Privacy Policy

1. Data Controller

2. Data Collected

3. Legal Basis

4. Processing Purposes

• ✅ Service delivery: account management, campaign publishing and tracking;
• ✅ Transaction processing: donation collection, creator payouts, receipt generation;
• ✅ Legal compliance: KYC, anti-fraud, regulatory obligations;
• ✅ Communication: important account/campaign notifications;
• ✅ Service improvement: anonymized usage analytics;
• ✅ Marketing (with consent): newsletters.

Your data is never sold to third parties or used for commercial profiling.

5. Data Sharing

6. Retention Periods

7. Your Privacy Rights (CCPA/COPPA)

Contact our DPO at dpo@sapeo.org. You may also file a complaint with the FTC.

8. Data Security

• 🔒 TLS/SSL 256-bit encryption of all communications;
• 🔑 bcrypt password hashing;
• 🛡️ Restricted access (least-privilege principle);
• 📊 Access logging and monitoring;
• 🔄 Encrypted daily backups;
• 🏅 PCI DSS Level 1 certification for all payment data.

9. International Transfers

SAPEO is hosted in the United States (AWS, Seattle WA). All data processing by sub-processors (payment, emailing) is governed by CCPA/COPPA-compliant Data Processing Agreements (DPA).

10. Minors

SAPEO is intended for users aged 18 and over. We do not knowingly collect data from minors. If you believe a minor has provided data without consent, contact privacy@sapeo.org.

11. Policy Changes

Significant changes will be notified by email with at least 30 days notice before taking effect.

12. International Sanctions & Verification (Payment Partner)

As part of the identity verification (KYC) and anti-money laundering checks required by our payment partner and U.S. regulations (OFAC, AML/BSA), SAPEO and our payment partner process your personal data (identity, address, location, payment information) to verify that you do not reside in a country or territory subject to comprehensive economic sanctions — including but not limited to Cuba, Iran, North Korea, Syria, Russia, and Belarus, or the Crimea, Donetsk, and Luhansk regions of Ukraine — and that you are not listed on a sanctions list (OFAC SDN, EU, or UN lists).

This processing constitutes a legal obligation (see Section 3 "Legal Basis") and may result in refusal to create an account, refusal of a transaction, or freezing of funds — including where the funds collected are intended for a sanctioned country, territory, or person, even if you are not yourself located in such a country. See Section 14 of our Terms of Service for full details.

13. DPO Contact

Response within 72 business hours. We handle requests within 30 days per CCPA/COPPA.