The Global Fund for Innovation and Resilience (“GFIR,” “we,” “us” or “our”) is a U.S. 501(c)(3) public charity (EIN 42-2623380) based at 5503 Wilma St, Torrance, CA 90503. We help families in developing countries prepare for, respond to and recover from climate-driven disasters with mobile early warning alerts and emergency cash assistance.
This Privacy Policy explains how we collect, use, share and protect information when you:
- visit our website at gfir.org (the “Website”);
- make a donation;
- contact us; or
- use the GFIR mobile app and related services, including household registration, disaster alerts, the GFIR wallet and emergency cash assistance (the “App”).
Together, these are the “Services.” This policy also applies to families who are registered for the Services by a local agent on their behalf.
1. Summary
- We do not sell your personal information, and we do not use it for targeted advertising.
- The Website uses Google Analytics to understand how visitors use it. Where the law requires it, we ask for your consent first.
- Donations are processed by Stripe. We never see or store your full card number.
- The App collects what we need to register a household, send disaster alerts and deliver cash assistance: contact details, basic household information, a one-time location check and a palm biometric credential.
- The App checks your location once, when you tap the button during registration. It does not track you in the background.
- You can delete your account in the App at any time, and you can ask to see, correct or get a copy of your information by writing to privacy@gfir.org.
2. Information we collect
2.1 When you visit the Website
- Usage and device information. We use Google Analytics to collect information such as the pages you view, how long you stay, the site that referred you, your browser and device type, operating system, screen size, and approximate location (city or country, based on your IP address). Google Analytics uses cookies and similar identifiers (for example, cookies named _ga). Where the law requires consent, these cookies are set only if you accept them. See Section 6.
- Fonts. The Website loads fonts from Google Fonts. When it does, your browser sends your IP address and browser information to Google.
- Server logs. Our website hosting provider automatically records technical information such as IP address, date and time, pages requested and browser type, for security and reliability.
You do not need an account to use the Website.
2.2 When you donate
Donations are completed on secure payment pages hosted by our payment processor, Stripe, Inc. On those pages, you give your name, email address, payment details and billing information directly to Stripe. Stripe processes the payment and emails you a receipt.
From Stripe, we receive your name, email address, the amount and date of your gift, payment status, limited payment details (such as card brand, last four digits and country), and the purpose your gift is designated for (for example, “where needed most”). We do not receive or store full card numbers or security codes. Stripe handles your payment information under its own privacy policy at stripe.com/privacy.
2.3 When you contact us
If you use our contact form or email us (for example, at hello@gfir.org or partners@gfir.org), we collect your first and last name, email address, organization (optional), the topic you choose, your message, and anything else you decide to share. Contact form messages are delivered to us through our email service provider.
2.4 When you use the GFIR App
Account information
- Your email address, full name and, if you provide it, your phone number.
- Your password. We store it only as a salted, one-way hash. We never store it in readable form.
- Your member ID. We assign this automatically; it is made from your initials and random characters. You use it to sign in and to send or receive payments.
- Your date of birth, so we can confirm you are old enough to have an account.
- Your account role and verification level (for example, whether your email or palm has been verified).
- A record of your choices: when you accepted our Terms of Service and this Privacy Policy (and which versions), and when you gave or withdrew consent for location and palm biometrics.
Google Sign-In. If you choose to sign in with Google, Google sends us your email address, whether it is verified, and your name. We never receive your Google password.
Verification codes. We email one-time codes to verify your email address, to let you sign in and to reset your password.
Household registration. You enter this information yourself, or a local agent enters it on your behalf with your permission:
- name, date of birth and gender;
- household size, and the number of children under 18 and adults aged 60 or older in the household. We record only these numbers. We do not collect the names or other details of other household members;
- phone number, mailing address (street, city, state or province, postal code), country and region;
- notes added by the registering agent.
Location. During registration, if you tap “Use my current location,” the App asks for your permission and then takes a single GPS reading: latitude, longitude and accuracy. We use it to confirm that the country you are in matches the address you entered. We store the reading with your household record and use it to tell whether a disaster may affect your home. The App does not track your location continuously and never collects it in the background. Before the reading, we ask for your agreement on screen, and your device also asks for permission. You can refuse. If you do, we can’t verify your location, and Services that depend on it, such as location-based alerts and cash assistance, may not be available to you.
Biometric information (palm). To stop the same person from registering twice, and to protect your account and money, we may ask you to scan your palm when you register. We may also ask before sensitive actions, such as signing in, confirming a payment or withdrawal, or joining an organization. The scan is turned into a digital template. We store only a one-way cryptographic code (a “hash”) made from that template and your registration details. We do not store an image of your palm. We compare this code with stored codes to confirm it’s you and to check that no one is registered twice. Palm scanning uses technology from a biometric provider that processes the scan only on our behalf.
- Consent first. Before your first palm scan, we explain what is collected and why, and ask for your consent. If an agent registers you, the agent must explain this to you and get your consent.
- Limited use. We use your palm credential only to confirm your identity and prevent duplicate registrations. We never sell it, never use it for advertising, and never share it except with the provider that processes it for us or when the law requires it.
- Your control. You can withdraw your consent and ask us to delete your palm credential at any time. If you do, you will need to use another way to sign in and confirm transactions, if one is available.
- Deletion. We delete your palm credential when you delete your account, when you withdraw consent, or after 3 years without use, whichever comes first.
Wallet and transaction information
- your wallet balance;
- money you send and receive: amount, sender and recipient member IDs, any note (memo), date, status and whether it was confirmed with your palm;
- money requests you send or receive;
- deposit and withdrawal requests: partner bank, amount and, for withdrawals, the last four digits of the routing and account numbers you provide;
- emergency cash assistance paid to you.
Alerts. We collect the regions you choose to follow (stored by region name only, not GPS), the alerts sent to you, and what you do with them (for example, marking an alert as seen).
Relief eligibility. We record our assessments of whether a registered household qualifies for cash assistance during a disaster (see Section 4).
Local agents and organizations. If you register as a local agent, we collect your organization’s name, your job title, your organization email address (we send it a code to confirm you work there) and your phone number. We also record your organization memberships, roles and invitations.
Device and technical information
- The App keeps your sign-in token in your device’s secure storage (iOS Keychain or Android encrypted storage).
- Our servers keep technical logs, such as request times and errors, for security and troubleshooting.
- The App loads maps from Mapbox or OpenStreetMap. These services receive your IP address and the map area you are viewing.
- Notifications. If you allow notifications, your device gives us a push token. We use it to send you alerts through Apple Push Notification service or Google Firebase Cloud Messaging. You can turn notifications off in your device settings.
- SMS alerts. We may also send disaster alerts by text message to the phone number on your household record, through our SMS provider. Standard message rates from your carrier may apply. You can ask us to stop SMS alerts at any time.
The App does not use advertising identifiers or third-party advertising or analytics tools.
3. How we use information
We use information to:
- Provide the Services: create and manage accounts; register households; confirm identity and location; send early warning alerts; decide who qualifies for help; deliver and record cash assistance; and run wallet transactions.
- Process donations: process gifts, send receipts, keep the donation records the law requires, and thank donors. We will not publish donor names without permission.
- Communicate: answer your messages, send you important information about the Services and, if you ask to stay in touch, send updates about GFIR.
- Protect people and the program: prevent fraud and duplicate registrations, secure accounts, and enforce our Terms of Service.
- Improve: understand how the Website and Services are used so we can make them better, mainly using combined statistics rather than individual records.
- Report publicly: publish combined statistics that can’t identify anyone, such as the number of families reached and the amount of money paid out in each response. We will never publish information that identifies a family we help without their consent.
- Meet legal obligations: comply with tax, accounting, anti-fraud and sanctions laws, and respond to lawful requests.
4. Automated alerts and eligibility decisions
We use hazard data from public scientific and government sources, such as weather forecasts, flood forecasts and global disaster alert systems, and compare it with the locations of registered households. This lets us send alerts and identify households that may need help.
A household may be flagged as possibly eligible for cash assistance when several separate hazard measures pass set thresholds at its location. A flag alone never sends money. GFIR staff review every flagged household under our program rules before assistance is approved, and we record who made each decision. If you think a decision about you is wrong, contact us or ask your local agent, and a person will review it.
7. How long we keep information
- Accounts and household records: kept while your account is active or while we need them to provide the Services. After you delete your account, we delete or de-identify this information within 30 days, except as described below.
- Palm credentials: deleted when you delete your account, when you withdraw consent, or after 3 years without use, whichever comes first.
- Transactions and cash assistance records: stored in a tamper-evident ledger, which means entries cannot be changed or removed. We keep them for financial accountability, audits and legal requirements. If you delete your account, these entries remain, but we remove or de-identify your profile details linked to them where we can.
- Donation records: kept as long as tax and accounting laws require, generally at least seven years.
- Unfinished registrations: deleted once the household is registered, or after 12 months without activity.
- Verification codes: expire shortly after they are sent and are then deleted.
- Consent records: kept while your account is open, and afterwards for as long as we need them to show that we got your consent.
- Server logs: generally kept for 14 to 30 days.
- Database backups: kept briefly, on a rolling basis.
- Contact messages: kept as long as needed to respond and maintain our relationship with you, then deleted.
- Google Analytics data: kept for 14 months.
8. How we protect information
We use safeguards designed to protect your information, including:
- encryption of data while it travels (HTTPS/TLS) and while it is stored in our database;
- salted, one-way hashing of passwords;
- palm credentials stored only as one-way hashes;
- sign-in tokens kept in your device’s secure storage;
- role-based access controls, so GFIR staff and partner organizations can see only the personal information they need for their role;
- multi-factor authentication for staff and administrator access;
- limits on sign-in attempts to block password guessing;
- audit logs of administrative actions and of staff access to personal information;
- a tamper-evident transaction ledger;
- regular, encrypted backups; and
- confidentiality duties for staff, volunteers and local agents who handle personal information.
No system is completely secure. We keep an incident response plan. If a data breach affects your personal information, we will notify you and the relevant authorities as the law requires.
9. Your choices and rights
You can ask us to:
- see the personal information we hold about you and receive a copy;
- correct information that is wrong or incomplete;
- delete your account and personal information, with the exceptions described in Section 7;
- limit or object to certain uses of your information; and
- withdraw your consent where we rely on it, including for palm biometrics and location.
Delete your account yourself. You can delete your account at any time in the App (Profile > Delete account) or at gfir.org/delete-account.
For any other request, email privacy@gfir.org. Your local agent can also help you contact us. We will send copies of your data in a common, portable format. Before we act, we will confirm your identity; this may involve a palm confirmation or help from your agent. We will respond within 30 days, or sooner if the law requires. We will not treat you differently for using your rights. Please note that withdrawing consent for palm biometrics or location may mean we can no longer offer some Services, such as palm sign-in or cash assistance that depends on verification.
Device settings. You can turn off location and notification permissions at any time in your device settings.
Emails and texts. You can unsubscribe from optional emails at any time with the link in each email, and you can ask us to stop SMS alerts. We will still send messages you need to use the Services, such as sign-in codes.
Rights where you live. Depending on where you live (for example, under the EU or UK GDPR, the Philippines Data Privacy Act of 2012, California law, or other local data protection laws), you may have additional rights, including the right to complain to your data protection authority. Where those laws apply, we rely on these legal grounds:
- your consent (for palm biometrics, location and, where required, analytics);
- providing the Services you request;
- our legitimate interests (security, fraud prevention and improving the Services);
- compliance with legal obligations; and
- protecting life and safety (emergency alerts).
California residents. We do not sell or “share” personal information as those terms are defined in California law. We do not give personal information to third parties for their own direct marketing.
10. International data transfers
GFIR is based in the United States. We store and process information in the United States (Amazon Web Services, U.S. East region), wherever you live. This includes families registered in South Asia, the Caribbean and Sub-Saharan Africa. Data protection laws in the United States may differ from those in your country. When we transfer information, we protect it as described in this policy and as applicable law requires.
11. Children’s privacy
The Website and App are not directed to children under 13, and we do not knowingly collect personal information online from children under 13. You must be at least 18 years old, or the age of majority where you live if that is older, to create an App account. We ask for your date of birth when you sign up to check this. When we register a household, we record only the number of children in it, not their names or other details. If you believe we have collected a child’s information by mistake, contact us and we will delete it.
12. Third-party services and links
The Services link to or rely on third-party services such as Stripe, Google and Mapbox. Their own privacy policies govern how they use your information, and we encourage you to read them.
13. Changes to this policy
We may update this policy as our Services change. When we do, we will post the new version on this page and change the “Last updated” date. If we make important changes, we will tell you through the Website, the App or by email before they take effect.
14. Contact us
Global Fund for Innovation and Resilience
Attn: Privacy
5503 Wilma St, Torrance, CA 90503, USA
Email: privacy@gfir.org