Privacy Policy

Nonprofit Compass™ is a division of Stephen Capital Partners, LLC. This policy covers information handled through this website and platform. Contact us at support@stephencapitalpartnersllc.com or 2143 Springs Road, Suite 55 #233 Vallejo, CA. 94591.

Account information includes your email address, account identifier, registration date, and a password hash used to verify your login. The application stores a hash rather than your readable password.

Organization information includes the organization name, state, optional EIN, and records you enter into its compliance checklist. These can include task status, deadlines, completion dates, notes, and document references. Avoid entering donor lists, health records, passwords, payment card information, or other sensitive information that is not needed for these tasks.

Billing records can include Stripe customer and subscription identifiers, plan and payment status, verification dates, and synchronization history. Card details are entered on Stripe-hosted payment pages; the application does not receive your full card number or security code.

We record selected activity, such as registration, successful login, page and dashboard visits, feature use, and checkout or upgrade interactions. Activity records can include an account or visitor identifier, an organization identifier, and a timestamp. Support correspondence, feedback, follow-up notes, and publication permissions may also be retained.

Operational logs help diagnose requests, errors, and security problems. Hosting providers may also process IP addresses, browser information, and other network information when delivering the service.

The activity endpoint temporarily processes a keyed hash of an IP address to limit excessive requests. This rate-limit identifier is held in server memory rather than stored as an activity-event field.

We use information to create and authenticate accounts, save organization records, calculate risk scores, generate reports, manage subscription access, respond to support requests, and maintain the service.

Internal activity and customer-support records help us understand feature use, identify problems, and follow up on feedback. Public registration counts are aggregate counts, not a publication of your account email or private checklist. A registration count does not establish that each organization is an active or paying customer.

Customer names, photos, quotations, and affiliations are not approved for public testimonial use merely because someone creates an account or provides feedback. Publication requires separate recorded permission.

The auth_token cookie keeps you signed in. It is an HTTP-only cookie with a maximum seven-day lifetime. In production it is sent over secure connections and uses a strict same-site setting. Signing out clears this cookie.

The npc_visitor cookie associates selected website activity with a browser visitor identifier. It has a maximum 90-day lifetime and can be linked to account activity when you sign in or register. This cookie supports usage measurement; it is not the same as the sign-in cookie.

HeyCatch uses browser local storage to associate page views, clicks, and navigation with a visitor and session. When you sign in, analytics can be linked to your internal account identifier, email address, plan, and registration date. Captured page text and element attributes are masked; passwords, checklist contents, EINs, and payment card details are not deliberately sent as analytics properties.

Your browser can block or delete cookies. Blocking the sign-in cookie prevents normal account access. Clearing cookies does not delete information already stored in your account or in service records.

The browser-activity endpoint skips optional activity events when it receives a Do Not Track or Global Privacy Control header set to 1. This does not stop essential account, security, or billing processing, or every server-recorded service event.

HeyCatch browser capture also respects Do Not Track and Global Privacy Control signals. The backend separately reports confirmed registrations, organization creation, and billing outcomes; those server-recorded events are not controlled by browser tracking signals or browser storage settings.

The service uses Replit for application hosting and database infrastructure, and Stripe for payment processing. These providers process information needed to deliver their services and have their own privacy notices. Fonts delivered by Google may also cause your browser to contact Google servers.

We use HeyCatch to understand website navigation and confirmed product outcomes. HeyCatch receives browser and session information, page and click events, and the account properties and server-recorded outcomes described above.

Authorized operators can access account, organization, support, and billing information as needed to provide and administer the service. Information may also be disclosed when required by law, to respond to lawful requests, to protect rights and security, or in connection with a business transfer subject to applicable safeguards.

Links to corporate websites, LinkedIn, or other external services lead to websites governed by their own notices. This policy does not control those services.

We retain information as needed to operate accounts, support customers, maintain security and audit records, resolve disputes, and meet legal or financial recordkeeping obligations. There is no published automatic deletion schedule for all platform records. Ending a subscription or signing out does not automatically erase organization records or checklists.

Access controls, password hashing, and secure production cookies help protect information. No internet service can guarantee absolute security. Keep your login confidential and contact support if you suspect unauthorized access. Hosting and service providers may process information outside your state or country.

Email support@stephencapitalpartnersllc.com to request access to, correction of, or deletion of information, or to ask about other rights available under applicable law. Describe the request without sending a password, full card number, or other unnecessary sensitive information.

We may need to verify your identity and authority over the account or organization before acting. Requests are reviewed under applicable law; some records may need to be retained for security, disputes, or legal and financial obligations. This page does not promise immediate deletion or a self-service deletion feature.

The service is intended for adult nonprofit professionals and is not directed to children under 13. If you believe a child has provided personal information, contact support so the situation can be reviewed.

We may update this policy as the service or its practices change. The date at the top identifies the most recent update. Material changes will be communicated as required by applicable law.