Legal

Privacy policy

Last updated: November 4, 2026

This Privacy Policy describes how Paws Forward (“Paws Forward,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects personal information when you visit our website, create a promoter QR, make a donation, contact us, or otherwise interact with our fundraising services (collectively, the “Services”).

Paws Forward is a dog-rescue fundraising organization. We raise money to help dogs obtain food, water, and shelter, and we operate a QR / referral program that lets supporters share a personal link and earn a commission on attributed gifts. Please read this policy carefully. By using the Services, you acknowledge the practices described here. If you do not agree, please do not use the Services.

This policy is intended to be clear and detailed. If anything is unclear, email joinpawsforward@outlook.com and we will help.

1. Who we are and how to reach us

For privacy questions, access requests, correction requests, deletion requests, or complaints about how we handle personal information, contact:

• Privacy: joinpawsforward@outlook.com
• General: joinpawsforward@outlook.com

We will respond within a reasonable period. We may ask you to verify your identity before disclosing or changing records that contain personal information.

2. Scope of this policy

This policy applies to personal information we process in connection with:

• Our public website and landing pages
• Donation flows and Stripe Checkout sessions initiated from our site
• Promoter signup (“Get your QR”) and resulting referral links / QR codes
• Visit and scan attribution related to those links
• Operator / volunteer tools used to administer the program
• Email or other messages you send to our contact addresses

It does not control the privacy practices of third parties that you visit after leaving our site, except to the extent those parties are Stripe or Supabase acting as our processors as described below.

3. Categories of personal information we collect

The information we collect depends on how you use the Services. We only collect what we need to run fundraising, attribution, payouts, security, and support.

3.1 Information you provide directly

• Promoter profile information. When you create a QR, you provide your first name, email address, phone number, preferred payout method (for example Cash App, Venmo, PayPal, Zelle, or another option we list), and a payout handle or identifier (such as a cashtag, username, email address, or phone number used for payout). We also generate and store a unique referral / promoter code tied to your profile.
• Donation-related information you enter on our site. Before or during checkout you may provide an amount and, where offered, an optional donor label or note. Card numbers and full payment credentials are entered on Stripe’s checkout pages, not stored by Paws Forward as raw card data.
• Communications. If you email us, we receive the content of your message, your email address, and any information you include.
• Support or privacy requests. Information you submit so we can verify and fulfill access, correction, or deletion requests.

3.2 Information collected automatically

• Visit / scan / referral events. When someone opens a donate link or QR associated with a promoter code, we may record the referral code, path or page, timestamp, and related attribution metadata so gifts can be tied to the correct promoter.
• Technical and device data. Standard request metadata such as IP address, browser type / user agent, approximate time of access, and similar log-style fields may be processed when you load pages or call our backend functions.
• Session state in your browser. Limited data may be kept in your browser session (for example an unlock state for the Portal). That data stays on your device unless you clear it.

3.3 Information from payment confirmation

After a donation attempt, we receive confirmation details needed to record the gift, including amount, currency, time, payment status, Stripe session or payment identifiers, and referral attribution when a promoter code was present. We use these records for accounting, commission calculation, and fraud / duplicate prevention.

3.4 Information we do not intentionally collect

We do not ask donors to create a Paws Forward account to give. We do not intentionally collect government ID numbers, precise GPS tracks, biometric templates, or special-category data as part of ordinary public use of the site. Please do not send sensitive information we do not need.

4. How we use personal information

We use personal information for the following purposes:

• Provide the Services. Create promoter profiles, generate QR codes and short links, accept donations, attribute gifts, and show confirmation states.
• Operate the rescue program. Track fundraising totals, allocate attributed and unattributed gifts, and support food, water, and shelter for dogs.
• Calculate and administer promoter payouts. Match donations to referral codes, apply the published commission rate, and use the payout method / handle you provided.
• Payment processing and reconciliation. Create Stripe Checkout sessions, confirm successful payments, prevent double-counting, and keep records for bookkeeping.
• Security, integrity, and abuse prevention. Detect suspicious traffic, protect operator tools, investigate misuse of QR codes, and keep the Services reliable.
• Customer and privacy support. Answer questions, handle disputes about attribution or payouts, and honor privacy rights requests.
• Legal and compliance. Keep records required for tax, accounting, audit, dispute resolution, or lawful requests.
• Improve clarity of the product. Understand which flows fail or succeed (for example checkout completion) using operational records — not for selling ads.

We do not sell personal information. We do not use personal information to build advertising profiles for third-party ad networks.

5. Legal bases (where applicable)

Depending on where you live, we may rely on one or more of the following grounds to process personal information:

• Contract / requested service — creating your QR, processing a donation you start, or paying a commission you earned
• Legitimate interests — securing the site, preventing fraud, attributing gifts, and improving reliability in ways that do not override your rights
• Legal obligation — retaining financial records or responding to lawful process
• Consent — where we ask for it, or where you voluntarily send us extra information

If you are in a jurisdiction that requires a specific legal basis and you believe we need additional notice, contact us and we will clarify how we process your data for that use.

6. Service providers we use: Stripe and Supabase

To run the Services we rely on two primary processors. This policy intentionally focuses on these providers because they are the systems that process personal information for payments and for our application database / backend.

6.1 Stripe

Stripe processes donations and related payment events. When you donate, you are typically redirected to or presented with Stripe Checkout (or a Stripe-hosted payment interface). Stripe collects and processes payment card data, billing details, and fraud / risk signals according to Stripe’s own terms and privacy policy.

In connection with Stripe, Paws Forward may store or receive:

• Checkout or payment session identifiers
• Payment status (for example paid, incomplete, or failed)
• Amount and currency
• Timestamps and attribution metadata we attach to the session (such as a referral code)
• Limited donor-facing labels if we collect them before checkout

Paws Forward does not store full payment card numbers on our own systems. Card data is handled by Stripe. Stripe may also send receipts or payment communications according to its product settings and your interaction with Checkout.

For more detail on how Stripe handles personal information, review Stripe’s privacy documentation on Stripe’s website. Your use of Stripe Checkout is also subject to Stripe’s terms.

6.2 Supabase

Supabase provides our application database and backend functions (including serverless / edge functions we use to create checkout sessions, confirm donations, create promoter records, and related operations). Personal information described in this policy — such as promoter profiles, donation records, referral codes, and visit / attribution events — is stored in or processed through Supabase infrastructure under our control and configuration.

Typical categories stored or processed via Supabase include:

• Promoter names, emails, phone numbers, payout type, payout handle, and referral codes
• Donation amounts, times, statuses, Stripe identifiers, and attribution fields
• Visit / scan events used for attribution and operational analytics
• Operational logs produced by our functions while fulfilling requests

Access to production data in Supabase is limited to authorized operators and automated processes that need it to run the Services. Supabase processes data under its terms and privacy policy as our infrastructure provider.

6.3 No other processors named in this policy

For purposes of this Privacy Policy’s description of third-party processors that handle personal information for core fundraising and data storage, we identify only Stripe and Supabase. If our processing stack changes in a material way, we will update this policy.

7. How we share information

We share personal information only as needed to operate the Services or as required by law:

• With Stripe — to create and complete payment sessions and reconcile donations.
• With Supabase — to store and process application data as our database and backend provider.
• Within our operating team — authorized volunteers / operators who need access to administer payouts, support, fraud review, or rescue accounting.
• For legal reasons — if we believe disclosure is required to comply with law, regulation, legal process, or governmental request; to protect the rights, safety, or property of Paws Forward, our users, animals in our care programs, or the public; or to detect, prevent, or address fraud and security issues.
• Business continuity — if we reorganize how the program is operated, data may transfer to a successor that continues the same fundraising purpose, subject to this policy or a successor policy with equivalent protections.

We do not sell personal information. We do not share personal information with third parties for their independent marketing.

8. Cookies, local storage, and similar technologies

Our public site is primarily a static experience plus calls to our backend. We may use browser storage or session mechanisms that are necessary for the site to function (for example remembering that an authorized operator unlocked the Portal in the current browser session). We do not run third-party advertising cookies as part of the core fundraising experience described here.

Stripe may set its own cookies or similar technologies on Checkout pages it hosts. Those technologies are governed by Stripe’s policies.

You can control cookies and site data through your browser settings. Blocking necessary storage may prevent parts of the Services (including operator unlock or checkout) from working correctly.

9. Retention

We keep personal information only as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law.

• Promoter profiles. Retained while your QR / referral code remains active and for a reasonable period afterward to handle payouts, disputes, and accounting.
• Donation and payment records. Retained for bookkeeping, tax, audit, chargeback, and commission reconciliation needs. Financial records often must be kept for multiple years under applicable rules.
• Visit / scan logs. Retained for attribution, abuse prevention, and operational review, then deleted, anonymized, or aggregated when no longer needed.
• Support and privacy correspondence. Retained as long as needed to resolve your request and to keep a record of how we responded.

When retention ends, we delete or de-identify information in a manner consistent with our systems in Supabase and with records Stripe retains under its own retention rules for payment processing.

10. Security

We take reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. These measures include limiting operator access, using encrypted transport (HTTPS) for the site and API calls, and relying on Stripe and Supabase security controls for payment and infrastructure layers.

No method of transmission or storage is completely secure. If we become aware of a security incident that affects your personal information, we will take appropriate steps, which may include notification where required by law.

11. International processing

Paws Forward may process information in the United States or other locations where we or our processors (Stripe and Supabase) operate infrastructure. If you access the Services from another country, your information may be transferred to and processed in countries that may have different data-protection laws than your own. Where required, we rely on appropriate safeguards and processor terms for such transfers.

12. Your privacy choices and rights

Subject to applicable law, you may have rights to access, correct, update, delete, or obtain a copy of personal information we hold about you; to object to or restrict certain processing; and to appeal or lodge a complaint with a regulator where available.

To exercise these rights, email joinpawsforward@outlook.com with:

• The email or phone associated with your request
• Whether you are a donor, promoter, or other contact
• What you want us to do (access, correction, deletion, etc.)
• Enough detail for us to locate records (for example a referral code or approximate donation date)

We may need to verify your identity. We may decline or limit a request where the law allows — for example when we must keep donation records for accounting, when deletion would impair fraud prevention, or when we cannot authenticate the requester. If we deny a request, we will explain why when we are permitted to do so.

Promoters who want their QR deactivated should contact us. Deactivation stops new attribution going forward but may not erase historical donation records needed for accounting.

Donors who need a receipt or payment question answered should contact us and, where the issue is payment-rail specific, may also need to work with Stripe or their card issuer.

13. Children’s privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact joinpawsforward@outlook.com and we will take appropriate steps to delete it. If local law sets a higher age for digital consent, we do not knowingly collect personal information from anyone under that age for promotional signup.

14. Notice for U.S. state privacy rights (including California)

Depending on where you live, state law may give you additional rights regarding personal information, such as the right to know what we collect, request deletion, correct inaccuracies, obtain a portable copy, or opt out of certain “sales” or “sharing” of personal information.

Paws Forward does not sell personal information for money. We also do not share personal information for cross-context behavioral advertising. We disclose personal information to Stripe and Supabase as service providers / processors so they can perform payment processing and database / backend services on our behalf.

Categories of personal information we may collect are described in Section 3 and generally include identifiers (name, phone, payout handle, referral code), commercial / transaction information (donation amounts and statuses), internet or technical activity (visit / scan metadata, IP, user agent), and inferences limited to operational attribution (which referral code was associated with a gift). We collect this information from you directly, from your device when you use the Services, and from Stripe payment confirmation events.

To exercise state privacy rights, email joinpawsforward@outlook.com. We will not discriminate against you for exercising privacy rights. We may need to verify your request and may deny requests where an exception applies (for example retaining donation records needed for legal / accounting obligations).

15. Do Not Track and automated decision-making

Some browsers offer a “Do Not Track” signal. Our Services do not currently respond to DNT signals in a differentiated way because we do not operate third-party advertising tracking as part of the core experience. We do not use personal information for solely automated decisions that produce legal or similarly significant effects about you without human involvement in our ordinary fundraising workflows. Commission calculations are based on recorded attributed donations and may be reviewed by operators before payout.

16. Links to other sites

Our site may link to external resources. Aside from Stripe Checkout and infrastructure operated through Supabase as described above, those destinations have their own privacy practices. We are not responsible for content or policies on sites we do not control.

17. Volunteer / operator access

Authorized operators use a Portal to administer promoters, donations, and payouts. Access is restricted. Operators are expected to use personal information only for program administration. Unauthorized access or misuse of operator tools is prohibited and may result in loss of access and other consequences.

Operator unlock or session mechanisms that live in your browser are described in Section 8. They are not a substitute for strong account security practices on devices used to administer the program.

18. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top of this page. If changes are material, we may also provide additional notice on the website. Continued use of the Services after an update means you acknowledge the revised policy. Please review this page periodically.

19. Relationship to Terms of Use

Use of the Services is also governed by our Terms of Use, which explain donations, promoter commissions, acceptable use, and related rules. If there is a conflict between the Terms and this Privacy Policy on a privacy-specific topic, this Privacy Policy controls for that topic.

20. Contact

Questions about privacy, data, Stripe payment records we hold, or Supabase-stored profile / donation information:

• Privacy: joinpawsforward@outlook.com
• General: joinpawsforward@outlook.com

For payment disputes that Stripe alone can resolve (for example card issuer chargebacks), you may also need to contact your bank or use Stripe’s consumer support channels related to the charge descriptor on your statement.