Privacy Policy

Pledgely Inc. is a corporation incorporated under the federal laws of Canada. We build Salesforce-native apps and run the website at pledgely.org. This policy explains what personal information we handle, why, and the choices you have. If you have any question about it, email us at support@pledgely.org.

This policy is written to meet Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA), and Canada's Anti-Spam Legislation (CASL). We sell mainly in Canada and the United States and welcome customers elsewhere.

We handle several kinds of information, and it helps to keep them separate:

• Website information, from people who visit pledgely.org or use our forms.
• Account information, from people we give a sign-in to our Knowledge base.
• Information handled by our service providers, such as our email and hosting providers.
• Aggregate usage information from the apps you install, which tells us how features are used but never the content of your records.
• Your Salesforce records, which stay in your own Salesforce org. We do not keep a separate copy of them.

Each section below tells you which kind it is talking about.

Contact form. When you send us a message through the contact form, we collect your name, email address, organization, the topic you pick, and your message. Your message is delivered to our support inbox, which is hosted by Google Workspace, and we use it only to reply to you and keep a record of the conversation. The message is a plain email. It does not carry hidden tracking data, marketing tags, or any information from your Salesforce org.

Newsletter and waitlists. You can subscribe to our product news or to a waitlist for an app in development. We use a double opt-in process: when you sign up, we email you a confirmation link, and nothing is added to a subscription list until you click it. That link expires after 72 hours. When you confirm, we record your email address, the list you chose, the page you subscribed from, and the date and time you confirmed, so we can show that you gave consent. You can unsubscribe from any list at any time using the link in every email.

Spam and abuse protection. Our forms are protected by Google reCAPTCHA, which sets a necessary cookie and analyzes technical signals about your interaction to tell people apart from automated bots. Google processes that information under its own terms. Our hosting provider, Cloudflare, also applies rate limits to prevent flooding and abuse, using your IP address and a one-way hashed version of your email address. We do not store your raw email address for rate limiting.

Analytics. We record first-party, aggregate analytics events through Cloudflare Analytics Engine, such as which page was viewed, which action was taken, a campaign name, an A/B test variant, and the domain of the site that referred you. These events do not include your name, your form submissions, or any Salesforce data, and we do not use third-party advertising trackers. Cloudflare Web Analytics is not currently active on the site.

Server logs. As our hosting provider, Cloudflare processes standard request information, such as IP addresses, timestamps, and browser type, to operate and protect the website.

Cookies. We keep cookies to a minimum and use them only for the following:

• A reCAPTCHA cookie that is necessary for spam protection.
• Clerk sign-in cookies on the sign-in page and the Knowledge base, so you stay signed in.
• A variant cookie named "v" that lasts 90 days and is set only on advertising landing pages (addresses beginning with /lp/). It keeps an A/B test consistent for your visit. It does not identify you and is not shared with advertising networks.

We do not use advertising or cross-site tracking cookies.

Sign-in for our Knowledge base is provided by Clerk. Accounts are created by us for approved customers, and there is no public sign-up. Clerk processes your email address and sign-in details so we can give you access to gated walkthroughs and videos. We use this information only to manage that access.

We use a small set of reputable providers to run our website and communications. They process personal information on our behalf, for the purposes described here, and we do not sell your personal information to anyone.

• Twilio SendGrid sends our confirmation and notification emails and stores our newsletter contacts, list membership, consent details, and unsubscribe records. See the Twilio Privacy Notice.
• Google reCAPTCHA protects our forms from spam and abuse. See the Google Privacy Policy.
• Google Workspace is our email system, where contact-form messages arrive. See the Google Privacy Policy.
• Google appointment scheduling powers our "Book a demo" page, which is a Google booking page embedded on our site. When you book, Google processes the details you enter. See the Google Privacy Policy.
• Cloudflare provides our hosting, media storage, rate limiting, request logs, and first-party analytics. See the Cloudflare Privacy Policy.
• Clerk provides sign-in for the Knowledge base. See the Clerk Privacy Policy.
• Salesforce is the platform our apps run inside, as managed packages. See the Salesforce privacy information.

Some of these providers operate in the United States and other countries, so your information may be processed and stored outside Canada and may be accessible to authorities in those countries under their laws. We choose providers we consider reputable and that offer contractual data protections.

When you install a Pledgely app in your Salesforce org, Salesforce's feature-management capability can report aggregate usage information back to us, such as which features are turned on and how often a capability is used. This is counts and flags only. It never includes the content of your records or personal information from your org. We use it to understand which features matter and to plan what to build. You can read more on our Security page.

We do not keep a separate database that copies your Salesforce records, and we do not hold standing access to your org. The records our apps create live in your Salesforce org and follow your org's own settings and your agreement with Salesforce. When one of our apps uses a provider account you connect, such as your own Twilio or SendGrid account, the data you send flows between your systems and that provider under your relationship with them. We access your org only when you grant us access, and only for as long as you grant it, to help with support.

We use the information described above to reply to your messages, send the updates you asked for, provide and secure the website and the Knowledge base, protect our forms from spam and abuse, understand aggregate usage of our apps, and meet our legal obligations.

For marketing emails, we rely on your express consent, which you give through our double opt-in confirmation. Every marketing email includes a working unsubscribe link. We act on unsubscribe requests promptly and, in any event, within the time Canadian anti-spam law requires. As that law also requires, our commercial emails identify us and include a mailing address in the footer. We keep that mailing address in our emails rather than on this website.

We share personal information only with the service providers listed above, who process it for us. We may also disclose personal information if the law requires it, to enforce our terms, or to protect the rights, property, or safety of Pledgely, our customers, or the public. If our business is ever involved in a sale, merger, or reorganization, personal information may be transferred as part of that transaction, and we will require the recipient to protect it under terms consistent with this policy.

We keep personal information only as long as necessary for the purposes described in this policy, or as the law requires, and then we delete or de-identify it. Some information ages out automatically at our providers, such as server logs and aggregate analytics. If you unsubscribe, we keep a suppression record so that we continue to honor your choice. You can ask us to delete your information at any time, as described below.

We protect personal information with safeguards appropriate to its sensitivity, including access controls, encryption in transit, and reputable providers. No method of transmission or storage is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will report it and notify affected individuals as required by Canadian law.

You may ask us to access the personal information we hold about you, correct it, delete it, or withdraw your consent, including unsubscribing from our emails. Email support@pledgely.org and we will respond within 30 days, as PIPEDA requires. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, and for matters under British Columbia law, the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca.

Our website and apps are made for businesses, nonprofits, and their staff, and are intended for adults. They are not directed to children, and we do not knowingly collect personal information from children. If we learn that we have, we delete it.

We may update this policy from time to time. When we do, we will post the new version here with an updated effective date, and we will make reasonable efforts to highlight material changes. Using the website or our services after a change means you accept the updated policy.

Questions, requests, or concerns about privacy can be sent to support@pledgely.org.