Massive Good Privacy Policy

1. Scope and Responsible Organization

1.1 Our role. Massive Good is responsible for personal information it determines how and why to process in operating its Services, subject to any actual role governed by applicable law. This Policy covers visitors, Applicants, Nominators, proposed and actual Beneficiaries, Donors, Participants, Media Subjects, property controllers, applicants for work, employees, volunteers, case managers, contractors, and people who correspond with us or are lawfully included in a case or activity.

1.2 Channels. The Policy applies to information received through websites, forms, chat, AI-assisted interviews, email, telephone, text, messaging, electronic documents, public records, authorized verification, in-person discussions, visits, projects, deliveries, events, filming, administration, and disputes. It covers related records and inferences we create from permitted information, as well as information someone directly supplies.

1.3 Other organizations. Stripe, a healthcare provider, licensed professional, employer, contractor, carrier, public platform, sponsor, government body, or another independent organization may determine its own processing and have separate notices and legal duties. A service provider may also process information on our behalf. The actual role matters; a shared mission or participation in a case does not make every organization the same data controller.

1.4 More specific permissions. A legally required health-data consent, professional-record authorization, recording permission, biometric notice, workplace notice, marketing choice, or other specific disclosure may supplement this Policy. More specific mandatory requirements govern the relevant processing. Acceptance of the Terms of Service, a donation, a nomination, or ordinary correspondence does not replace consent in the particular form law requires.

1.5 International scope. We may receive requests, donations, communications, and participation from different countries. The law applying to a person, activity, organization, or record determines which rights and duties apply. Our Texas location does not eliminate a mandatory privacy protection applying elsewhere.

2. Information You Provide

2.1 Identity and contact. We may collect names, email addresses, telephone numbers, postal and project addresses, account identifiers, date of birth or adult-status information, language, communication preferences, identity-verification information, and information about a representative’s capacity and authority.

2.2 Case circumstances. Depending on a request, we may receive personal narratives, household and family circumstances, relationships, living conditions, employment, income, expenses, debts, assets, benefits, insurance, other assistance, requested support, estimated costs, urgency, safety concerns, referrals, and correspondence. These records may include information about other people, allegations, or disputed facts.

2.3 Health and highly sensitive information. A case can include diagnoses, symptoms, disabilities, mobility and functional limitations, injuries, medical history, treatment, medications, equipment needs, clinician information, mental-health or substance-use information, reproductive or sexual-health information, dietary needs, allergies, care arrangements, protected status, abuse or safeguarding concerns, and records revealing a request for health-related support. You may include such information in a narrative or image even when we have not requested a particular detail. Sections 20 through 27 provide further details about covered consumer health information.

2.4 Documents and verification. Where relevant and lawfully obtained, we may receive identification documents, authority or guardianship documents, medical and provider records, benefit statements, financial records, bills, receipts, tax information, title and lease documents, insurance evidence, permits, licenses, inspections, background or eligibility records, and other supporting materials. Do not send a complete government identifier, full payment credential, or unrelated sensitive record unless it is actually needed and requested through an appropriate process.

2.5 Property and project information. We may collect ownership and occupancy information, addresses, property interests, access arrangements, plans, measurements, functional needs, existing conditions, hazards, photographs, materials and equipment details, quotations, permits, work orders, inspections, change records, completion information, warranties, maintenance concerns, and incident records. Home images and project records can disclose a person’s health, finances, routines, or location.

2.6 Donations and payments. Donation records may include name, contact details, payment amount, currency, date, campaign or preference, recurring instructions, receipt information, transaction identifiers, limited payment-method details available to us through the payment flow, tax-acknowledgment records, tribute or recognition preferences, error reports, and disputes. Stripe and other parties to the payment flow process the payment information required for their functions.

2.7 Audio video and stories. We may collect photographs, footage, audio, voice, image, likeness, statements, interviews, performances, narrative details, locations, production records, media materials you provide, and records of permissions and restrictions for authorized filming and publication. A recording may reveal incidental information requiring removal, restricted access, or additional permission before use.

2.8 Work and engagement information. Workforce and contractor records may include identity, contact details, applications, qualifications, licenses, experience, references, availability, contracts, work product, time and attendance, compensation, banking or tax information, expenses, benefits, professional insurance, screening records, accommodations, safety, performance, complaints, disciplinary information, and engagement termination. Additional rules apply to protected employment and screening information.

2.9 Communications and rights requests. We may retain messages, complaints, requests, case corrections, accessibility inquiries, consent records, privacy requests and appeals, legal notices, permission disputes, and information needed to investigate or respond. A request to exercise a right does not consent to unrelated publicity, marketing, or a new contractual waiver.

3. Information from Devices, Other Sources, and Inferences

3.1 Technical information. Our digital interfaces and providers may collect information such as IP address, approximate location, device and browser type, operating system, language, identifiers, referral source, pages or features used, timestamps, interaction events, logs, error reports, authentication information, and security signals. The actual information depends on the interface and technologies enabled.

3.2 Cookies and similar tools. Cookies, local storage, pixels, tags, scripts, SDKs, and comparable tools may support operation, authentication, preferences, performance measurement, security, analytics, or permitted marketing. Some are supplied by third parties. Additional consent or opt-out requirements may apply before a particular tool collects or discloses information. Section 10 addresses choices and restrictions.

3.3 Other people and providers. We may receive information from an authorized Nominator, family member, guardian, caregiver, property owner, case manager, employee, volunteer, professional, contractor, payment provider, insurer, sponsor, donor, public agency, or another person participating in a lawful case, verification, or activity. We may request direct confirmation from the person concerned when needed.

3.4 Public and verification sources. Lawful sources can include property, licensing, nonprofit, court, business, professional, and other public records; information a person has lawfully made public; and appropriately authorized identity, eligibility, reference, or background checks. A public record may be inaccurate or incomplete, and public availability does not itself justify every possible reuse.

3.5 Derived information. We may organize information into case records and create summaries, categories, estimates, eligibility observations, risk assessments, project requirements, fraud signals, and other relevant inferences. An inference about health or need may itself be sensitive personal or consumer health information. An estimate, record match, AI-generated label, or allegation is not necessarily a verified fact.

3.6 Location and biometrics. A supplied address, IP-derived approximate location, property image, or location associated with a service can identify a person. Precise device-location collection or legally regulated biometric identification, if introduced for an activity, requires the specific notice, lawful basis, and permission applicable to that processing. Ordinary images and audio are not automatically permission to create a faceprint, voiceprint, or other regulated identifying template.

4. How We Use Information

4.1 Operating the Services. We use permitted information to operate interfaces and records, facilitate communications, identify the relevant case or transaction, support accounts, provide information, administer requests, and perform other lawful operational functions. Acknowledgment, processing, or storage does not promise review, selection, a response, or aid.

4.2 Evaluating requests. We may use information to understand circumstances, verify identity and authority, assess needs and feasibility, estimate costs and risks, check available resources, identify appropriate providers, detect misleading submissions, prioritize or decline proposed cases, and manage related communication. Selection remains discretionary under the Terms and applicable law.

4.3 Planning and delivering assistance. For an authorized activity, information may support funding, purchasing, scheduling, property access, qualified professional input, construction or accessibility planning, permits, delivery, coordination, safety, handover, and applicable outcome documentation or follow-up. Share only what a particular person or provider lawfully needs for their role.

4.4 Payments and fundraising. We use donation and transaction information to process authorized payments, recurring instructions, cancellation, reconciliation, acknowledgments, accounting, errors, disputes, fraud controls, and legally required reporting. We may also administer lawful donor relationships, recognition, sponsorships, campaigns, fundraising communications, and permitted promotion, subject to required choices.

4.5 Filming and publication. With legally sufficient permission or another applicable lawful basis, information and media may be used to produce, edit, distribute, promote, archive, and discuss stories and projects, including through documentaries, websites, social media, fundraising, advertising, sponsor campaigns, broadcasts, and licensed distribution. Media rights and sensitive-information permissions have distinct legal requirements.

4.6 Administration and improvement. We may use information for lawful budgeting, procurement, planning, analytics, testing, quality assessment, record organization, service and workflow improvement, reporting, and evaluation of program outcomes. Use of sensitive information, AI, research, or identifiable publicity must remain within the applicable purpose, legal basis, and permission.

4.7 Personnel and contractors. We process information to consider and manage engagements, verify qualifications, allocate authorized tasks, administer lawful pay and expenses, supervise work, maintain safety and appropriate access, address performance and complaints, comply with employment and contracting obligations, and protect case confidentiality.

4.8 Protection and legal duties. Information may be used to detect fraud, protect people and systems, investigate a concern, assess a defect or incident, obtain legal or insurance advice, establish or defend claims, comply with lawful process, preserve appropriate evidence, meet reporting duties, and address a safeguarding or serious safety matter. These purposes do not authorize an unrelated public release of private files.

4.9 Necessary and optional information. Some data is needed for a transaction, authority check, legal obligation, or the specific assistance requested. You may decline to supply other information, but we may be unable to consider or perform an activity without genuinely necessary data or required lawful permissions. We do not treat every optional detail as necessary merely because collecting it would be convenient.

5. AI and Automated Processing

5.1 Uses of tools. We may use AI, transcription, translation, automation, and other third-party tools to conduct intake, organize records, summarize narratives, produce drafts, support verification, classify needs, estimate costs, identify risks, detect fraud, analyze patterns, and assist other lawful operations. Information submitted to an AI-assisted interface may be sent to a provider engaged for the relevant processing.

5.2 Inputs and outputs. Such tools may process prompts, narratives, documents, images, audio, transcripts, identifiers, technical records, summaries, and generated outputs relevant to the task. Their storage, access, diagnostic, and service-improvement processing depends on the applicable provider arrangement and lawful permissions. We do not represent that every provider operates without retention or that every AI service is the same.

5.3 Purpose restrictions. Use of personal information to develop or improve a tool, evaluate a model, or train a model must have the applicable legal basis and any required specific notice and consent. A private aid request or general Terms acceptance does not by itself authorize unrestricted public disclosure, independent third-party model training, or repurposing protected health records. A provider processing on our behalf must operate within its lawful instructions and processing arrangement.

5.4 Accuracy and review. Automated outputs may be inaccurate, incomplete, biased, or misleading. They are not medical diagnoses, ownership determinations, professional certifications, or funding promises. We do not guarantee that every output or case receives human review. Notify [email protected] of a material error relevant to your case or rights.

5.5 Consequential decisions. Where applicable law protects against a solely automated decision with legal or similarly significant effects, you may have a right to meaningful information, human intervention, challenge, or other required protection. General intake automation does not eliminate those rights. Information about the actual process and an applicable review request can be sought through our privacy contact.

6. Stripe Donations and Payment Information

6.1 Payment flow. Online donations are processed through Stripe. Payment methods and the relevant Stripe services may collect credentials, billing, identity, device, fraud, and transaction information needed for processing and their legal obligations. Depending on the function, Stripe may act as a processor or an independent controller under its own notices.

6.2 Our records. We may receive transaction status, amount, currency, donor and contact information, recurring settings, identifiers, limited payment-method information, receipts, and other records made available through the relevant payment arrangement. We also receive information you separately send about a charge, cancellation, acknowledgment, or dispute. Do not email full card details, passwords, or unnecessary banking information.

6.3 Recurrence and cancellation. Recurring authorization comes from the actual disclosed payment choice. Cancel future recurring donations through [email protected] or available controls in your applicable Stripe donation or billing flow. Cancellation does not itself delete transaction records or create a right to a refund of a completed donation; applicable law and valid payment terms control.

6.4 Independent privacy practices. Stripe’s privacy notice is available at https://stripe.com/privacy. Banks, payment networks, and other parties to a selected method may have their own notices. Contact the responsible organization for information it controls independently. We remain responsible for the duties applying to our own processing and instructions.

6.5 Recognition and anonymity. A recognition preference can affect authorized public acknowledgment but does not prevent necessary payment, accounting, compliance, or legally required disclosures. A donation does not grant the Donor access to a Beneficiary’s private records or the right to dictate another person’s disclosure.

7. Who May Receive Information

7.1 Authorized personnel. Information may be available to employees, case managers, volunteers, officers, and authorized representatives for the lawful duties relevant to their participation, subject to applicable access, confidentiality, and sensitive-information restrictions. A person’s job title does not grant a right to use a case file for an unrelated purpose.

7.2 Technology and administrative providers. We may disclose relevant information to hosting, database, storage, AI, transcription, communications, support, analytics, security, identity-verification, accounting, payment, legal, and other providers performing permitted functions. Their role and necessary data depend on the engagement. Legally required processor contracts, safeguards, and limits apply to processing on our behalf.

7.3 Project and professional participants. Relevant information may be supplied to contractors, subcontractors, suppliers, architects, engineers, accessibility specialists, medical or other licensed providers, transport or housing providers, property controllers, inspectors, insurers, or other people lawfully assisting a requested or approved activity. We may disclose functional needs, contact details, project conditions, scope, or other appropriate information rather than an entire unrelated file.

7.4 Representatives and connected people. A verified guardian, authorized representative, caregiver, property owner, or person you lawfully direct us to contact may receive information within their actual role and authority. We do not give every family member or Nominator an unrestricted right to another person’s case, medical records, or privacy-request response.

7.5 Donors sponsors and collaborators. We may share lawful campaign information, authorized stories, appropriate project updates, or information necessary for an agreed sponsorship or collaboration. Private, identifiable health, financial, location, or other protected details require the lawful basis and any specific permission applicable to the disclosure. Donating does not itself authorize access to private case files.

7.6 Production and public recipients. Producers, editors, crew, broadcasters, distributors, publishers, platforms, sponsors, licensees, audiences, and the public may receive media and personal-story information within valid recording, publication, and sensitive-data permissions. Authorized public distribution can make information available internationally, searchable, and independently copied. Section 9 explains the consequences and limits.

7.7 Advisers authorities and claims. We may disclose information lawfully necessary to attorneys, accountants, auditors, insurers, professional advisers, regulators, courts, law enforcement, safeguarding services, or other appropriate recipients to comply with law, investigate a concern, address serious safety matters, secure advice, or establish or defend a claim. We do not treat a private dispute as blanket authorization for public disclosure.

7.8 Organizational arrangements. Information may be handled in a lawful collaboration, reorganization, successor arrangement, or transfer of relevant operations, subject to compatible purposes, confidentiality, accepted restrictions, and required notice or consent. Corporate affiliation alone is not a lawful basis for unrestricted sharing. The specific affiliate and recipient restrictions in Section 23 apply to covered health information.

7.9 Your direction and other lawful disclosures. We may share information at your valid direction, with appropriate permission, or as another applicable legal basis allows for a described purpose. “Sharing” in this Policy is a general description unless a particular statutory definition is identified. A category of possible recipients is not permission to disclose every record to every member of the category.

8. Sensitive Records and Required Permissions

8.1 Health-data consent. Consumer health data can be protected even when it is not a clinical record or information held by a healthcare provider. Sections 20 through 27 address categories, sources, purposes, recipients, consent, and rights for covered consumer health processing. Additional local requirements can apply to health, genetic, biometric, location, intimate, or other sensitive information.

8.2 Professional records. A healthcare provider or other regulated source may require a compliant, source-specific authorization before releasing a record. The authorization may need to identify information, discloser, recipient, purpose, expiration, signature, revocation, and other required statements. We may require this additional process before accessing a record. A Nominator’s assertion or website checkbox is not automatically sufficient.

8.3 Separate legal regimes. Particular records may be governed by HIPAA, substance-use confidentiality, professional confidentiality, education, safeguarding, employment, or local privacy rules. Holding a health-related case does not itself establish that every record has the same legal status or that every participant is a healthcare entity. The actual record, role, source, recipient, and applicable law determine the requirements.

8.4 Record use and redisclosure. Information supplied through an authorization is used within its lawful purpose and restrictions. Required consent withdrawal, limitations, and redisclosure rules apply. A production license or a reference to third-party services does not override a protected record’s restrictions.

8.5 Information about another person. Before providing another person’s record, you must have an appropriate lawful basis and required permission, or begin with a nonidentifying description. We may seek direct confirmation, restrict processing, or require a representative’s proof of authority. Permission to discuss one expense does not necessarily authorize a complete medical history or public identification.

9. Filming and Public Stories

9.1 Program filming. Our programs may require authorized filming and sharing as a participation condition where law permits. You may decline a proposed program. Case selection is discretionary, but a participation condition cannot replace required freely given or otherwise valid sensitive-information consent or allow recording that law prohibits. Permission may be limited for particular sensitive details while other lawful project footage is authorized.

9.2 Media data and purposes. Authorized footage and stories may include identity, voice, likeness, statements, personal circumstances, needs, home conditions, work, assistance, progress, and outcomes. Permitted uses may include documentaries, editorial and educational works, websites, social media, broadcasts, fundraising, advertising, sponsor materials, archives, excerpts, translations, and licensed distribution. The actual lawful permission and accepted restrictions govern.

9.3 Production technology. Editing, translation, illustration, reconstruction, and authorized synthetic voice or visual elements may involve production and AI tools. They must remain within valid permissions and required disclosures. A publicity grant does not automatically supply consent for regulated biometric identification or an unlawful false portrayal.

9.4 Separate recording and disclosure. Consent to record, a location permission, a publicity grant, and permission to disclose sensitive records can be different legal permissions. We may require specific electronic acceptance or another legally adequate process for each relevant permission. You cannot give another unrelated adult’s consent merely because they are nearby, and a representative may act only within actual lawful authority.

9.5 Production recipients. Authorized production and distribution can involve crew, editors, outside producers, media partners, platforms, sponsors, and the public. A paid license or other transfer involving consumer health data may trigger special sale-authorization requirements. General media acceptance is not the separate statutory authorization such a transfer requires.

9.6 Public availability. Published information may be seen worldwide, indexed, copied, excerpted, commented on, or independently redistributed. It may attract unwanted attention or criticism. We do not control every third-party reaction or guarantee complete recall of public copies. Removing content from a channel we control does not necessarily remove independently held copies.

9.7 Permissions and rights requests. Media permissions may have a continuing lawful contractual term, but mandatory consent-withdrawal, deletion, restriction, or other privacy rights remain. Contact [email protected] about a permission or safety concern. We handle a request according to the actual permission, processing basis, record, and applicable law rather than treating every license as an irreversible waiver of privacy rights.

9.8 Sensitive location and safeguarding. Tell us about a protective order, stalking concern, child-safety issue, confidential address, health setting, or another material disclosure risk before an authorized activity. Required restrictions and accepted limitations control. A dispute does not authorize retaliatory disclosure outside valid permissions.

10. Cookies Analytics and Marketing Technologies

10.1 Purposes. Operational technologies may support site functionality, authentication, preferences, security, error detection, and delivery. When enabled, analytics or advertising technologies may measure interactions, assess fundraising performance, or support lawful promotion. They can process identifiers, IP addresses, pages, events, referrals, or other technical information. Applicable notice, consent, and opt-out requirements depend on the technology and use.

10.2 Controls. Browser settings may allow you to remove or restrict cookies and local storage. Device and provider controls may address particular identifiers or permissions. Blocking a technology can affect functionality. A browser control is not necessarily equivalent to a legal opt-out, and rejecting optional processing must be effective where applicable law requires that choice.

10.3 Sensitive interfaces. Technical information from a health-related intake page, query, event, or identifier can reveal health interests or case details. We do not treat a pixel, analytics transfer, or referral as legally harmless simply because it lacks a clinical record. Sensitive-data collection or disclosure requires the lawful basis and specific permission applicable to it; this Policy does not authorize prohibited transfers through an advertising tool.

10.4 Marketing choices. You may unsubscribe from an email through an available link or contact [email protected]. Regulated calls and texts require appropriate permission and applicable opt-out handling. Opting out of marketing does not necessarily stop necessary transaction, security, rights-request, or legal communications. General Terms acceptance does not supply an undisclosed marketing consent.

10.5 Preference signals. Where applicable law requires recognition of a qualifying universal opt-out or privacy preference signal, that requirement applies to the processing it governs. A signal may apply to a browser or device without identifying all of your other records. You may also submit a relevant opt-out request to our privacy contact. A general browser “Do Not Track” setting is not treated as equivalent to every legally recognized signal.

10.6 Statutory sale and sharing. Some advertising or other disclosures may qualify as “sale,” “sharing,” or targeted advertising under a particular law even without a conventional cash sale. When that law applies, the relevant disclosure, consent, opt-out, sensitive-information, and nondiscrimination rules govern. Charitable status does not create a universal exemption for every health, communications, biometric, or other privacy rule.

11. Children Representatives and Vulnerable People

11.1 Adult online intake. Our direct online intake and agreement process is intended for people at least eighteen years old and legally able to enter the applicable agreement. People below that age must use a legally authorized adult or an appropriate separately arranged process. Children may receive assistance or participate in properly authorized activities; that does not authorize direct collection and public use of all their information.

11.2 Unauthorized child submissions. A child can contact us despite an age restriction. If we learn that information was collected from a child through an unauthorized process, we may restrict processing to appropriate safety, verification, lawful response, or obtaining required adult involvement, and must delete, restrict, or otherwise handle it as applicable law requires. An age statement in the Terms does not replace a mandatory child-privacy requirement.

11.3 Required permission. Appropriate parent, guardian, representative, child-consent or assent, provider, court, employment, or other permission must be obtained for the relevant information, activity, and publication where required. A representative must have the particular authority needed. One adult’s approval does not necessarily control another parent’s rights, a child’s independent rights, or a protected adult’s own choices.

11.4 Publication and sensitive details. Child and vulnerable-person stories can require additional safeguards, limitations, or permissions. Recording permission does not by itself authorize a prohibited commercial use, intimate disclosure, identifying location, or regulated performance. Applicable local law controls, including any direct rights the person may exercise.

11.5 Contact. A parent, guardian, represented person, or authorized representative may contact [email protected] about child information, authority, consent, or a safeguarding-related privacy concern. We may request proportionate evidence before disclosing another person’s information. Contact emergency services immediately for imminent danger.

12. Personnel and Contractor Information

12.1 Engagement purposes. We use relevant records to assess applications, engage personnel and vendors, verify qualifications, administer lawful compensation, expenses and taxes, supervise authorized duties, maintain access, coordinate projects, address safety and safeguarding, assess work and performance, investigate concerns, and comply with actual legal and contractual obligations.

12.2 Employment entity and providers. The actual employer or engaging organization determines its own responsibilities. Payroll, benefits, recruiting, reference, screening, legal, insurance, and other providers may handle relevant information in their actual roles. This Policy does not establish that every person working on a case is employed by Massive Good.

12.3 Sensitive workforce data. Accommodation, medical, benefit, protected-status, government-identifier, banking, and screening information is subject to its applicable legal restrictions and permissions. It is not authorized for a public case story merely because the worker also participates in a project or fundraising activity.

12.4 Work systems and records. Authorized organizational systems may generate access, communication, project, performance, security, and incident records. Any legally regulated monitoring, recording, location tracking, or biometrics requires the applicable notice and lawful basis. This Policy does not grant unrestricted access to personal accounts or replace a mandatory workplace-monitoring notice.

12.5 Rights and protected activity. Privacy, employment, record-access, labor, whistleblower, and other mandatory rights remain available. A confidentiality obligation does not prohibit a legally protected report or consultation with counsel. Workforce information is not automatically deletable if an applicable employment, tax, claim, or record law requires retention, but any exception must be lawful for the record concerned.

13. Security and Service Continuity

13.1 Risk and third parties. Information may be transmitted, stored, or processed through third-party infrastructure and services. No website, communications channel, storage service, AI system, or provider can be guaranteed secure against every unauthorized access, loss, disclosure, disruption, or attack. We do not promise a particular certification, encryption implementation, recovery time, independent backup service, or absolute confidentiality through this Policy.

13.2 Applicable duties. Security and access duties imposed by applicable law continue to apply. A disclaimer, provider contract, permission to process, or acceptance of the Terms does not waive a required standard of care or legally required breach response. Covered consumer health data has the additional security and processor requirements stated in Section 25.

13.3 Your accounts and submissions. Use appropriate account protection and avoid submitting unnecessary sensitive details, passwords, full payment credentials, or information you lack authority to disclose. Do not use a public comment or social post to send a private medical file. Maintaining your own records is prudent because the Services are not offered as your personal document-storage or backup service.

13.4 Providers and recovery. A provider may have its own operational copies, archives, backups, security arrangements, and recovery capabilities. These vary by service and actual configuration. We do not guarantee that every submitted file can be restored or that every provider copy can be removed immediately; legally required deletion and security obligations still apply.

13.5 Concerns and incidents. Report suspected unauthorized access, misdirected records, exposed case information, or another security concern to [email protected] with enough information to identify it. Do not access additional private information to investigate without authority. Required incident notices and other response duties are determined by the law applying to the actual information and role.

14. Retention Deletion and Records

14.1 Ongoing records. We maintain case, project, donation, media, personnel, permission, and operational records on an ongoing basis and do not promise routine deletion after a universal fixed period. Closing a case, declining assistance, completing a project, cancelling a recurring donation, or ending an account does not itself delete all related information. Retention is subject to actual lawful purposes and mandatory limits.

14.2 Retention criteria. Relevant criteria include the ongoing relationship; case administration and possible lawful follow-up; accounting, tax, charitable-fund and transaction requirements; project, product and workmanship records; permission and media-use evidence; employment and contracting duties; safety and fraud concerns; investigation, insurance, claim and limitation periods; and legally required preservation. Where law requires necessity-based or limited retention, information may not be kept indefinitely merely because storage is available.

14.3 Case and sensitive records. A case can contain health and intimate information that is not necessary for every accounting or project record. A permitted need to preserve a transaction, scope, or permission does not automatically justify retaining the entire sensitive narrative. Consumer-health deletion and other mandatory rights apply to the records within their legal scope.

14.4 Media and public copies. Original production materials, permissions, authorized completed works, and public copies can have different lawful retention bases. A continuing media license does not override mandatory withdrawal or deletion. We may be unable to remove independently held public copies, but must take actions actually required by law for information we control and required recipient notifications.

14.5 Requests and exceptions. You may request deletion through [email protected]. We apply the rights and exceptions of the law governing the record, such as legally required accounting, employment, privilege, fraud, claim, or other justified preservation where permitted. We do not apply a universal “never delete” exception or use a generic litigation label to defeat a mandatory health-data deletion right.

14.6 Provider systems. Legally required deletion may involve providers, recipients, operational copies, archives, and backups. Any permitted delay or retention restriction is governed by the specific law and role. We do not claim that deleting an interface automatically removes every provider copy. Section 25.4 specifies Washington’s applicable backup-deletion limit.

14.7 Deidentified records. Where permitted, information may be genuinely anonymized or deidentified instead of retaining an identifiable record. The required legal standard must be met; removing a name from a distinctive diagnosis, home, voice, or small-community story may be insufficient. Required restrictions against reidentification apply when relying on deidentified status.

15. Your Choices and Privacy Requests

15.1 Information and permissions. You may choose what to provide, decline a proposed program, request clarification, correct relevant information, and exercise applicable consent and privacy rights. We may be unable to process a transaction or deliver a particular requested activity without necessary information or lawful permissions. Providing information or accepting a permission does not guarantee review or assistance.

15.2 Rights under applicable law. Depending on the law, information, and relationship, rights may include confirmation of processing; access and a copy; correction; deletion; restriction; portability; consent withdrawal; objection to particular processing; opt-out of sale, advertising sharing, targeted advertising, or certain profiling; an explanation or challenge of a consequential automated decision; appeal; and complaint to a regulator. Section 26 describes additional rights for covered consumer health data.

15.3 How to request. Email [email protected] or write to Massive Good Inc., 500 W 2nd St, Floor 19, Suite 16, Austin, Texas 78701, United States. State the relevant relationship, information, and right requested. You need not create a new account solely to make a request where law forbids that requirement. Use only the identifying information reasonably needed to locate the relevant records.

15.4 Authentication and representatives. We may request proportionate information to confirm identity, locate records, and prevent an unauthorized disclosure or deletion. An agent, guardian, or other representative must demonstrate the authority applicable to the request. Additional confirmation is limited by law; a representative’s authority does not provide access beyond what the represented person’s rights and applicable restrictions permit.

15.5 Responses and limits. Applicable law determines response deadlines, permissible extensions, fees, exceptions, and required reasons. Where a right applies, we respond through the required process and explain a lawful denial or limitation. Necessary protection of another person’s information, privilege, or legal records applies only within the exception actually permitted by that law.

15.6 Appeals. Where an appeal right applies, send an appeal to [email protected] identifying the request and reason for review. We provide the response and regulator information required by the applicable law. Section 27.1 states the Washington consumer-health appeal deadline.

15.7 Withdrawal and objection. A valid withdrawal stops the relevant future consent-based processing as law requires, without necessarily making earlier authorized processing unlawful. An objection, opt-out, or withdrawal may not eliminate processing supported by another lawful basis or a mandatory record obligation. We do not use an unrelated basis to evade a specific legal restriction.

15.8 No unlawful retaliation. Exercise of a protected privacy right does not authorize unlawful discrimination or retaliation. If essential information cannot lawfully be processed, a genuinely dependent service may be unavailable. That practical limitation is subject to the applicable rule and must not be used as an unlawful penalty for exercising a right.

16. United States Privacy Rights

16.1 Nonprofit status and applicable laws. Some general state privacy laws exclude particular nonprofit organizations, but other privacy, consumer-health, communications, biometric, breach, professional, employment, fundraising, and child-related rules may still apply. The actual law and facts determine coverage. We do not claim that our charitable status exempts every record or participant.

16.2 State rights. If an applicable state law covers the processing, its access, correction, deletion, portability, consent, opt-out, sensitive-information, agent, appeal, and nondiscrimination requirements apply. Requests and appeals may be sent to [email protected]. Technical-information categories, purposes, and recipient categories are described in Sections 2 through 10.

16.3 California. To the extent California law applies, relevant rights can include access, correction, deletion, portability, opt-out of legally defined sale or sharing, limitation of certain sensitive-information uses, authorized-agent requests, and protected preference signals. Processing for the actual case, transaction, employment, or agreed activity remains subject to applicable legal bases and exceptions. An additional legally required notice at collection is not replaced by an assumption that all nonprofit processing is exempt.

16.4 Consumer health. Washington and other jurisdictions may protect nonclinical health information held by a nonprofit. Sections 20 through 27 describe covered collection, sharing, purposes, recipients, requests, and appeals. A general Texas governing-law clause does not displace mandatory local consumer-health rules.

16.5 Communications and special information. Audio recording, precise location, biometric identification, protected medical or education records, background checks, and regulated calls or texts can have separate notice and consent requirements. A standard Terms checkbox does not waive those requirements.

16.6 Complaints and enforcement. You may contact a competent regulator or other authority about protected processing without first agreeing to a new release or exhausting a contractual complaint process where law does not require it. A dispute-resolution clause does not extinguish a substantive privacy right or a regulator’s enforcement power.

17. European United Kingdom and Swiss Information

17.1 Applicability and controller. Where European, United Kingdom, or Swiss data-protection law applies to our processing, Massive Good Inc. is the responsible organization for the purposes it determines, at the contact and address stated in this Policy. An independent provider may be a separate controller for its own processing. This section applies within the law’s actual territorial and material scope.

17.2 Lawful bases. Depending on the activity, bases may include consent; steps requested before an applicable agreement and performance of that agreement; compliance with a legal obligation; legitimate interests where not overridden by your rights and interests; and protection of vital interests where the legal conditions are met. A request for urgent help does not mean we have undertaken an emergency service or that every processing operation qualifies as vital-interest processing.

17.3 Legitimate interests. Relevant interests can include administering charitable programs and proposed cases, managing relationships and lawful fundraising, coordinating authorized work, protecting people and systems, detecting fraud, keeping justified operational records, assessing performance, securing professional advice, and establishing or defending claims. These interests do not override an express consent requirement, a prohibited disclosure, or the protections applicable to a child or sensitive information.

17.4 Special-category information. Health, biometric identification, and other special-category information require an applicable additional legal condition. Where we rely on consent, it must satisfy the relevant specific, informed, freely given, and explicit requirements. Public disclosure, fundraising media, or independent model training is not automatically necessary to providing assistance merely because it supports our organization. Criminal-history information requires its own lawful conditions where applicable.

17.5 Information and necessity. Sections 2 through 7 describe categories, sources, purposes, and recipients. Section 14 describes retention criteria. Necessary information may be required to perform a transaction, verify authority, comply with law, or arrange the specific activity requested. Refusal can prevent that particular activity but does not authorize an unlawful consent condition.

17.6 Rights. Applicable rights may include access, rectification, erasure, restriction, portability, withdrawal of consent, objection to legitimate-interest processing, objection to direct marketing, and protections concerning solely automated decisions with legal or similarly significant effects. Object to direct marketing or withdraw relevant consent through [email protected]. Rights have the limits and exceptions provided by the applicable law.

17.7 Complaints. You may lodge a complaint with the competent supervisory authority, including in the jurisdiction where you ordinarily live, work, or believe an infringement occurred where the law provides that right. You need not waive the right by accepting these Terms or a media grant. Contact us for information about the processing relevant to your request, including legally required representative or local-contact information for the activity concerned.

18. International Processing and Transfers

18.1 Processing locations. Massive Good operates from the United States. Information may be processed in the United States and in other countries where an authorized provider, professional, production partner, recipient, or activity operates. Laws, access rights, government powers, and available remedies can differ from those in your country.

18.2 Transfer requirements. Where law requires a transfer mechanism or safeguard, the relevant processing must satisfy that requirement, such as an applicable adequacy arrangement, valid contractual safeguard, or another legally permitted mechanism. We do not claim a certification, data-residency guarantee, binding corporate rules, or an executed transfer instrument solely through this Policy. Request information about a transfer concerning your records through [email protected].

18.3 Consent limits. Using the site, donating, or corresponding does not supply every consent or exception required for an international transfer. An explicit-consent or other exceptional mechanism may be used only where legally available for the actual transfer and with the information and safeguards required. A provider’s global availability does not automatically establish legality for protected data.

18.4 Local duties. Local restrictions on health records, children, employees, sensitive information, publication, or transfers continue to apply when mandatory. No provision waives a required local representative, notice, contractual arrangement, regulatory approval, or other obligation if it applies to the actual activity.

19. Publicity Advertising and Other Data Disclosures

19.1 Described purposes. We may use and disclose information for the operational, fundraising, professional, media, legal, and other lawful purposes described in this Policy. We do not treat a broad recipient description as an unlimited license to sell, advertise with, or publicly expose every submitted record.

19.2 Fundraising and recognition. Donor and supporter information may support permitted fundraising, relationship administration, authorized recognition, and sponsorship activity. Private case and health details require the specific lawful basis and permission applicable to the disclosure. A donor preference to hear a story does not override a Beneficiary’s privacy rights.

19.3 Regulated transfers. A disclosure for money, other value, targeted advertising, or paid media licensing may be regulated as a sale or sharing under a particular law. Applicable notice, separate authorization, opt-out, sensitive-information, or other requirements must be met before the relevant transfer. A health-data sale requires the distinct authorization described in Section 24 where that rule applies.

19.4 Aggregates and deidentification. We may use lawful aggregate, anonymized, or genuinely deidentified information for reporting, analytics, research, planning, and demonstrating program outcomes. A distinctive story, image, voice, rare condition, or household combination may remain identifiable. We do not rely on deidentified status unless the applicable standard and any required safeguards are satisfied.

19.5 Research and new activities. A proposed research, experimental, clinical, or materially different processing activity may require additional professional, ethics, privacy, or consent requirements. Calling an activity “improvement” does not itself supply those permissions. A material new purpose is subject to Section 28 and applicable law.

20. Covered Consumer Health Information

These consumer-health provisions apply where the Washington My Health My Data Act, Nevada consumer-health law, or another applicable consumer-health rule governs the information. Sections 20 through 27 control an inconsistent general description elsewhere in this Policy for the covered health data. The changes and contact provisions in Section 28 also apply.

20.1 Scope. Consumer health data is personal information linked or reasonably linkable to a person that identifies physical or mental health status or a protected health relationship within the applicable law. It can include information about seeking assistance, treatment, accommodation, medication, equipment, or a health service, not just a clinical diagnosis. A contact identifier, location, or inference can be covered when linked to that information.

20.2 Applicable persons and records. Washington coverage can include a Washington resident or a person whose covered data is collected in Washington within the statutory definition. Other jurisdictions have their own definitions, exclusions, and territorial rules. Any exemption for a particular legally protected record does not automatically exempt all case information or the entire organization.

20.3 No universal authorization. A nomination, donation, general Terms acceptance, media license, or submission about another person does not itself supply all required health-data consent. Collection, sharing, and sale can require different permissions. We apply the law and permission appropriate to the actual information, purpose, source, and recipient.

21. Health Data Categories and Their Purposes

21.1 Conditions and symptoms. Submitted information can include diagnoses, symptoms, injuries, medical history, physical or mental conditions, and related records. These may be used to understand the described need, assess feasibility and safety, verify relevant authorized facts, identify a suitable proposed activity, and administer permitted assistance.

21.2 Disabilities and functional needs. Mobility, sensory, cognitive, functional, accessibility, dependency, and care-arrangement information may be used to assess accommodations, equipment, home conditions, access, design, appropriate professional input, and individualized project suitability.

21.3 Care and resources. Treatment, procedures, medications, equipment, provider details, appointments, insurance or benefit information revealing a health relationship, health expenses, and requests for health-related funding or services may be used to understand and verify a requested resource, coordinate appropriately authorized providers, arrange assistance, and administer relevant transactions.

21.4 Particularly sensitive details. A narrative or record may include mental-health, substance-use, reproductive or sexual-health information, genetic or diagnostic details, dietary needs, allergies, or safeguarding circumstances relevant to health. Their use requires the applicable lawful purpose and permission. An open narrative does not demand every intimate detail.

21.5 Media and communications. Authorized photographs, footage, audio, interviews, documents, messages, and personal stories may reveal health conditions, disability, care, or health-service interests. Private processing can support case administration and authorized work. Public-story use, fundraising, promotion, sponsor content, and distribution require the separate lawful permissions applicable to that use.

21.6 Identifiers location and inferences. Case identifiers, name and contact details linked to health information, an address or service location revealing a health relationship, summaries, classifications, estimates, and health-related inferences derived from permitted inputs can be covered. These may support record organization, case communication, relevant verification, feasibility, safety, project coordination, and lawful administration. They are not anonymous merely because an AI tool generated them.

21.7 Other lawful administrative purposes. Covered information may be used as law permits to address a complaint, incident, defect, safeguarding matter, consent or rights request, fraud concern, legal requirement, professional advice, insurance issue, or establishment or defense of claims. A statutory exception is used only within its actual conditions and is not a general permission for unrelated publicity or indefinite retention.

21.8 New purposes. New health-data categories and materially additional purposes requiring consent must be disclosed and accepted through the required process before processing. Public media, targeted advertising, independent model training, and data sale are not assumed necessary to providing assistance merely because they could benefit our organization.

22. Sources of Health Information

22.1 The consumer. Sources include information you choose to provide through intake, chat, documents, email, telephone, interviews, an authorized activity, filming, or a rights request.

22.2 Authorized people and records. Information may come from a legally authorized Nominator, parent, guardian, representative, caregiver, provider, professional, property controller, or other participant in a permitted case or project, with the lawful basis and permissions needed for the disclosure. A person’s assertion of authority may require direct confirmation.

22.3 Activities and systems. We may receive health-related project observations, images, equipment or accessibility information, authorized communications, or relevant technical and service data produced during lawful participation. Regulated collection through a device, precise location, biometric process, or confidential recording requires its applicable permission.

22.4 Derived information. Case managers, authorized professionals, and AI or other tools may create health-related summaries, classifications, functional observations, or inferences from lawfully processed information. These remain covered where the definition applies and may require correction when inaccurate.

22.5 Other sources. A public or professional record can be used only where the applicable law allows the source and purpose. This policy does not authorize unlawful access to records, prohibited health-facility tracking, or an undisclosed collection from a health-data broker.

23. Health Data Collection Sharing and Recipients

23.1 Collection permission. Where applicable law requires consent, we collect covered data with valid affirmative consent for the identified categories and purposes, or only within a legally available exception for processing necessary to provide the particular service the consumer requested. An unrelated person’s nomination is not automatically a service request by the consumer described.

23.2 Separate sharing permission. Where required, consent to sharing is separate and distinct from consent to collection. We do not treat acceptance of a general document as the distinct choice. A requested-service exception extends only to the information and disclosure actually necessary under the applicable rule. Processing by a properly engaged processor is subject to its legal requirements and binding instructions.

23.3 Categories that may be shared. Within valid permission or another applicable lawful basis, shared categories can include relevant conditions, symptoms, disability and functional needs, treatment or equipment needs, provider or service information, health-related expenses or eligibility facts, authorized health records and communications, linked identity or location information, health-related images and stories, and relevant derived summaries. The actual recipient receives the information appropriate to its authorized function rather than an unrestricted entitlement to every case detail.

23.4 Operational and professional recipients. Recipient categories can include properly engaged hosting, storage, AI, transcription, communications, security, administrative, or other processors; case managers and authorized personnel; requested project contractors and suppliers; accessibility, architecture, engineering, medical, transport, housing, food, or other appropriately authorized providers; verified representatives and caregivers; relevant property controllers or inspectors; and lawful professional advisers and insurers. Required purpose, access, contractual, consent, and confidentiality limits apply.

23.5 Media and public recipients. Specific authorized health-story information may be disclosed to producers, editors, crew, broadcasters, publishers, platforms, distributors, sponsors, media licensees, audiences, and the public for identified permitted recording, publicity, fundraising, promotional, editorial, educational, or distribution purposes. Such a disclosure is not treated as necessary to private assistance simply because filming is part of a proposed program. Required separate consent or sale authorization must be obtained before the relevant use.

23.6 Authorities and directed disclosures. We may disclose information to competent authorities, courts, safeguarding services, legal or other appropriate advisers, or another recipient at the consumer’s valid direction only within the conditions and purpose actually permitted by law. A general safety or litigation interest does not override a health-specific disclosure restriction.

23.7 Specific affiliates. This Policy does not designate any corporate affiliate as an authorized recipient of covered consumer health data. A proposed disclosure to an affiliated legal entity in that capacity requires identification of that entity by legal name in an updated Policy and any required consent before the disclosure. Affiliation alone supplies no permission. An independently engaged processor or project provider remains subject to the actual role and applicable requirements.

23.8 Required access information. Where a consumer has a statutory right to the identities and usable contact information of actual third-party or affiliated recipients, that information is provided through the applicable authenticated access process. Recipient categories in a notice do not replace a required actual-recipient response.

24. Health Data Sale Advertising and Special Authorization

24.1 No sale permission from this policy. This Policy does not authorize a sale of covered consumer health data. A general Terms acceptance, donation, intake permission, recording grant, or publicity release is not the separate signed statutory sale authorization required where the applicable law defines the proposed transfer as a sale.

24.2 Value and media licensing. A transfer for monetary or other valuable consideration, including some paid media, sponsorship, or licensing arrangements involving identifiable health information, may be a legally defined sale. The transfer must not proceed under general permissions if a distinct authorization or prohibition applies. Whether a particular arrangement qualifies depends on the actual facts and law.

24.3 Required authorization. Where law permits a sale only with specific authorization, it must identify the relevant health data, collecting and selling party, purchaser, purposes, expiration, revocation process, signature, and required statements, and satisfy required duration, copy, and retention rules. Under Washington’s applicable rule, a sale authorization expires one year after signature and the required authorization record is retained for six years. It is separate from collection and sharing consent.

24.4 Advertising and new uses. Disclosure of identifiable health interests or case information through an advertising technology, sponsor, AI service, or other recipient must satisfy the applicable purpose and permission requirements before it occurs. Neither a cookie label nor calling a record an inference removes health protection.

24.5 Geofencing. We do not use a geofence around a healthcare facility to identify or track consumers, collect health information, or send notifications, messages, or advertisements where the applicable law prohibits that conduct. A generic location or website consent does not authorize prohibited geofencing.

25. Health Data Retention Security and Processors

25.1 Retention limits. We may retain covered health records for ongoing lawful case, project, consent, safety, administrative, professional, or legal purposes, subject to applicable necessity, retention, withdrawal, and deletion rules. A closed case is not automatically deleted, but a general long-term record preference does not override a mandatory deletion right or authorize retaining unnecessary health data indefinitely where law prohibits it.

25.2 Processor requirements. A consumer-health processor must act under a binding lawful agreement stating the relevant instructions and processing limits and assist with required rights, deletion, and security obligations. A processor may not independently repurpose covered data contrary to its authorized role, consent, applicable notice, or law.

25.3 Required security. Covered data is subject to administrative, technical, and physical security and access requirements imposed by the applicable law, including a reasonable standard of care appropriate to its volume and nature where required. No consent or disclaimer waives those duties. We do not guarantee immunity from every attack or claim a particular certification through this policy.

25.4 Provider copies. Required deletion can extend to processors, contractors, other recipients, archives, and backup systems. Applicable record exceptions and permitted delays are specific to the governing law. Under the Washington rule, a permitted delay for archived or backup systems may not exceed six months after authenticating the deletion request.

26. Health Data Rights and Requests

26.1 Washington rights. Where the Washington law applies, you may confirm whether covered health data is collected, shared, or sold; access that data; obtain the required list of actual third-party and affiliated recipients and their active email or other usable contact mechanism; withdraw collection or sharing consent; and request deletion of covered data. A valid withdrawal or deletion applies within the actual statutory scope.

26.2 Request method. Email [email protected] and identify the relevant case or interaction and the right requested. You need not create a new account solely to request a right under the applicable Washington rule. We may request information reasonably necessary to authenticate the request and protect against disclosure to an impostor. An authorized representative must have the authority required by law.

26.3 Deletion action. Where deletion is required, covered information must be deleted from the systems within the required scope and the relevant affiliates, processors, contractors, and third parties must be notified to honor the request. A media license, general contractual survival clause, or ordinary record preference does not defeat a mandatory health deletion right. The limited archive and backup timing in 25.4 applies where legally available.

26.4 Response timing. Under the Washington rule, we respond without undue delay and within forty-five days after receipt of a request, with one additional forty-five-day extension where reasonably necessary and with timely notice of the reason. Authentication does not create a new unrestricted response period. If we decline a request, the required explanation and appeal instructions are supplied within the applicable period.

26.5 Requests and fees. Washington’s applicable rules provide responses free of charge up to twice annually and allow a reasonable cost-based fee or refusal for a manifestly unfounded, excessive, or repetitive request within statutory conditions. Any verification, fee, or exception must satisfy the governing law and is not a discretionary obstacle to a protected right.

26.6 Nevada and other rights. Where another consumer-health law applies, its rights, consent, deletion, sharing, sale, appeal, exceptions, and response periods govern the relevant records. Requests may use [email protected]. We do not substitute Washington’s timeline or exceptions for a different mandatory local rule.

26.7 Withdrawal and services. Withdraw applicable consent by emailing [email protected] and identifying the permission. Withdrawal stops the relevant future consent-based processing as required. A particular service genuinely dependent on necessary information may become unavailable, but we do not unlawfully discriminate for exercising protected health-data rights or make withdrawal an unlawful penalty.

27. Health Data Appeals and Complaints

27.1 Appeal. Appeal a covered request denial by emailing [email protected] with the request identified and the reason for review. Under the Washington rule, a written appeal response explaining action or inaction is provided within forty-five days after receipt of the appeal.

27.2 Regulator contact. If a Washington appeal is denied, the response includes an available online mechanism or other appropriate method to contact the Washington Attorney General. The Attorney General’s complaint page is https://www.atg.wa.gov/file-complaint. Another competent regulator may be contacted where applicable law provides that right.

27.3 No waiver. You do not waive a substantive health-data right, regulator complaint, or mandatory remedy through a donation, Terms acceptance, media grant, nomination, or correspondence. Valid dispute procedures apply only within their lawful scope.

28. Changes and Contact

28.1 Updates. We may revise this Policy and publish its updated date. Material changes receive notice and further permission when required. An updated notice does not retroactively convert a private case request into an unrestricted media, advertising, model-training, or health-data-sale permission. New processing must have its actual lawful basis.

28.2 Health-data changes. We publish the updated date of this Policy. Required notice and consent for new categories, additional purposes, recipients, or other material changes must occur before the changed processing. Continued browsing is not a substitute for legally required affirmative consent.

28.3 Contact and requests. For privacy access, correction, deletion, consent withdrawal, objections, opt-outs, appeals, permissions, security concerns, child information, personnel privacy, health-data recipient information, or questions, contact [email protected] or write to Massive Good Inc., 500 W 2nd St, Floor 19, Suite 16, Austin, Texas 78701, United States. State the relevant request and provide only the identifying detail reasonably needed.

28.4 Safety. Our email and intake tools are not continuously monitored emergency channels. Contact local emergency services for imminent danger. A message describing a crisis does not guarantee detection, review, intervention, or assistance.