Last updated: April 2026

Privacy Policy

Gifts In Kind ("GIK", "we", "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use our web application, including the GIK Marketplace at app.gik.org (the "Service"). If you do not agree with this policy, please do not access the Service.

1. Information We Collect

• Account Information: Name, email address, organization affiliation, and other details you provide when you register or update your profile.
• Organization Data: Details about the organizations you administer or join, including member lists, listings, and operational preferences.
• Communications: Messages, offers, notifications, and support interactions sent through the Service, including data processed via Stream Chat.
• Usage and Technical Data: Log information, device and browser data, and diagnostic information collected through our hosting providers (including Supabase).

2. How We Use Information

We use the information we collect to:

• Provide, operate, and improve the Service and its features.
• Authenticate users, manage organization access, and maintain security.
• Send transactional communications such as invitations, status updates, and alerts.
• Respond to support requests, gather feedback, and analyze product usage.
• Comply with applicable laws and enforce our Terms of Use.

3. Third-Party Sign-In Providers

When you sign in to the Service using a third-party authentication provider such as Google, the provider shares a limited set of profile information with us based on the OAuth scopes you authorize. For Google Sign-In, this is limited to your basic profile information: your name, email address, profile picture, locale, and Google account identifier.

We use this information solely to:

• Create or look up your GIK account.
• Pre-fill your profile (display name, avatar) so you can finish onboarding more quickly.
• Authenticate subsequent sign-ins and keep your session secure.

We do not request any restricted or sensitive Google API scopes, and we do not access, read, or store your Gmail messages, Google Drive files, contacts, calendar, or any other Google service data. The information GIK receives from Google Sign-In is used only as described in this Privacy Policy and is not sold or transferred to third parties for advertising or any unrelated purpose. You can revoke the Service's access to your Google account at any time from your Google Account permissions page at https://myaccount.google.com/permissions.

4. Legal Bases for Processing

Where required by law, we rely on the following legal bases to process personal data: (i) performance of a contract with you or your organization; (ii) legitimate interests such as securing and improving the Service; and (iii) compliance with legal obligations.

5. How We Share Information

• Service Providers: We use third parties such as Supabase for hosting and data storage, Stream Chat for messaging, email delivery platforms, and analytics tools. These providers process data on our behalf under appropriate agreements.
• Organization Administrators: Admins within your organization can access member activity, invitations, and listings relevant to that organization.
• Legal Compliance: We may disclose information if required by law, court order, or government request, or to enforce our legal rights.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.
• No Sale of Personal Information: We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

6. Data Retention

We retain personal information for as long as needed to provide the Service, fulfill the purposes described in this policy, and meet legal or contractual obligations. We may anonymize or aggregate data for longer-term analytics. When you delete your account, we remove or anonymize your personal information within a reasonable period, except where retention is required by law.

7. Security

We employ administrative, technical, and physical safeguards to protect personal information. These measures include access controls, encryption-in-transit, and regular monitoring of our Supabase-hosted infrastructure. However, no system can guarantee absolute security.

8. International Transfers

GIK is based in the United States. By using the Service, you understand that your information may be transferred to, stored, and processed in the U.S. or other countries where our service providers operate.

9. Your Choices and Rights

• Update your profile or organization settings from within the Service.
• Submit a request to access, correct, or delete personal data by contacting us at info@gik.org.
• Manage email preferences via the links in GIK communications.
• Deactivate your account by contacting GIK support.
• Revoke any third-party sign-in provider's access to GIK from that provider's account settings.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children. If we learn that a child has provided personal data, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated with reasonable notice. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact Us

For questions or requests regarding this Privacy Policy, email us at info@gik.org or contact your GIK representative.