Privacy policy

Each Organization imports its own donors into PZcall and decides why and how it uses their information. For that data, the Organization is responsible for the personal information, and PZcall processes it only on the Organization's behalf and following its instructions, as a service provider.

For the information about the people who hold a PZcall account (organization admins and the PZcall team), and for the technical data we need to run the service, PZcall is responsible.

If you are a donor and an Organization called you or sent you a message through PZcall, the Organization is your first contact for any question about your information. You can also write to us and we will help.

Donor information, imported and controlled by each Organization:

• names, phone numbers, email addresses;
• gift history, amounts, and the campaigns a donor was part of;
• notes, tags, lists, and any other fields the Organization chooses to add;
• a “do not call” flag when a donor asked not to be called.

Account information:

• organization admins: name, email address and password (we store only a secure hash of the password, never the password itself);
• volunteers who call: a name or a team seat name, without a password, and their call activity (outcomes, times and call durations);
• the PZcall team: name and email address.

Information created while the service is used:

• call outcomes and notes written during or after a call;
• pledges (“will donate”) and their amounts, and donations recorded;
• payment links sent to donors by text message or email;
• comments left with the in-app feedback tool (the name you type and your message);
• basic technical logs (such as IP address, browser type, the page requested and the time), used to keep the service secure and working.

Payments. Gifts are paid on Charidy, a third-party donation platform, under its own privacy policy. PZcall never sees or stores card numbers. Campaign packs are invoiced by PZcall today; when online payment of packs arrives, it will go through a payment provider and we will update this policy.

• to provide the service the Organization asked for: prepare campaigns, show donors to volunteers, place calls, record outcomes, pledges and donations, and send payment links;
• to create and secure accounts, sign people in and reset passwords;
• to answer questions, support requests and feedback;
• to invoice campaign packs;
• to keep the service secure, prevent abuse and fix problems;
• to meet our legal obligations.

We do not sell personal information. We do not use donor information for our own marketing, and we do not share it with other Organizations. There is no advertising in PZcall.

Each Organization is responsible for having the right to hold and use its donors' information and to contact them, for telling them how it uses their information, and for honoring “do not call” and unsubscribe requests. PZcall helps with a “do not call” flag that keeps a donor out of the calling lists.

When you create an account or use PZcall, you consent to the use of your information described in this policy. You can withdraw your consent at any time (see section 9); some features may then stop working for you.

• Emails to donors leave from the Organization's own email address when the Organization connects it to PZcall. Otherwise, the volunteer sends the message from their own mailbox.
• Text messages leave from the sender's own phone, or through Twilio when the Organization has that option enabled.
• Calls placed from the browser, when the Organization has them enabled, go through our call providers (Telnyx or Twilio), which carry the call and the donor's phone number. PZcall does not record calls.
• Account emails (such as a sign-in confirmation or a password reset) are sent by PZcall through Resend.

Connecting a Google or Microsoft account

When an Organization connects its Google (Gmail) or Microsoft (Outlook) account, PZcall asks only for permission to send email on its behalf (Gmail "gmail.send", Microsoft "Mail.Send") and to know the address it sends from. PZcall never reads, stores or deletes the messages in the mailbox. We use this access only to send the emails that a member of the Organization asks PZcall to send. The access tokens are stored encrypted and are never shared, sold, used for advertising or used to train artificial intelligence models. The Organization can disconnect at any time in Settings, or from its Google or Microsoft account; PZcall then deletes the tokens.

PZcall's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We rely on a small number of service providers. They process information only to provide their service to us, under contracts that require them to protect it.

Information is therefore stored and processed outside Quebec and outside Canada, mainly in the United States. Before relying on these providers, we assessed the sensitivity of the information, why it is transferred, the protection measures in place (encryption in transit and at rest, access controls, contractual commitments) and the legal framework of the countries involved, as Quebec's Law 25 requires. We concluded that the information receives adequate protection. Information held in another country may be accessible to that country's authorities under its laws.

PZcall uses only the cookies needed to sign in and to keep a session open:

• the admin session cookie, for organization admins;
• the volunteer session cookie, for people calling in a campaign;
• the demo access cookie, for people trying the demo with an access code.

Your browser also remembers a few preferences on your own device, such as the microphone you chose, whether sounds are on, or the name you typed in the feedback tool.

We count visits to our public pages (the home page, the contact page and these legal pages) with Vercel Web Analytics. It sets no cookie and does not identify you: it records the page, the site you came from, your approximate place (country, region, city), your browser, system and kind of device. To count one visit once, it uses a code made from your request that is thrown away after 24 hours; your IP address is not kept. The organizations' app, volunteer pages and payment pages are never counted.

There are no advertising or tracking cookies, and no analytics data is sold or shared with anyone.

• Account information is kept while the account is active.
• An Organization can delete donors, and its other data, at any time from the app.
• When the service ends, and on the Organization's request, we delete the Organization's data within 30 days, except what the law requires us to keep (for example, invoices).
• Backups roll over: deleted information disappears from them within 30 days.

Under Quebec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA, you have the right to:

• know whether we hold information about you, and get access to it;
• have inaccurate, incomplete or out-of-date information corrected;
• withdraw your consent;
• ask for your information to be deleted, or no longer shared, when the law allows it;
• receive your information in a structured, commonly used technological format, where applicable;
• file a complaint with a regulator.

To use these rights, write to us or use our contact page. We answer within 30 days. We may ask you to confirm your identity first.

Donors: if you want your information corrected or removed, please contact the Organization that called you, since it controls that information. If you do not know how to reach it, write to us and we will pass your request on and help the Organization act on it.

If you are not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec or to the Office of the Privacy Commissioner of Canada.

Information travels encrypted (HTTPS) and is stored with access limited to the people who need it. Passwords are stored as secure hashes, and the credentials an Organization gives to connect its email address are encrypted.

If a confidentiality incident happens, we act quickly to reduce the risk, we notify the affected Organizations, and when the incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people concerned, as the law requires. We keep a register of incidents.

PZcall is meant for organizations and adults. We do not knowingly collect information from children for our own purposes.

Our Privacy officer is responsible for the protection of personal information at PZcall and can be reached by email (write to the privacy officer) or through our contact page.

We may update this policy as PZcall evolves. The date at the top shows the latest version. When a change is significant, we tell the Organizations using PZcall before it takes effect.