How we handle your data
Nonprofit leaders worry most about what happens to their data, not about what AI can do. So data handling is part of every diagnostic, and these rules apply to everything we do.
Our research is public data only
- Before you hire us, we look only at organization-level public records: IRS Form 990 filings, your own website and reports, public grant records and news.
- We never collect donor names, wealth screening data, giving capacity, political contribution data, client or participant details, home addresses, dates of birth, personal phone numbers or personal emails.
- Leaders' names appear only as filed in public records or on your own pages, in their professional role.
When we work inside your systems
- Minimum necessary access, read-only wherever possible.
- A written data-handling acknowledgment at the start of every diagnostic.
- Nothing sensitive goes into public or consumer AI tools.
- We tell you which AI providers process any of your data, and whether they use it for training.
- If you handle health information, we sign a business associate agreement before we touch it.
- At the end of the engagement, your data is returned or deleted.
- Credentials live in a secrets manager, never in documents or email.
How we use AI
- AI is used only where it is safe and measurably saves staff time.
- Every AI feature we build has human review built in.
- For Texas clients, every AI system we deploy comes with a written description of its intended use and its limits.
How we contact people
- Every email identifies who is writing and includes our postal address and a working opt-out.
- One reply of "no thanks" or "unsubscribe" stops all contact, permanently, the same day.
- We never automate LinkedIn and never send bulk sequences.
- We contact the top of the organization only: the CEO or Executive Director, and the board chair.
Standards we follow: the Apra and AFP standards for fundraising ethics, and the CAN-SPAM Act.