Privacy Policy

Volunteeritude LLC operates the platform under two names: "Volunteeritude" and "Yura." Both names refer to the same company, the same platform, and the same data practices. References to "Yura" in the product, our marketing, or this Policy mean Volunteeritude LLC.

This Policy does not apply to:

• Information practices of the organizations, schools, and universities that use Yura. They are independent entities. When an organization collects information from you through Yura (for example, through an application form, custom fields, or a document request), the organization determines what is collected and why. Contact the organization directly with questions about its practices.
• Third-party websites and services we link to (Section 12).

We use personal information to:

• Provide the Services: operate accounts; log, verify, and report volunteer hours; run events, programs, shifts, and applications; produce dashboards, reports, and exports for you and your organizations.
• Operate school and institutional programs: associate student accounts with the correct school, enforce restricted-account protections, and generate the reports the school requires (Section 8).
• Communicate with you: transactional and service emails (verification requests, event confirmations and reminders, milestone notifications, security notices), in-app notifications, and browser push notifications you enable. Optional product-update emails are sent only consistent with your email preferences, and every non-essential email includes an unsubscribe link.
• Provide AI-assisted features to organization administrators (Section 4).
• Improve the Services: analytics, debugging, performance measurement, and product research (feature polls, feedback).
• Protect the Services and our users: authentication, rate limiting, fraud and abuse prevention, security auditing, and enforcing our Terms of Use.
• Process payments for paid organization subscriptions.
• Comply with law: respond to lawful requests and meet our legal obligations.

We do not use personal information for third-party advertising, and we do not build advertising profiles. We do not make automated decisions about you that have legal or similarly significant effects.

Some Yura features for organization administrators use large-language-model technology provided by Anthropic (the Claude API):

• AI search and filtering: an administrator can ask a natural-language question about their own organization's data (for example, "who hasn't logged hours this month?"). To answer, we may send Anthropic relevant organization data — which can include volunteer names and email addresses within that organization, along with events, programs, and custom-field definitions.
• AI report drafting: administrators can generate report documents from their organization's data. To draft a report, the AI may query the organization's aggregated statistics and, where the administrator's request calls for it, individual service-log records within that organization (volunteer name, activity, date, hours, verification status) and responses to that organization's custom fields. Outputs are instructed to avoid including personal information beyond what the report requires.

Commitments that apply to all AI features:

• No AI training on your data. We use Anthropic's commercial API, which under Anthropic's commercial terms is not used to train Anthropic's models, and we do not permit any AI provider to use personal information from Yura to train or improve AI models. Student data is never used to train AI models.
• AI processing happens only to fulfill the administrator's specific request; we do not send reflections, journals, mood data, documents, or passwords to AI providers.
• AI outputs can be inaccurate and are a drafting/search aid only. Organizations are responsible for reviewing AI outputs before relying on them, and must not use AI outputs as the sole basis for decisions about a volunteer or student (see Terms of Use).
• If an administrator submits feedback on an AI response, we store that feedback together with the related prompt so we can improve the feature's design (not to train models). AI prompts are not otherwise retained.

• Strictly necessary cookies (authentication/session, security, signup consent) are required for the Services to function and cannot be disabled while using the Services.
• Analytics (PostHog): used to understand product usage and errors. You can limit analytics by using browser tracking protections or blocking requests to our /ingest analytics endpoint; core Services continue to work.
• Do Not Track / Global Privacy Control: we do not sell or "share" personal information for cross-context behavioral advertising, so there is no sale/sharing to opt out of. We do not currently respond to Do Not Track signals.
• No advertising trackers: we do not run third-party advertising pixels or ad networks on the Services.

We do not sell, rent, or trade personal information. We have never sold personal information. We do not share personal information for cross-context behavioral advertising.

We share information only as follows:

• Organization pages and events: organizations may publish public profile pages and public event listings. These show organization information and event details — public pages never display volunteer rosters, and our public data layer excludes personal contact details.
• Volunteer profiles: volunteer profiles are private by default.
• Photo galleries: organizations may publish photos approved by their administrators. Contact the organization (or us) if a photo of you should be removed.

This section applies when a school, district, university, or other educational institution ("School") uses Yura for its students.

• Role. We act as a service provider to the School. Where the School discloses education records to us, we operate as a "school official" with a "legitimate educational interest" under FERPA (20 U.S.C. § 1232g; 34 C.F.R. § 99.31(a)(1)), performing services the School would otherwise perform itself, under the School's direct control with respect to those records.
• Ownership and control. As between us and the School, student education records belong to the School (and to students and their parents as provided by law). We collect, use, and share student data only to provide the Services to the School, as directed by the School and our agreement with it, and as permitted by law.
• What we don't do with student data. We do not: sell student data; use it for targeted advertising of any kind; build profiles of students for any purpose other than providing the Services to the School; use it to train AI models; or disclose it except to subprocessors bound to equivalent commitments, as directed by the School, or as required by law.
• How student accounts work. Schools may arrange domain-based sign-in, where a student signing in with a school Google account is automatically connected to the school with a restricted account. Restricted accounts block collection of phone number, date of birth, and city/state/ZIP location fields, stay pseudonymous in product analytics, and are excluded from data sent to AI providers. Schools decide which optional data (for example, student ID or grade level via custom fields) they collect through Yura, and are responsible for limiting it to what is reasonably needed.
• Parents and eligible students. Requests to access, correct, or delete a student's education records should be directed to the School; we support the School in fulfilling them. Where required, the School is responsible for providing notices to, and obtaining consents from, parents and guardians.
• Deletion and return. When a School relationship ends, or upon a School's request, we will delete or return the School's student data within the timeframe stated in our agreement with the School (and no later than any deadline applicable law imposes — for example, North Carolina law requires deletion within 45 days of a school's request), except where law requires retention.
• Data processing agreements. We sign data processing/privacy agreements with School customers (including state or consortium standard forms where applicable). Where a signed School agreement conflicts with this Policy, the agreement controls for that School's student data.
• Breach notice. We will notify affected Schools without unreasonable delay of any breach involving their student data, consistent with our agreements and applicable law.

Yura is not directed to children under 13, and users under 13 are not permitted. We do not knowingly collect personal information from children under 13. School-provisioned accounts are intended for high-school students (13+). If we learn that we have collected personal information from a child under 13 without required consent, we will delete it promptly. If you believe a child under 13 has an account, contact us at admin@volunteeritude.com and we will investigate and delete as required, and we will honor a parent or guardian's request to review or delete their child's information as required by law.

For users aged 13–17, our Terms of Use require parental or guardian consent to use the Services, and where a School provisions accounts the School is responsible for any parental notice or consent its policies and applicable law require.

We apply additional protections to minors' data regardless of age: no targeted advertising, no sale of data, no AI training, and restricted-account data minimization for school-provisioned accounts (Section 8).

Available to everyone, regardless of state:

• Access and correction: view and update your profile and account information in settings at any time.
• Export: export your service-log history from the app (volunteers can self-export their logs); you may also request a copy of your personal information by email.
• Deletion: delete your account in Settings (on the web: Settings → Danger Zone; in the mobile app: Settings → Delete account) or by emailing us at admin@volunteeritude.com. Account deletion is permanent and immediate — your profile, service logs, journals, goals, awards, and document records are deleted and cannot be recovered. Copies that organizations exported before your deletion remain under their control. Uploaded files are removed from our storage systems following deletion; residual copies in encrypted database backups are purged on the backup provider's rolling schedule (approximately 30 days); and we may retain limited records where the law requires (for example, payment and tax records, and records of legal agreements).
• Email choices: unsubscribe from non-essential email via the link in any such email or in settings. Service and security emails (verification requests, password resets) are sent as needed while you have an account.
• Push notifications: enable/disable in your browser or device settings, and per-category in notification preferences.
• Profile visibility: volunteer profiles are private by default; note that administrators of organizations you belong to can view your profile information relevant to their program.
• Google account: you may disconnect Google Sign-In via your Google account permissions (ensure you have a password set first).

State privacy rights. Depending on where you live (for example, California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and a growing number of other states), you may have rights to: know/access the personal information we hold about you; obtain a portable copy; correct inaccuracies; delete your personal information; opt out of sale, sharing for targeted advertising, and certain profiling (we do not do these); limit use of sensitive personal information (we use none for secondary purposes); and not be discriminated against for exercising rights. Some states also grant a right to appeal a refusal: if we decline your request, you may appeal by replying to our decision, and we will respond within the timeframe your state's law requires; if your appeal is denied, you may contact your state Attorney General.

To exercise any right, use the in-product tools above or email admin@volunteeritude.com with the subject "Privacy Rights Request." We will verify your identity (usually via your account email) and respond within the time required by your state's law (typically 45 days). An authorized agent may submit a request on your behalf with proof of authorization. For student education records held for a School, we will refer the request to the School as described in Section 8.

California notice at collection. In the last 12 months we have collected these categories of personal information (as defined by the CCPA/CPRA): identifiers (name, email, username, IP address); customer-records information (phone, billing information); characteristics of protected classifications only if you or your organization choose to provide them (for example, date of birth; note that volunteer activity can imply affiliations such as religious or cause-based interests); commercial information (subscription records); internet/network activity (usage data, device data); general (not precise) geolocation inferred from IP; audio/visual (photos you upload); professional/educational information (school affiliation, volunteer history, organization-defined fields such as student ID or grade); and inferences only as needed to operate the Services (for example, hour totals against goals). Sources, purposes, and recipients are described in Sections 2, 3, and 6. We do not sell or share personal information as defined by the CPRA, and we do not collect or use sensitive personal information for purposes requiring a right to limit. Retention is described in Section 13.

We take security seriously and apply measures appropriate to the sensitivity of the data, including:

• encryption of data in transit (TLS/HTTPS enforced, including for our mobile app);
• passwords stored only as Argon2id cryptographic hashes (never in plain text);
• application-level encryption at rest for reflection and journal text, plus storage-provider encryption at rest for our database and file storage;
• role-based access controls (25-permission model) limiting what organization administrators can see and do; restricted-account protections for student accounts;
• rate limiting, login-attempt lockouts, and security audit logging of authentication and permission events;
• signed webhooks, scoped API credentials, and access-logged document storage with file-type (MIME/content) and size validation on uploads;
• vendor agreements requiring confidentiality and security for all subprocessors.

No system is completely secure. Please use a strong, unique password and contact us immediately at admin@volunteeritude.com if you suspect unauthorized access. If a security breach affects your unencrypted personal information, we will notify you and any affected customer organizations without unreasonable delay, consistent with applicable law (including S.C. Code § 39-1-90 and N.C. Gen. Stat. § 75-65) and our contractual commitments, and will notify regulators where required.

The Services contain links to third-party sites (organization websites, social media, video-conference links for virtual events, maps). Their privacy practices are their own; review their policies before providing information. Public marketing pages on our site may embed third-party content (for example, a hosted demo video), which can receive standard technical data (like IP address) from your browser when it loads.

We keep personal information only as long as needed for the purposes described in this Policy:

Where this table and a signed customer agreement differ, the agreement controls for that customer's data.

We may update this Policy as our practices, the law, or the Services change. For material changes we will: post the updated Policy with a new Effective Date and version; email the address on your account at least 30 days before the changes take effect (or such longer notice as our School agreements require); and display an in-product notice. For School customers, we will not make material changes to student-data practices without providing the notice required by our agreements and applicable student-privacy laws. If a change materially expands how we use previously collected personal information, we will obtain any consent the law requires. Prior versions are available on request.

The Services are operated from the United States, are intended for users located in the United States, and store data in the United States. If you access the Services from outside the United States, you do so on your own initiative, and your information will be processed in the United States. The Services are not directed to residents of the European Economic Area or the United Kingdom.

Volunteeritude LLC
4030 Wake Forest Road, Ste 349, Raleigh, NC 27609
Email: legal@volunteeritude.com (subject line "Privacy Inquiry" or "Privacy Rights Request")

We respond to privacy inquiries within 30 days, and to verified rights requests within the time applicable law requires.