Privacy Policy

1. Information we collect

Account information: your name, email address, phone number and mailing address when you create an account or contact us.

Application information: employment status, monthly income and expenses, household size, details of each debt you ask us to consider (creditor, debt type, balances, monthly payment and interest rate), and a description of your financial hardship.

Documents: identification, proof of income and debt statements that you upload to support your application.

Community-impact information: activities you sign up for, hours you log and verification provided by the hosting organization.

Technical information: basic log data such as IP address, browser type and timestamps, used to keep the platform secure and functioning.

2. How we use information

We use your information to determine eligibility, review and decide applications, verify submitted information and documents, administer approved assistance and community-impact participation, communicate with you about your application, prevent fraud and misuse, produce aggregated impact reporting, and meet legal and record-keeping obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

3. Consent to verify financial information

When you submit an application you authorize us and our authorized service providers to verify the information you provide. Verification may include reviewing the documents you upload and contacting the creditors you list, solely for the purpose of assessing and administering your application. You may withdraw this authorization in writing at any time, in which case we may be unable to continue reviewing your application.

4. Legal bases for processing

Where applicable data-protection law requires a legal basis, we rely on your consent (for verification and document processing), performance of our agreements with you (program participation), our legitimate interests (security, fraud prevention, program integrity) and compliance with legal obligations.

5. Document storage and retention

Uploaded documents are stored in a private, access-controlled storage system. Only you and authorized ShineBright staff reviewing your application can access them.

We retain application records and documents for as long as needed to administer the program and to meet accounting, audit and legal requirements — generally seven years after your application is closed or your participation ends — after which records are deleted or anonymized.

6. Sharing with funding partners and service providers

Funding partners receive aggregated and de-identified reporting on how contributions were used. They do not receive your identifying information, documents or debt details unless you give explicit, separate written consent.

We share information with service providers who host our platform, store documents, process communications and support verification. These providers act on our instructions under written agreements and may not use your information for their own purposes.

We may disclose information where required by law, court order or valid legal process, or to protect the rights and safety of applicants, staff or the public.

7. Data-processing disclosures

Personal data is processed by ShineBright as the controller, using vetted processors for hosting, storage, authentication and communications. Processing is limited to the purposes described in this policy, subject to confidentiality obligations, and protected by contractual data-protection terms.

8. Security measures

We use encryption in transit, encrypted storage, private document buckets, role-based access controls and row-level security so that each user can access only their own records. Staff access is limited to those who need it to review applications, and administrative actions are recorded in an audit log. No system can be guaranteed perfectly secure, so please avoid sending sensitive data through email or public forms.

9. Your rights and choices

You may request access to the personal information we hold about you, ask us to correct inaccurate information, request deletion of information we no longer need to retain, withdraw consent, object to certain processing, or request a copy of your information in a portable format. Contact us using the support form and we will respond within the timeframes required by applicable law.

10. Children's information

The platform is intended for adults aged 18 and over. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will delete it.

11. International transfers

Our services are operated from the United States. If you access the platform from outside the United States, your information will be transferred to and processed in the United States under appropriate safeguards.

12. Changes to this policy

We may update this policy as the program evolves. Material changes will be posted on this page with a new effective date, and where required we will notify you directly.

13. How to contact us

ShineBright Relief Foundation, Inc., 1201 Peachtree Street NE, Suite 800, Atlanta, GA 30361, United States. Use the Contact Support button in the site footer or our contact page to reach the privacy team. Support hours: Monday – Friday, 9:00am – 6:00pm ET.