1. Who we are
Foundation Lookup is run by Staunch Digital, established in France under SIREN 898 721 865, so European data protection law applies to what we do with personal data. Contact: [email protected].
This notice covers two groups of people: those who hold an account, and those named in the IRS returns the site shows.
2. People named in IRS returns
Private foundations file Form 990-PF with the IRS, and the IRS publishes the returns. We show them because they are public records that help nonprofits find funders.
- Officers, directors and trustees appear on their foundation’s page as the return lists them: name, title, hours and pay. They are not listed anywhere else on the site and are not in exports.
- People who received grants are never named. We do not store their names or addresses; those lines read “Individual” with the amount and the purpose.
- Application contacts appear on the foundation’s page as the return gives them.
To ask us to remove something from a page, use the removal request form. The email address you give there is used only to answer that request.
3. Account holders: what we store, and why
- Your account: your name, email address, a one-way hash of your password, your team and role, and when you last signed in. To run your account.
- Your work in the app: the organizations you add, your grant range, saved lists with their statuses and notes, alert settings and peers, and a record of each export (its size, not its contents). To provide the service.
- Billing: your plan, its status and renewal date, and the Stripe customer and subscription identifiers. To know what your plan includes.
- Security: sign-in attempts and rate limits, with IP addresses kept only as salted one-way hashes. To stop abuse.
We do not sell personal data and do not share it with advertisers.
4. Who else sees it
- Stripe processes payments. It receives your billing details; we never see or store card numbers.
- Cloudflare delivers the site, and its email service sends account email (confirmation, password reset, invitations, alerts).
- Infrastructure hosting runs the servers the service is delivered from, in the United States. Named on request.
5. Cookies
Signing in sets one essential cookie that keeps you signed in for up to 30 days. Sign-in may use Cloudflare Turnstile to check for automated abuse. There is no advertising tag on the site.
6. How long we keep it
Account data is kept while the account is open. An account whose email address is never confirmed and that has no plan is deleted 7 days after it was created, when its confirmation link expires. An account without a plan where no one has signed in for 90 days is deleted with its saved lists and organizations; we email a warning 7 days before, and signing in keeps the account. Ask us and we delete the account and its data; deleted data may stay in backups until they expire on their fixed schedule. Billing records may be kept longer where the law requires it. A removal request is kept for as long as the change it asked for stays in place.
7. Your rights
Depending on where you are, you may ask what we hold about you, have it corrected, or have it deleted. Write to us and we will answer within the time the law allows. If you think we have handled your personal data badly, tell us first; you can also complain to the CNIL (Commission Nationale de l’Informatique et des Libertés), which oversees us because the company is established in France.
8. Changes
We may update this notice. The date at the top says when it last changed, and we will tell account holders directly about changes that matter.