
Email communications and newsletters
Data collected: Email address, name, communication preferences, email engagement
Google reCAPTCHA
Bot prevention and form security
Data collected: Device and browser information for security verification
Cookies
We use required browser storage for requested features and security. With your consent, we also use cookies and similar technologies for analytics and Google Ads conversion measurement.
Google tags initialize with analytics and advertising storage denied. Depending on browser and provider behavior, limited cookieless consent-status or measurement signals may be sent before you make a choice. The site sends page-view events only after analytics consent and sends Google Ads donation conversions only after marketing consent. Page telemetry excludes URL query strings.
You can change optional categories through Cookie Preferences in the footer or through your browser settings. Disabling required storage may affect forms, payments, consent settings, or other requested functionality.
View our full Cookie PolicyYour Privacy Rights
European Union (GDPR)
If European data-protection law applies to your information, your rights may include:
- Right to access your personal data
- Right to rectification of inaccurate data
- Right to erasure ("right to be forgotten")
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to withdraw consent
California (CCPA/CPRA)
If California privacy law applies to your information, your rights may include:
- Right to know what personal information is collected
- Right to know if personal information is sold or disclosed
- Right to say no to the sale of personal information
- Right to delete personal information
- Right to non-discrimination for exercising rights
- Right to correct inaccurate personal information
- Right to limit use of sensitive personal information
Note: The Chahal Foundation does not sell your personal information. We only share data with third-party service providers as necessary to operate our organization and fulfill our mission.
Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.
Retention approach:
- Donation and accounting records: retained according to applicable tax, accounting, fraud-prevention, and legal requirements
- Contact form submissions: retained as needed to respond, maintain appropriate records, and prevent abuse
- Newsletter update requests: retained only as needed to review and process the request; if an address is added to a managed communications list, it remains subject to the list's suppression, unsubscribe, and applicable record-retention requirements
- Analytics data: retained according to the configured provider settings and your consent choices
- Advocacy action receipts: limited to pseudonymous participation records and retained only as needed for aggregate program reporting, abuse prevention, and applicable legal obligations
Data Security
We implement appropriate technical and organizational security measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. The measures used by this website include:
- Encrypted HTTPS connections for website traffic
- Payment-card handling through Stripe rather than Foundation-hosted card storage
- Access controls for administrative tools and service credentials
- Form-abuse and automated-submission protections
No internet transmission or storage system can be guaranteed completely secure.
Children's Privacy
Our website is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly. If you believe we may have collected information from a child under 13, please contact us.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically for any changes.
Contact Us About Privacy
If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how we handle your data, please contact us.
Privacy Requests
Use the privacy contact formOrganization
The Chahal Foundation
EIN: 39-5160137