Privacy Policy

Stewardly is a donor-stewardship assistant for small nonprofit organizations. It reads the fundraising and communication systems your organization already uses and assembles what it finds into briefs and answers for the people on your team. This policy explains what we collect, why, who we share it with, and what you can do about it.

Stewardly is operated by Structlab LLC DBA Stewardly ("Stewardly", "we", "us"). If anything here is unclear, write to support@stewardly.fyi.

Who this policy is about

Two groups of people appear in Stewardly, and the distinction matters throughout this policy:

• Users — the staff and volunteers of a subscribing organization who sign in and use the product. They have accounts with us.
• Donors and contacts — the people your organization stewards. They do not have accounts with us. Their information reaches us only because your organization connected a system that already held it, and your organization decides what happens to it. For that information we act as a processor on your organization's instructions.

Information we collect

Account information

Your name, email address, a hashed password, the organization you belong to, and your role in it. We record the sessions you open (user agent, IP address, timestamps) so you can be signed out everywhere and so we can investigate abuse.

Information from the systems you connect

Each connection is authorized by a person on your team and can be disconnected by them at any time. What Stewardly reads and writes, by system:

• Gmail and Microsoft Outlook (connected per user) — we read messages matching a search for a donor, and we create drafts in your own mailbox. We never send mail. Stewardly has no feature that sends a message. For Outlook we do not request the permission to send at all. Google's draft permission, gmail.compose, also allows sending, and Google's consent screen says so, but Stewardly only ever uses it to create drafts.
• Google Calendar and Outlook Calendar (read-only) — events in a window around a donor's activity, filtered down to the ones the donor actually attended.
• Google Docs and Google Drive — we search Drive for documents that name a donor and export their text. We can also create a document when you ask us to; that permission only ever reaches files Stewardly itself created.
• Stripe, ActBlue, Givebutter, EveryAction (VAN) and Salesforce — donation, contact and activity records. Stripe and ActBlue records are copied into our database, and each donor in them is listed in your organization's donor registry, so the registry and briefs can be assembled quickly; the rest are queried live and never copied. All five are read-only with one exception: in Givebutter we can log an activity note, and only when you ask us to.
• Sincere Engage (Rover) — the postcard- and letter-writing platform. An organizer or administrator signs in to Sincere Engage and chooses one organization there; we then read that organization's campaigns and its writers' names, roles and writing activity, live and read-only. To find which of your donors also write, we send Sincere Engage your donors' email addresses, and it answers only with the ones that belong to its writers, so we never receive the rest of its volunteer list. Nothing from Sincere Engage is copied into Stewardly except what a brief cites, and disconnecting ends our access there.
• Slack — searched live at the moment you ask; nothing is archived. Chat searches run at your own Slack visibility. The search behind a brief is restricted to public channels, because briefs are visible to your whole organization and store the excerpts they cite.
• iMessage — if a user pairs a Mac running our companion app, that Mac sends us the message history for phone numbers and email addresses that match your organization's donors. Those messages are stored in your organization's archive. Matching a phone number to a donor happens on our servers, never on the device's word: by the phone numbers and email addresses on your donor records, and by any your teammates have linked to a donor themselves. So the person can see whose texts sync, the Mac receives your donors' names along with those phone numbers and email addresses, and keeps them in memory only. The person who paired the Mac decides on that Mac which conversations it may send — every donor conversation, all but the people they exclude, or only the people they choose — and can delete everything that Mac has sent us, at any time, from the app.

What you type

Your conversations with Stewardly, the notes you save, and the briefs that are produced for your organization. Briefs and saved notes are visible to everyone in your organization; your conversations are visible only to you.

Technical information

Server logs and error reports. Error reports go to Sentry with personal-information capture switched off — cookies, authorization headers and request bodies are not sent.

Billing information

Subscriptions are handled by Stripe. Stripe collects and holds the payment card; we never see or store card numbers. We keep the customer and subscription identifiers Stripe gives us, and the status of your subscription.

Google User Data

Because Stewardly asks for scopes that Google classes as sensitive and restricted, this section states plainly what we do with Google user data. It applies in addition to everything above.

What we request, and why:

• gmail.readonly — to find and read the messages exchanged with a specific donor so they can appear, cited, in that donor's brief and in answers to your questions.
• gmail.compose — to create a draft reply in your own mailbox. Google's description of this permission includes sending email, but Stewardly uses it only to create drafts and never sends.
• calendar.events.owned.readonly — to find meetings a donor attended.
• drive.readonly — to find and read documents that name a donor.
• drive.file — to create a document when you explicitly ask for one. This permission reaches only files Stewardly created.
• Basic profile and email address — to identify which Google account is connected and show it on your integrations page.

What we do with it. Google user data is used only to provide the features you asked for. Message bodies, calendar events and document text are read at the moment a brief or an answer is being produced. We do not build a copy of your mailbox or your Drive: what persists is the short excerpt a brief quotes as its source, alongside the link back to the original.

What we never do. We do not sell Google user data, use it for advertising, use it to train or improve any generalized artificial-intelligence or machine-learning model, or transfer it to anyone except as described under "Who we share information with" below.

Limited Use disclosure

Stewardly's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can review and revoke Stewardly's access to your Google account at any time at myaccount.google.com/permissions, or by disconnecting Google from your Stewardly integrations page. Disconnecting Google, or deleting your Stewardly account, revokes Stewardly's access at Google, deletes the stored tokens, and deletes the email, calendar and document excerpts quoted in the briefs you prepared.

Microsoft account data

The Outlook connection asks for Mail.ReadWrite and Calendars.Read, and deliberately does not ask for Mail.Send. Microsoft account data is used for the same narrow purposes as the Google data above and is subject to the same restrictions: no sale, no advertising, no model training. Disconnecting Outlook from your integrations page, or deleting your Stewardly account, deletes the stored tokens and the email and calendar excerpts quoted in the briefs you prepared.

How Stewardly uses artificial intelligence

Stewardly's answers and briefs are written by large language models operated by Anthropic. To produce a reply, the relevant content — your question, and the donor records, messages, events, documents and notes gathered for it — is sent to Anthropic's API. Anthropic processes that content to return a response and, under our commercial agreement with them, does not use it to train their models.

Model output can be wrong. Briefs and drafts are a starting point for a person, not a substitute for one, and every claim in a brief carries a link to the source it came from so you can check it.

Who we share information with

We do not sell personal information. We share it only with the service providers that make the product work:

• Anthropic — model processing, as described above.
• Render — application hosting and database hosting.
• Stripe — subscription billing.
• Sentry — error reporting, with personal-information capture off.
• Cloudflare — delivery of the transactional email we send you.
• Have I Been Pwned — when you set a password, the first five characters of its SHA-1 hash, to check it against passwords exposed in known breaches. The password itself never leaves Stewardly.
• AI apps you connect yourself — if you link an app such as Claude or ChatGPT to your Stewardly account, it receives the results of the tools it calls for you. Those results can include your email, calendar and document content. That app's own privacy policy applies to what it receives. Nothing reaches one unless you connect it.
• The systems you connect — Google, Microsoft, Slack, Salesforce, Stripe, ActBlue, Givebutter, EveryAction and Sincere Engage — which receive only the requests needed to read your data or write the draft or note you asked for.

We may also disclose information if we are legally required to, or to protect the rights and safety of our users. If Stewardly is ever acquired, information may transfer as part of that transaction, and this policy travels with it until it is replaced by one you are told about.

Where information is kept, and for how long

Stewardly runs on infrastructure located in the United States. If you are outside the United States, using Stewardly means your information is transferred there.

We keep your organization's data for as long as your organization has an account with us, with three exceptions. Synced text messages are deleted 24 months after they were sent. Briefs, along with the excerpts they quote, are deleted 24 months after they were prepared. Data exports you generate are deleted after seven days.

Disconnecting an integration deletes the stored credentials for it immediately. Deleting a conversation deletes it. When an organization's account is closed, we delete all of its data. Backups and logs are kept for one week, so copies in them are gone within a week of that. To request deletion sooner, write to support@stewardly.fyi.

Your choices

• Disconnect any integration, at any time, from your integrations page.
• Revoke Google or Microsoft access directly with those providers.
• Delete a conversation, or a note, from inside the product.
• Choose which Messages conversations a paired Mac sends us, and delete everything it has sent, from the Stewardly app on that Mac.
• Ask us for a copy of the information we hold about you, or ask us to correct or delete it, by writing to support@stewardly.fyi. If you are a donor rather than a user, the fastest route is your organization, which decides what happens to its records; we will help them act on your request.

Security

Traffic is served over HTTPS. OAuth tokens and API keys are encrypted at rest in our database. Sessions expire and their cookies carry the same deadline as the server-side record. Each organization's data is scoped to that organization, and that scoping is enforced by an automated audit that fails our build if an endpoint stops honouring it. No system is perfectly secure, and we do not claim otherwise.

Children

Stewardly is a tool for nonprofit staff and is not directed to children. We do not knowingly collect information from anyone under 16 as a user of the product.

Changes to this policy

We will post any change on this page and update the date at the top. If a change materially affects what we do with your information, we will tell account holders by email before it takes effect.

Contact

Questions, requests, or a report of something we have got wrong: support@stewardly.fyi.