Effective November 10, 2026 · ArcAngel CRM,
a product of ArcAngel Technical Services, LLC
ArcAngel CRM (“ArcAngel CRM,” “we,” “us,” or “our”), a
product of ArcAngel Technical Services, LLC, provides case-management and
recordkeeping software (the “Service”) to non-profit organizations that run
programs — transitional and emergency housing, recovery residences, food and
clothing assistance, case management, workforce and education programs, and
similar work. The Service holds detailed records about people in difficult
circumstances, including children. This Privacy Policy explains what we
collect, how we use and protect it, and what rights participants and
organizations have.
In short: we collect only what is needed to run an Organization’s programs,
we never sell it, rent it, or use it for advertising, we
encrypt sensitive fields and every uploaded document, we keep each
Organization’s data isolated from every other Organization’s, and the
Organization stays in control of its records at all times. The sections below
give the detail, including what we do not yet do.
1. Our role: we work on the organization’s behalf
For every customer, ArcAngel CRM acts as a service provider
(a “processor”) handling information at the direction of, and under the
control of, the non-profit that operates the account (the
“Organization”). The Organization decides what information is
collected, from whom, why, and for how long. We do not make those decisions,
and we do not use the information for any purpose of our own.
People who receive services from an Organization are referred to here as
“Participants.” If you are a Participant and have a question
about your record, the Organization serving you is the right place to start;
Section 9 explains what to do if that is not possible.
2. Information we collect
Account information — for staff, volunteers, donors and
Participants who sign in: name and email address, a securely hashed
password, the Organization they belong to, and the role(s) they hold. A
donor may make their own account where an Organization allows it; nothing is
made until they confirm it from a link sent to that email, and they may
remove it at any time, after which the Organization keeps the record of
their gifts, which its books and receipts rest on.
Sign-up information — when an Organization signs itself
up, the person doing it gives their name and email, and the Organization's
name, EIN, web address, type, time zone and total annual revenue, with a note
if the revenue differs from its latest Form 990. Until the account exists, the
person's name and email are encrypted under our own key. A sign-up that isn't
finished is deleted 7 days after it was started (21 days while a bank payment
clears). Once it is paid, the person's name and email move to their account
invitation and are removed from the sign-up, which keeps only the
Organization's own facts, for the life of the account. If the EIN isn't in
ProPublica's data, the proof of nonprofit status the Organization sends is
encrypted under our key, seen only by ArcAngel staff, and deleted once
reviewed, or when the account is erased.
Participant records the Organization enters — depending
on the programs it runs, this may include names and preferred names, dates
of birth, contact details, household composition and relationships,
demographic information collected for funder reporting (such as race,
ethnicity, gender, veteran status, and disability status), program entry and
exit dates and destinations, housing assignments, income and benefits,
service events such as meals or nights of shelter, case notes and goals,
appointments, referrals, and incidents.
Uploaded documents — files an Organization attaches to a
record, such as identification, birth certificates, leases, program
agreements, court documents, or medical records. These may contain
information we do not ask for and do not index, including Social
Security numbers. See Section 7. Pictures of pay stubs and receipts
are read automatically, on ArcAngel's own servers and never by an outside
service, to suggest what to fill in: on a pay stub, the dates, hours and
amounts the form asks for, and the employer's name, to match it to the right
job; on a receipt, the date, the total and where it is from. A person checks
them before they count. The text read from the picture is not kept, and
nothing else on it is used.
Donor records, if an Organization keeps them — the
names, contact details and mailing addresses of the people and
organizations who give to it, how they are related to one another, how
they wish to be contacted and named in public, what they gave or promised
(amounts, dates, check numbers or references, and what an in-kind gift
was), their memberships and what paid for them, the thank-you letters,
statements, renewal reminders and appeal letters sent to them, notes on
conversations, follow-up tasks, and any other details the Organization
chooses to record about them in fields of its own, and the descriptions
of groups of its donors it saves to reach them, and the gifts it hopes to
ask them for (what, how much, by when, and why one did not come); and, for a gift given in honor or in
memory of somebody, that person's name and the names, email and mailing
addresses of the people the donor asks to be told of it, with the notices
sent to them. Donor records are kept separate from the records of the
people the Organization serves and are never joined to them. When the
Organization merges two records of one donor, the record merged away and
the details the merge replaced are kept, sealed, so the merge can be
undone, and are shown nowhere else. A donor with an account sees their own
record, gifts, receipts and statements, and may correct their own details
and preferences; the Organization is told which details they changed.
Event registrations, if an Organization runs events —
who bought tickets, which and how many, and what they paid; the names of
their guests and each guest's meal choice; and anything the buyer tells the
Organization about a guest's needs, such as allergies or access, and their
answers to the Organization's own questions; where guests are seated, their
table and who the buyer would like to sit with. Those needs, answers and
seating wishes are seen only by the Organization's event staff and are
deleted 30 days after the event. A purchase that is never paid for is deleted, with its guests'
names, once its payment page expires. Buyers, meaning anyone who purchases
a ticket or other item, become donor records. A buyer, or the
Organization's staff, may also provide a guest's own email address and
phone number; both are optional. A guest whose email is provided also
becomes a donor record, so that their receipts, and news of anything they
bid on or win, go to them rather than to the buyer. We email the guest to
confirm they are registered. That email includes a link they may use to
create an account to see their own purchases and history. No account is
created unless they choose to create one. A guest with no email on file is
kept only as a name on the buyer's purchase. The Organization's event
staff can see a list of everyone connected to an event: those who bought
tickets, attended, sponsored, donated or requested auction items, bid, won,
or bought raffle tickets. Only staff who may also see donor records can see
the email addresses and phone numbers on that list, or download it. Each
download is logged, with who made it and how many people it included.
Holiday wish lists, if an Organization runs an
adopt-a-family or similar program — for each child a family signs up: a
first name, age, gender, clothing sizes, needs and wants, answers to the
Organization's own questions and, only if the program asks, race; and, for
a family signing up on a public page, a family name and a way to reach
them. Someone giving a gift sees only a code and the details the
Organization chooses to show; never a name, an address or race.
Holiday givers, if an Organization runs such a
program — the name, email and phone of someone signing up to adopt (and,
for a group, its name), how many children they would like, and which
children they adopt. They are emailed a private link to see those
children's cards. If the Organization keeps donor records, the giver
becomes one when they first open that link, and may have the gifts they
bring recorded there as an in-kind gift. A giver who books a drop-off time
is emailed a reminder the day before; it names no child. A family may be
told in its portal, or by email, that its gifts are ready to collect, never
what they are. A set time after the program's season closes, its details
are erased; who took part is kept, with the family's or donor's own record
or in a short log the Organization reviews (see the Retention &
Deletion Schedule).
Requests for financial assistance, if an Organization
offers them — what the help is for, how much, what happened, who it would
be paid to and any papers sent with it (a lease, a notice or a bill), and,
on an Organization's public request form, the name, phone or email, zip
code and household size of whoever asks. The Organization's staff screen a
public request before it becomes anything more; one not taken forward is
deleted with its papers a year after it arrived. Someone who asks on the
public form is emailed only that their request arrived and where it stands,
never an amount, a reason or a note. A landlord's or vendor's tax ID, kept for paying them,
is seen only by those who approve assistance.
Visitors, if an Organization keeps a visitor log — a
visitor's name, who or what they came for, the building, when they came and
left, and whether staff checked a photo ID and its kind. The number on an ID
and a picture of it are never kept. A resident may register a guest in
advance, with a code the guest uses at the Organization's lobby tablet.
Visitor records are deleted in line with the Organization's own data
retention settings: after the time it chooses, from 90 days to three years
(one year unless it changes it).
A do-not-admit list, if an Organization keeps one — the
name and other names of a person barred from its property, why (such as a
trespass notice, or a protective, restraining or no-contact order), what
happened, the dates, and a photo. It is encrypted, and only the
Organization's managers, security staff and administrators see it. Staff
signing visitors in see only that a name matches, and the photo. An entry
never shows who a protective, restraining or no-contact order protects,
except on that household's own record, where its case managers see who the
order is against. Entries are deleted in line with the same settings, the
chosen time after they end or are lifted.
Applications — information submitted through an
Organization’s public intake or application form.
Billing information — an Organization’s level, billing
period, price, any discount, storage blocks, and subscription status, and
whether its payments succeeded. The Service's own fees are collected
by Stripe (Section 5). An administrator enters the card or bank
account, and the billing address, on Stripe's own pages, never on ours, so we
never receive or store a card or account number. We send Stripe the
Organization's name, the email address it chooses for invoices, an internal
reference to the Organization, and its plan. Stripe tells us whether each
payment succeeded, when it will try again, and the amount and due date of any
unpaid invoice. We also measure how much storage an Organization's files take
up, in total, for its storage allowance. Donations an Organization takes
online go to its own Stripe account (Section 5), never through our hands.
Technical and audit information — IP address, browser
type, sign-in activity, and a log of actions taken in the Service, such as
who viewed, edited, exported, or downloaded a record.
The public demo — anyone may try the Service at /demo/
without making an account. Its organizations hold only invented records.
What a visitor does there is recorded in the demo's own audit log, and that
log, with everything the visitor entered, is deleted when the demo is rebuilt
each night. The demo sends no email. Please don't enter real information about
anyone in it.
We never require or use a Social Security number. The
Service does not need one to work, and neither ArcAngel CRM nor ArcAngel
Technical Services, LLC asks for one or uses one for any purpose. An
Organization records a person’s number only when its own circumstances call
for it, such as a funder, a benefits program, or a law that applies to it.
Whether you are asked for one is the Organization’s decision, and the
Organization can tell you why it needs it. The public application form never
asks for one. When a number is recorded, it is encrypted under a unique
encryption key dedicated to the Organization, is never searchable, and is never included in an
export. Every screen shows only its last four digits. Seeing the full number
requires a separate permission that no role has by default, and the user must
type a reason each time. Every reveal, and every refused attempt, is recorded
in the audit log along with that reason, which is itself encrypted; the number
is never written to the log. ArcAngel personnel, including during a support
session, can never reveal a full number, and it is never shown to anyone
outside the Organization, including people the Organization gives view-only
access to. An Organization may also upload a document that contains a Social
Security number; those files are encrypted and access-controlled as described
in Section 7.
We do not use advertising or analytics trackers. The Service
sets only the cookies required to keep you signed in and to protect forms
against cross-site request forgery. There are no third-party trackers, no
advertising pixels, and no cross-site profiling.
3. How we use information
We use information only to operate, secure, and support the Service for the
Organization: to maintain records and program enrollments, produce the reports
a funder requires, run staff and participant portals, provide support when the
Organization asks for it, keep the Service secure, and administer billing.
We will never: sell or rent Participant information; use it
for advertising or to build commercial profiles; use it to train machine
learning or artificial intelligence models; or use it for any purpose other
than providing the Service to the Organization, except as the Organization
directs or the law requires.
4. Sensitive categories, and what the law requires of the organization
The Service can hold information that is specially protected. Responsibility
for those rules sits with the Organization, which decides what to record; our
responsibility is to provide controls that make compliance possible and to be
clear about the limits of what we offer today.
Homeless services data (HUD / HMIS). The Service’s
program, enrollment, and exit-destination model follows the shape of the HUD
Homeless Management Information System data standards so that an
Organization can meet Continuum of Care reporting obligations. ArcAngel CRM
is not itself an HMIS implementation and is not a substitute for a
Continuum’s designated HMIS where participation is required.
Health information (HIPAA). ArcAngel CRM is not a HIPAA
covered entity. Most non-profit service programs are not covered entities
either, but some are, or are business associates of one.
We do not currently offer a Business Associate Agreement.
An Organization that is subject to HIPAA should not place protected health
information in the Service until we do.
Substance use disorder records (42 CFR Part 2). Records
from a federally assisted substance use disorder program carry disclosure
restrictions stricter than HIPAA. We do not currently offer a
Qualified Service Organization Agreement, and an Organization
operating such a program should not place Part 2 records in the Service
until we do.
Domestic violence and human trafficking programs.
Victim service providers are subject to the confidentiality requirements of
the Violence Against Women Act, which restrict entering personally
identifying information into shared databases. The Service is built with
tenant isolation and does not share data between Organizations, but
we have not completed a VAWA confidentiality assessment,
and a victim service provider should evaluate the Service against its own
obligations before using it.
These limits are stated plainly because the alternative — a policy that
implies coverage we do not provide — would put an Organization at risk. Each
will be removed from this list only when the corresponding agreement and
controls actually exist.
5. How information is shared
Within the Organization — users see information according
to the roles and page permissions the Organization’s administrator assigns.
An Organization can restrict a page to read-only, or to no access at all,
for a given role.
Observers the Organization chooses — an Organization can
give a person outside it, such as a state office or a funder, a read-only
sign-in that shows only the facts its case managers choose about chosen
families or programs, reports they choose, as totals or for those families
only, and documents they choose to let the observer download. Identity
papers such as Social Security cards, IDs and birth certificates are never
shared with an observer. An observer never sees a full Social Security number
or date of birth; at most the last four digits and the birth year, and only
when chosen. Observers must use two-factor sign-in, their access ends on a
set date, and everything they open is recorded in the Organization’s audit
log. This is the Organization’s own disclosure, made under its own
obligations.
Never between Organizations. One Organization cannot see,
search, reach, or infer the existence of another Organization’s records. A
request for a record belonging to another Organization is answered as though
the record does not exist.
Service providers (sub-processors) — we use a small,
published set of vendors to run the Service:
DigitalOcean — cloud hosting, database, and file
storage. United States, New York City region. Holds all Service data.
Backblaze — an off-site copy of our encrypted
database backups, and of every stored file as we store it: each document
and other upload encrypted under its Organization's own key, and its
logo as published. United States, US West region. It holds them only
encrypted, with a key it does not have, and no more than 90 days.
Cloudflare — DNS, TLS termination, and protection
against attack traffic. Global edge network; processes requests in
transit but does not retain Service data.
Brevo (operated by Sendinblue SAS, France) — sending
transactional email such as password resets and notifications. Receives
a recipient’s email address and the content of that email only. Because
this vendor is in the European Union, those specific messages are
processed outside the United States. The messages are invitations
(including the link a donor uses to confirm an account they asked for),
sign-in and password links, a volunteer's or commercial tenant's own
reminders, and staff notices that name places, work-order numbers and
dates; and, for an Organization that keeps donor records, its thank-you
letters and year-end giving statements to its donors, which state what
the donor gave (a statement as an attached PDF), and notices to the
people a donor names that a gift was made in honor or in memory of
somebody (the amount only when the donor agreed), and reminders to
members that their membership is ending; a volunteer's answer to a shift
they asked for; a resident's or commercial tenant's notice that a work
order they reported is complete (its number and place), or that a weekly
budget was sent back (never its figures or notes); and our own messages to
an Organization about its subscription: the way to set up payment, a
failed payment, a coming read-only date, its storage, that a data export
is ready (never its passphrase), and each step of an erasure. None carries a
record about a Participant, its notes, or a document. See
Section 10.
An Organization’s own mail server, if it sets
one up — the Organization’s invitations, reminders, links,
notices and letters to its donors are then sent through its own email provider, from its own
address, instead of through Brevo. That provider is the
Organization’s choice and works for it, not for us. We connect to
it only over an encrypted connection with a verified certificate, and
never to an address inside a private network. Password resets and
sign-in mail always come through Brevo.
Stripe (Stripe, Inc., United States) — in two roles.
Our own fees: Stripe collects each Organization's subscription
for us, under our agreement with Stripe. It receives the Organization's
name, the email address it chooses for invoices, and its plan; the
administrator gives the card or bank account and billing address to
Stripe directly. No information about a Participant is sent.
An Organization's donations and tickets: only for an
Organization that takes donations or sells event tickets online,
through its own Stripe account. A donor enters card or bank details on
Stripe's own payment page, never on ours, so we never receive or store
a card number. We send Stripe the amount, what the gift or the tickets
are for, and the donor's name and email when they give them; Stripe
tells us the payment succeeded, its amount and fee, the email the donor
gave, and when the Organization refunds it in its Stripe account. The Organization's own
agreement with Stripe governs Stripe's handling.
ProPublica (its Nonprofit Explorer, United States) —
when an organization signs up, the EIN it types is sent to ProPublica's
free public database of nonprofit tax filings, to find the revenue on its
latest Form 990 and suggest its level. Only the EIN is sent: never a
name, an email, or anything about a Participant.
National Weather Service (NOAA, a United States
government agency) — the temperature on a lobby sign, only if an
Organization turns it on. The sign's zip code is turned into a position
on our own servers; the service receives only that position, rounded to
about 10 km. No Participant record is sent to it.
Each may process information only to provide services to us and is bound by
confidentiality and data-protection obligations. We will update this list
before adding a vendor that handles Participant information.
Legal and safety — when required by law, or to protect
the rights, safety, or security of Participants, users, the public, or
ArcAngel CRM. Where we are legally permitted to do so, we will notify the
affected Organization before disclosing its data in response to legal
process, so that it may object.
Business transfers — if ArcAngel Technical Services is
involved in a merger, acquisition, or asset sale, information may transfer
subject to this Policy; we will notify affected Organizations.
We do not sell information, do not share it for anyone’s marketing, and do
not combine one Organization’s data with another’s for any purpose, including
benchmarking or statistics.
6. Access by ArcAngel staff
A small number of ArcAngel Technical Services personnel can access the system
in order to operate and support it. That access is limited to named accounts,
is used only to keep the Service running or to respond to a support request,
and is recorded in the audit log — including the “view as” tool, which lets a
support engineer see the Service exactly as a particular user sees it only
after receiving explicit, time-limited authorization, for no more than 24
hours, from that user or an administrator of their Organization for a
specific support request. The one exception is responding to a security
incident, which needs no authorization and is flagged as such in the
Organization’s audit log.
Individuals have the right to request and receive an accounting of
disclosures of their information made through the electronic record system
for the three years prior to the request date. The
fact that this access exists is disclosed here rather than buried, because an
Organization deciding whether to trust us with its records is entitled to know
who can read them.
What an Organization’s people send us themselves is addressed to us,
and we read it on our own pages without a support session:
feedback through Send feedback, which anyone with an account at
the Organization may send, including its residents, tenants, volunteers
and donors;
requests for help through Help & support, which only its
staff may send.
Both are encrypted using a separate administrative key, are deleted with the
rest of that Organization’s data when its account is erased, and each
time we open one it is recorded in the Organization’s audit log. The
forms ask people not to name anyone. A staff member may also approve, with
their request for help, our viewing their pages for a set window; that access
is a support session, with the protections described above.
7. How we protect information
Our security measures are described in full on the
Security page, which clearly
distinguishes between measures currently in active operation and those
planned for future deployment. In summary:
Encryption in transit — all traffic is served over
HTTPS/TLS, and the connection between our servers and our database is
encrypted as well.
Encryption at rest — names, dates of birth, telephone
numbers, addresses, and the whole of the narrative record — case notes,
incidents, goals and exit assessments — are encrypted field-by-field with
AES-256-GCM before they reach the database, so they are unreadable to
anyone holding raw database access or a stolen backup. Every uploaded
document is encrypted the same way, under a filename that reveals nothing.
Each Organization has its own encryption key, so one
Organization’s records cannot be read with another’s, and destroying that
key makes its data unreadable by anyone, including us. The remainder of the
database is encrypted at the storage layer by our hosting provider.
Statuses, dates and amounts stay readable at the application level for
reporting purposes: they are what the reports your funders require are
counted from, and we implement internal controls to ensure none of them
identifies a person on its own.
Tenant isolation — every record carries the Organization
that owns it, and every lookup is filtered by the Organization of the
signed-in user, so one Organization’s data cannot be reached from another’s
session even by guessing a record’s address.
Role- and capability-based access — users can see only
what their assigned role permits, and an Organization’s administrator
decides which roles may read, write, or not reach each page.
Audit logging — sign-ins, and actions on sensitive
records including viewing, exporting, and downloading, are recorded.
Brute-force protection — repeated failed sign-in attempts
are locked out.
United States hosting for all Service data — see
Section 10.
If we become aware of a confirmed breach affecting an Organization’s data, we
will notify that Organization without undue delay, and in any event within
72 hours of confirming it, with what we know, what we are
doing, and what the Organization may need to do. We will cooperate with any
breach-notification obligations that apply to the Organization.
What we do not promise. No online system can be guaranteed
perfectly secure, and we do not claim to be. We commit to reasonable
administrative, technical, and physical safeguards and to the specific
measures above and on the Security page; we cannot guarantee that data will
never be accessed, altered, or lost despite them. Keeping credentials
confidential and assigning roles carefully remain the Organization’s
responsibility.
8. Data retention and deletion
We retain information for as long as the Organization’s account is active and
as needed to provide the Service. An Organization may correct or delete
records at any time and may export its data at any time, including while its
subscription is inactive.
Retention periods for Participant records are the Organization’s to set:
funders frequently require records to be kept for a period of years, and while
an Organization's subscription is active we do not delete its records on our
own initiative. Three things are erased on a schedule:
a holiday program's season details, on the date the Organization's settings
give, which an administrator can move later; and a request made on an
Organization's public financial-assistance form that was never taken
forward, a year after it arrived; and an Organization's whole account,
one year after it became read-only because its subscription
was cancelled or went unpaid. Before that last one we email its administrators
and billing contact 90 days and 7 days ahead, and paying again stops it. When an
Organization asks for its account to be erased, we complete it within
60 days of its request, except where retention is required by
law. Either way, we confirm in writing when it is done. Encrypted backups are
purged on a rolling schedule of no more than 90 days, after
which deleted data is gone from our systems entirely. The
Retention & Deletion Schedule
gives each period, and an Organization can sign our
Data Processing Addendum.
9. Your rights and choices
Organizations control their data and can access, correct, export, or delete
it through the Service or by contacting us.
Participants may exercise access, correction, and deletion rights
through the Organization serving them, which holds the record
and is the party that can act on it. We will support the Organization in
responding. If you are a Participant and cannot reach the Organization — for
example, because it has closed — contact us at
info@arcangelts.com and we will
do what we can, which may be limited by our role as a processor and by the
Organization’s own retention obligations.
Depending on where you live, you may have additional rights under state
privacy law. We do not sell personal information or share it for cross-context
behavioral advertising, so there is nothing to opt out of in those
categories.
10. Where information is stored
All Service data — the database, uploaded documents, and backups — is stored
in the United States: the New York City region, with the
off-site backup copies in the US West region. The single
exception is outbound transactional email, which is sent through a vendor
located in the European Union and therefore carries the recipient’s email
address and that message’s contents outside the United States; no record
about a Participant, its notes, or a document is in any of them. This is disclosed in
Section 5 and will change if we move email to a United States provider. A
lobby sign's temperature comes from the National Weather Service, in the
United States.
11. Changes to this Policy
We may update this Policy. We will post the updated version with a new
effective date and, for material changes affecting Participant data, notify
Organizations directly before the change takes effect.
12. Contact us
For privacy questions or requests, contact
info@arcangelts.com. To report
a security problem, see the Security
page.
Questions about this document? Contact
info@arcangelts.com.
ArcAngel Technical Services, LLC
