What personal information Donors holds, why, where it lives, and what you and your donors can ask us to do about it.
1 Who we are
Donors is a fundraising CRM operated by 2835627 Alberta Inc. o/a 2Labs Advisory, Alberta, Canada. In this policy, "Donors," "we," and "us" mean that entity; "you" means a customer organization (a charity or nonprofit) and its authorized users.
Questions about privacy: hello@2labs.ca.
2 The one thing to understand first: two roles
Donors handles two different kinds of personal information, and our role differs for each:
- Your account users (the staff at your organization who log in). For their information, we are the controller — we decide how it's used, and this policy governs it directly.
- Your donors and contacts (the people in your CRM). That information belongs to your organization; we only process it on your behalf and under your instructions, to provide the service. Your organization decides how it's used, and your organization's own privacy notice governs your donors. If a donor asks us about their data, we direct them to your organization and help you respond.
3 What we collect and keep
From your account users (we are the controller): - Name, email address, and role. - Sign-in security data: one-time login codes (stored only as a cryptographic hash, never in readable form) and session tokens (also hashed), plus the IP address and browser of a sign-in, used to keep the account secure.
Donor and contact data you enter or import (we are the processor): only what a fundraising CRM needs — name, organization, email, phone, mailing address, notes — together with the gifts, receipts, recurring plans, consent preferences, tags, households, and activity you choose to record. We don't enrich it, buy data about your donors, or add anything you didn't put there.
Payment data: when a donation is processed, card details go directly to Stripe and never reach our servers. We store only the Stripe transaction reference — not the card number, not the last four digits, not the card brand.
That's the whole list. We do not collect advertising identifiers, build behavioural profiles, or track your donors around the internet.
4 What we do — and don't do — with it
We use the information above only to run the service: to authenticate users, store and display your records, issue CRA-compliant receipts, send the transactional emails you trigger (sign-in codes, receipts), process the donations you collect, and provide support you ask for.
We do not: - sell, rent, or trade personal information — ever; - use your donors' data to advertise, or share it with advertisers or data brokers; - use your donor data to train AI models; - access your data ourselves except the narrow, logged support access described under Security.
5 Where your data lives
Donors is hosted on Microsoft Azure in Canada — primary in the Canada Central region (Toronto), with encrypted, geo-redundant backups in Canada East (Québec). Your donor data, and its backups, stay in Canada. (This also supports your own CRA obligation to keep books and records in Canada.)
6 AI-assisted import
When you import a spreadsheet, Donors can use AI to suggest how your columns map to fields. To do that it sends your column headings and a sample of rows from your file (up to 30) to our AI provider (Anthropic) so it can propose a mapping. If those sample rows contain donor details, those details are included in what is sent. Anthropic does not use this data to train its models and retains it only briefly to return the result. If AI mapping is unavailable, Donors falls back to a built-in matcher and nothing leaves our systems.
7 Website analytics
Our marketing website and the Donors sign-in page use Fathom Analytics to count which pages are read. Fathom is cookieless: it sets no cookie, stores no personal information, and cannot follow you to other websites — so there is nothing to consent to and nothing to switch off. Inside the application there is no analytics at all.
8 Who else touches the data (subprocessors)
We use a small set of service providers, each only for the purpose shown, and each bound to protect the data:
| Provider | Purpose | Data involved |
|---|---|---|
| Microsoft Azure (Canada) | Hosting, database, storage, backups | All service data, encrypted, in Canada |
| Stripe | Payment processing | Card data (direct to Stripe); we store only a transaction reference |
| 2Labs Communications | Sending sign-in codes and receipt emails | Recipient email + email contents |
| Anthropic | AI import column-mapping | Column headings and a sample of rows from the file you import (up to 30 rows), so it can propose a mapping |
| Fathom Analytics | Website analytics (marketing site and sign-in page only, never inside the app) | Page views only — no cookie, no personal information, no cross-site tracking |
We'll keep this list current and give notice of material changes. A separate Data Processing Addendum (available to customers) governs how we process donor data on your behalf.
9 Security
Encryption in transit (TLS) and at rest; strict tenant isolation enforced in the database so no organization can reach another's data; least-privilege access; passwordless sign-in (no reusable passwords). Any support access to your account by our team is scoped to your organization, time-boxed, and logged. No security is absolute, but protecting donor trust is designed into the foundation. See our security overview or ask us for detail.
10 How long we keep it
We keep your data for as long as your organization is a customer. Sign-in codes are short-lived (they expire in minutes); session tokens expire and are cleared. On termination we will, on request, provide a full export and then delete your organization's data within 30 days, including from backups as they age out on their normal cycle. You can export your data at any time.
11 Your choices and rights
For account-user data we control, you may request access, correction, or deletion, and may object to certain processing, by writing to hello@2labs.ca. For donor data, because it belongs to your organization, a donor's request should go to that organization; we will assist the organization in responding. Under Canadian privacy law (PIPEDA and applicable provincial laws) you may also contact the Office of the Privacy Commissioner of Canada.
12 Children
Donors is a tool for organizations and is not directed to children. We don't knowingly collect information from children through the service.
13 Changes
We may update this policy; we'll post the new date above and, for material changes, notify customers.
14 Contact
2835627 Alberta Inc. o/a 2Labs Advisory · hello@2labs.ca · governing law: Alberta, Canada.
Effective 25 September 2026.