Penyzen Privacy Policy

Effective Date: July 4, 2026 Last Updated: July 4, 2026

This Privacy Policy describes how Penyzen LLC ("Penyzen," "we," "us," or "our"), a Delaware limited liability company, collects, uses, and shares information about you when you use the Penyzen website, platform, and related services (collectively, the "Platform"). This Policy is incorporated into and forms part of our Terms of Service.

By using the Platform, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Platform.

1. Information We Collect

1.1 Information You Provide

Account information. When you create an account, we collect your first and last name, email address, and a password. Passwords are handled by our authentication provider (Amazon Cognito) using industry-standard cryptographic storage — Penyzen never stores or has access to your plaintext password.

Phone number (optional). You may provide a phone number to enable phone verification. We use your phone number solely to send one-time verification codes and account-security notices. See Section 6 (Text Messages) for details. We do not use your phone number for marketing.

Organization information. If you register an organization, we collect the organization's name, type, and — for nonprofits — its Employer Identification Number (EIN) and verification documents you submit (such as IRS determination letters and state registration documents).

Campaign content. When you create a campaign, we collect the content you provide: title, description, story, images, videos, goal amount, milestones, updates, and item registry entries. Published campaign content is public.

Donation information. When you donate, we record the campaign, amount, any optional tip, any message you attach, and whether you chose to donate anonymously.

Item pledge information. When you pledge an item, we collect the pledge details and the messages you exchange with the campaign organizer through the pledge messaging thread.

Communications. If you contact us (for example at support@penyzen.com), we keep a record of the correspondence.

1.2 Information Collected by Our Payment and Verification Partners

Payment card data. All payments are processed by Stripe, Inc. Your card number and full payment credentials are transmitted directly to Stripe and never touch Penyzen's systems. We receive only transaction metadata (amount, status, last-four digits and card brand where applicable) needed to display your donation history and operate the Platform. Stripe's handling of your data is governed by Stripe's Privacy Policy (stripe.com/privacy).

Identity verification (KYC). Campaign organizers complete identity verification through Stripe Identity. Your government-issued ID and verification photos are collected and processed by Stripe, not by Penyzen. We receive and store only the verification outcome (e.g., verified, pending, rejected).

Payout information. Organizer bank account details are collected by Stripe when you set up your payout account (Stripe Express). Penyzen does not store your bank account numbers.

Donor-advised fund (DAF) grants. DAF donations are processed through Chariot (Chariot Technologies, Inc.). Chariot's handling of your information is governed by Chariot's privacy policy.

1.3 Information Collected Automatically

Technical data. When you use the Platform, our infrastructure automatically records standard technical information: IP address, browser type, device information, pages viewed, and timestamps. This appears in server logs used for security, debugging, and abuse prevention.

Cookies and similar technologies. The Platform uses only essential cookies and browser storage — session and authentication tokens required to keep you signed in. We do not use third-party advertising cookies or cross-site trackers.

2. How We Use Information

We use the information we collect to:

• provide, operate, and maintain the Platform (accounts, campaigns, donations, pledges, payouts);
• verify identities and organizations, and maintain the trust and safety of the Platform (fraud detection, campaign review, sanctions screening);
• send transactional communications: email confirmations, donation receipts, campaign notifications, verification codes, and security alerts;
• send verification codes by text message where you have provided a phone number (see Section 6);
• respond to your support requests;
• comply with legal obligations, including tax reporting, sanctions compliance, and responses to valid legal process;
• enforce our Terms of Service and protect the rights, property, and safety of Penyzen, our users, and the public.

We do not sell your personal information. We do not share your personal information with third parties for their own advertising or marketing purposes.

3. How We Share Information

We share information only as described below:

Service providers. We share information with the vendors that operate the Platform on our behalf:

Public content. Published campaigns — including titles, stories, images, goal and raised amounts, milestones, and updates — are visible to anyone. Donations appear on the campaign's public donor wall with your name unless you choose to donate anonymously, in which case your identity is masked publicly (Penyzen and Stripe retain the full transaction record, as required for legal and compliance purposes).

Campaign organizers. When you donate or pledge an item, the organizer sees the information needed to operate their campaign (your name unless anonymous, donation amount, any message, and pledge coordination details).

Legal and safety. We may disclose information when required by law, subpoena, or other legal process; to law-enforcement or government authorities where we believe disclosure is required or appropriate; or where necessary to investigate fraud, protect our users, or defend Penyzen's legal rights.

Corporate transactions. If Penyzen is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy's protections.

4. Data Retention

We retain your information for as long as your account is active and as needed to provide the Platform. We retain transaction and donation records for the period required by tax, accounting, anti-fraud, and other legal obligations (generally up to seven years). Campaign content you delete is removed from public view; residual copies may persist in backups for a limited period. You may request account deletion as described in Section 7.

5. Security

We protect your information with technical and organizational measures that include: encryption in transit (TLS) for all connections; encryption at rest for our databases and file storage; network isolation of database systems (no direct internet path); least-privilege access controls; separated production and development environments with no shared credentials or data; and cryptographically signed verification of payment events. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Text Messages (SMS)

If you provide a phone number, we use it only to send:

• one-time verification codes you request (for example, when verifying your phone or signing in);
• security notices about your account or organization.

We never send marketing or promotional text messages. Message frequency depends on your use of verification features. Message and data rates may apply. You can stop receiving texts at any time by replying STOP, or get help by replying HELP. Consent to receive verification texts is not a condition of purchasing anything, and you may use email-based verification instead where offered.

7. Your Rights and Choices

Access and correction. You can view and update your profile information in your account settings at any time.

Deletion. You may request deletion of your account and associated personal information by emailing privacy@penyzen.com. We will honor verified deletion requests, subject to information we must retain for legal, tax, anti-fraud, and dispute-resolution purposes.

Email choices. Transactional emails (receipts, verification codes, security notices) are part of operating your account. Any optional email programs include an unsubscribe mechanism.

SMS choices. Reply STOP to any Penyzen text to opt out of SMS entirely.

7.1 State Privacy Rights (California and others)

If you are a resident of California (CCPA/CPRA) or of another state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, or Utah), you may have rights to: know what personal information we collect and how it is used and shared; access a copy of your personal information; correct inaccurate information; delete personal information; and not receive discriminatory treatment for exercising these rights.

Penyzen does not sell personal information and does not share personal information for cross-context behavioral advertising, so no opt-out of sale/sharing is required. To exercise any right, email privacy@penyzen.com with your request; we will verify your identity before responding, and will respond within the timeframe required by applicable law. You may designate an authorized agent to make requests on your behalf.

8. Children's Privacy

The Platform is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Users between 13 and 17 may use the Platform only with the consent and supervision of a parent or legal guardian, as described in our Terms of Service. If you believe a child under 13 has provided us personal information, contact privacy@penyzen.com and we will delete it.

9. Users Outside the United States

The Platform is operated from the United States, and information is stored and processed in the United States. If you access the Platform from outside the US, you understand that your information will be transferred to and processed in the US, where data protection laws may differ from those in your jurisdiction.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on this page and update the "Last Updated" date. For material changes, we will provide at least 30 days' notice by email to your registered address before the changes take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

11. Contact Us

For privacy questions or to exercise your rights:

Penyzen LLC
8 The Green, Ste A
Dover, DE 19901 Email: privacy@penyzen.com

This Privacy Policy was last updated on July 4, 2026.