Privacy Policy

This Privacy Policy explains how Occam, operated by Nonsilebo LLC (“Occam,” “we,” “us”), handles personal information when you use our fundraising platform. It covers information about the people who run an organization on Occam, and the donor and constituent information those organizations manage with our tools.

When your organization uses Occam to manage its donors, your organization is the controller of that donor data and Occam acts as a processor on its behalf. Organizations that need one can review our Data Processing Addendum, linked in the footer.

Account information: your name, email address, and organization details when you create an account or organization.

Constituent data: donor and supporter records your organization adds or that are created when someone gives — such as names, contact details, phone numbers, gifts, event registrations, memberships, pledges, auction bids, store purchases, and notes your team records.

Payment information: donations and purchases are processed by Stripe or PayPal (including Venmo), whichever the organization has connected. Card, bank and PayPal account details are handled by that provider and are not stored on Occam's servers; we retain only non-sensitive records of a transaction (such as amount, date, method, and status). When an organization takes a payment in person, such as cash at an event, its staff may record the amount and method in Occam.

Content and media: pages your organization builds with the website builder, and images or video your organization uploads for its website, campaigns, and social posts.

Connected accounts: if your organization connects a social media account (such as a Facebook Page or Instagram account) or an accounting integration (such as QuickBooks), we store the identifiers and access credentials needed to operate that connection. Access tokens are stored encrypted and are never shown in the product.

Usage information: basic technical data such as IP addresses, log entries, and device/browser information, used to keep the service secure and reliable — for example, to limit repeated requests from one source.

Camera: an organization's staff can use their device's camera on the event check-in screen to read guests' ticket QR codes. The camera image is read on that device and is never sent to or stored by Occam.

We use information to provide and operate the platform, process donations, send transactional and organization-authorized messages, publish content the organization schedules to its connected accounts, provide support, keep the service secure, and improve how Occam works. We do not sell personal information, and we do not use your organization's data to advertise to anyone.

We rely on a small number of providers to run Occam, including Stripe and PayPal (payment processing), Supabase (authentication, database, and file storage), Vercel (hosting and custom domains), Resend (transactional email), and Zoho (our support inbox). If your organization enables text messaging, messages are delivered through an SMS carrier service (Telnyx or Twilio). If your organization enables AI-assisted features, text is processed by Anthropic as described below.

Each provider processes information only as needed to deliver its part of the service. The current list, with what each provider does and where it processes data, is on our Subprocessors page, linked in the footer.

An organization may connect its own Facebook Page or Instagram Business account so it can plan and publish posts from Occam. When it does, we receive the account's name, identifiers, and an access token from Meta, and we send Meta the content and media the organization chooses to publish, on the organization's behalf. Content published to a social network is then governed by that network's own terms and privacy policy.

We honor Meta's deauthorization and data-deletion callbacks: if you disconnect the app from your Meta settings, or delete it, the stored connection and its tokens are removed on our side. An organization can also disconnect an account inside Occam at any time, which deletes its stored tokens.

Some optional features — such as drafting social post copy or summarizing a donor's history for your own staff — use a large language model operated by Anthropic. When an organization uses one of these features, the relevant text is sent to Anthropic's API to generate the output and is subject to Anthropic's commercial API terms, under which it is not used to train Anthropic's models. These features are optional: the platform, including the social post planner, works without them, using no AI at all.

Organizations use Occam to send receipts, reminders, newsletters, and other messages to their supporters. Every marketing email includes an unsubscribe link, and opt-outs are enforced by the platform. Organizations are responsible for having the recipient's consent that their jurisdiction requires, particularly for text messages.

We keep information for as long as an account or organization is active, and as needed to comply with legal and financial recordkeeping obligations. Organizations can delete records within the product, and can request deletion of their data when they stop using Occam.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. Occam provides tools for organizations to export a donor's full record and to permanently erase a donor on request, to support obligations such as GDPR and CCPA. If you are a donor, please contact the organization you gave to, or reach us and we'll help route your request.

We use strictly necessary cookies to keep you signed in and to operate the site. We do not use advertising cookies, and we never sell or share visitor data.

An organization may add content from another service to its pages — a video from YouTube or Vimeo, or a map from Google Maps. When you open a page that includes one, your browser loads it directly from that service, which receives your IP address, may set its own cookies, and handles that information under its own privacy policy.

Occam includes built-in traffic analytics so an organization can see how many people visit its donation pages, events, store, and website, and where that traffic comes from. This is measured by us, for that organization only — no third-party analytics or advertising service receives it.

By default this is cookie-free: nothing is stored on a visitor's device. We derive a pseudonymous identifier by hashing a visitor's IP address and browser user-agent together with a secret that rotates every day, which lets us count a visit without ever storing the IP address or user-agent themselves. Because the secret rotates daily, yesterday's identifiers cannot be recomputed and visitors cannot be recognized from one day to the next.

An organization may instead opt in to recognizing returning visitors, which stores a first-party cookie containing a random identifier on the visitor's device. That cookie is used only to count returning visits and to attribute a gift to the visit that led to it. Where this is enabled, the organization is responsible for any cookie notice its jurisdiction requires.

Raw visit records are deleted after 190 days; only aggregate counts are kept beyond that.

Occam is operated from the United States, and data is processed and stored there by us and the providers listed above. If your organization is subject to GDPR or UK data protection law, our Data Processing Addendum covers international transfers.

Occam is intended for use by organizations and their staff, and is not directed to children under 13.

We may update this policy as the product evolves. When we make material changes, we'll update the date below and, where appropriate, notify account holders.

Questions about privacy? Email info@occam.gives or use the Contact link in the footer and we'll get back to you.