Privacy Policy

EvolvArts, Inc. ("EvolvArts," "Company," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy ("Policy") describes how we collect, use, disclose, retain, and safeguard your information when you visit our website at https://evolvarts.com (the "Site") and use our software-as-a-service platform and related services (collectively, the "Services"), including our customer relationship management tools, ticketing systems, fundraising and donation processing, class management, marketing tools, analytics, and point-of-sale services.

This Policy applies to information we collect from all users of the Services, including arts organizations that subscribe to our platform ("Organization Users") and the patrons, customers, donors, and other individuals who interact with those organizations through the Services ("End Users").

PLEASE READ THIS POLICY CAREFULLY. BY ACCESSING OR USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS POLICY. IF YOU DO NOT AGREE WITH THIS POLICY, YOU MUST NOT ACCESS OR USE THE SERVICES. THIS POLICY IS INCORPORATED INTO AND FORMS PART OF OUR TERMS OF SERVICE.

1. Information We Collect

We collect information in the following categories:

1.1 Information You Provide Directly

We collect information you voluntarily provide when you register for an account, subscribe to a plan, make a purchase, contact us, or otherwise interact with the Services. This may include:

• Identity Information: Full name, date of birth, username, and other similar identifiers;
• Contact Information: Email address, mailing address, telephone number, and other contact details;
• Account Credentials: Password and security questions used to authenticate your account;
• Payment and Financial Data: Credit or debit card numbers, billing addresses, and other payment-related information (note: payment card data is processed and stored by our third-party payment processor, Stripe, Inc., and is not stored on our servers);
• Professional and Employment Information: Job title, organization name, and role within the organization;
• Communications Data: Records and content of correspondence when you contact us, including support tickets and feedback; and
• User Content and Transactional Data: Any data, information, or content you upload, submit, or generate through your use of the Services, including patron records, donation histories, ticket purchase records, class enrollments, and event information.

1.2 Information Collected Automatically

When you access or use the Services, we automatically collect certain information, including:

• Device and Browser Data: IP address, browser type and version, operating system, device type, unique device identifiers, and screen resolution;
• Usage Data: Pages viewed, links clicked, features used, access times and dates, session duration, referring URL, and navigation patterns;
• Location Data: Approximate geographic location inferred from your IP address; and
• Cookies and Similar Technologies: We use cookies, web beacons, pixels, and similar tracking technologies to collect information about your interactions with the Services. For more details, see Section 7 ("Cookies and Tracking Technologies") below.

1.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Payment Processors: Transaction status, partial payment card information (e.g., last four digits), and billing details from Stripe;
• Analytics Providers: Aggregated and individual usage analytics from services we integrate with;
• Wealth Screening and Data Enrichment Services: Publicly available information and estimated giving capacity data used by arts organizations for donor development; and
• Organization Users: If you are an End User, the Organization User you interact with may provide your personal information to us through the Services.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing and Maintaining the Services: To create and manage your account, process transactions, deliver the features and functionality of the Services, and provide customer support;
• Improving and Developing the Services: To understand how users interact with the Services, identify trends and usage patterns, conduct research and analysis, and develop new products, services, features, and functionality;
• Communications: To send you transactional communications (e.g., order confirmations, account notifications, security alerts), respond to your inquiries, and, where permitted, send you marketing and promotional communications;
• Personalization: To tailor the Services and content to your preferences and interests;
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other illegal activities, and to protect the rights, property, and safety of EvolvArts, our users, and others;
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests; and
• Enforcing Our Terms: To enforce our Terms of Service and other agreements.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

3.1 Service Providers

We share your information with third-party vendors, consultants, and service providers who perform services on our behalf, including payment processing (Stripe, Inc.), cloud hosting and infrastructure, email delivery, analytics, and customer support tools. These service providers are contractually obligated to use your information only as necessary to perform services for us and in accordance with this Policy.

3.2 Organization Users and End Users

If you are an End User, the Organization User whose services you interact with may access your personal information through the Services as part of their use of our platform (e.g., patron records, ticket purchase histories, donation data). The Organization User's use of your information is governed by their own privacy policy, not ours.

3.3 Legal Obligations and Protection of Rights

We may disclose your information if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation, regulation, governmental request, or legal process (including subpoenas and court orders); (b) protect and defend the rights, property, or safety of EvolvArts, our users, or the public; (c) enforce our Terms of Service; (d) investigate or prevent fraud, security, or technical issues; or (e) respond to an emergency involving danger of death or serious physical injury to any person.

3.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, asset sale, or other similar transaction, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Site of any change in ownership or use of your personal information, as well as any choices you may have regarding your personal information.

3.5 Affiliates

We may share your information with our affiliates, including our parent company, subsidiaries, and companies under common control, in which case we will require those affiliates to honor this Policy.

3.6 With Your Consent

We may share your information with third parties when you have given us your explicit consent to do so.

3.7 Aggregated or De-identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you for any purpose, including research, analytics, marketing, and industry benchmarking.

4. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Policy, including to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the information, and applicable legal requirements.

If you request deletion of your account, we will delete or de-identify your personal information within a commercially reasonable time, unless we are required to retain it for legal, regulatory, or legitimate business purposes. Certain information may persist in backup systems for a limited period before being permanently removed.

5. Data Security

We implement and maintain commercially reasonable administrative, technical, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include, but are not limited to, encryption of data in transit and at rest, access controls, regular security assessments, and employee training.

However, no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials and for restricting access to your account. You agree to notify us immediately of any unauthorized use of your account.

6. Data Processing and Sub-Processing

When Organization Users submit personal data of their End Users through the Services, EvolvArts processes that data on behalf of the Organization User as a data processor (or "service provider," as defined under applicable law). In this capacity, we process End User data only in accordance with the Organization User's instructions and as necessary to provide the Services.

Organization Users are the data controllers with respect to their End Users' personal data and are responsible for: (a) providing all required notices to End Users regarding the collection and processing of their personal data; (b) obtaining all necessary consents; and (c) ensuring that their use of the Services complies with all applicable data protection laws.

We may engage sub-processors (third-party service providers) to assist in providing the Services. A list of our current sub-processors is available upon request by contacting us at support@evolvarts.com.

7. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Strictly Necessary Cookies: Essential for the basic functionality of the Services, such as authentication, session management, and security. These cookies cannot be disabled.
• Performance and Analytics Cookies: Help us understand how visitors interact with the Services by collecting information about pages visited, time spent on pages, and error messages encountered.
• Functional Cookies: Enable enhanced functionality and personalization, such as remembering your preferences and settings.

Most web browsers are set to accept cookies by default. You can adjust your browser settings to remove or reject cookies. Please note that disabling cookies may affect the functionality of certain features of the Services.

We do not currently respond to "Do Not Track" (DNT) signals transmitted by web browsers, as there is no universally accepted standard for how to respond to such signals.

8. Your Privacy Rights

Depending on your location and applicable law, you may have certain rights regarding your personal information. We respect these rights and will facilitate your exercise of them to the extent required by law.

8.1 Rights Available to All Users

Regardless of where you are located, you may:

• Access and Portability: Request a copy of the personal information we hold about you in a structured, commonly used, machine-readable format;
• Correction: Request correction of any inaccurate or incomplete personal information;
• Deletion: Request deletion of your personal information, subject to certain exceptions (e.g., where we are required to retain information for legal or regulatory purposes);
• Opt-Out of Marketing Communications: Unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any marketing email or by contacting us directly. Please note that you may continue to receive transactional communications (e.g., order confirmations, account alerts) even after opting out of marketing communications.

8.2 Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), provides you with the following additional rights:

• Right to Know: The right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business or commercial purposes for collecting it, and the categories of third parties with whom we shared it;
• Right to Delete: The right to request that we delete personal information we have collected from you, subject to certain exceptions;
• Right to Correct: The right to request correction of inaccurate personal information;
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information and do not share it for cross-context behavioral advertising purposes;
• Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes beyond those permitted under the CCPA/CPRA; and
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

California residents may exercise their rights by contacting us at support@evolvarts.com. We may need to verify your identity before processing your request.

8.3 Additional Rights Under Other State Privacy Laws

Residents of certain other U.S. states (including, but not limited to, Virginia, Colorado, Connecticut, Utah, and other states that have enacted comprehensive consumer privacy laws) may have additional rights, including the right to access, correct, delete, and obtain a copy of their personal data, the right to opt out of targeted advertising and profiling, and the right to appeal our decisions regarding their privacy requests. To exercise these rights, please contact us at support@evolvarts.com.

8.4 Exercising Your Rights

To exercise any of the rights described above, please submit a request to us at support@evolvarts.com. We will respond to your request within the timeframe required by applicable law (typically within 30 to 45 days). We may ask you to verify your identity before fulfilling your request.

If you are an End User of an Organization User and wish to exercise your privacy rights, please contact the relevant Organization User directly, as they are the data controller responsible for your personal information.

9. Children's Privacy

The Services are not directed to children under the age of thirteen (13). We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take commercially reasonable steps to delete such information as quickly as practicable. If you believe that we may have collected personal information from a child under 13, please contact us immediately at support@evolvarts.com.

10. International Data Transfers

The Services are operated in the United States and are intended for users located within the United States. If you access the Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction. By using the Services, you consent to the transfer of your information to the United States as described in this Policy.

11. Third-Party Websites and Services

The Services may contain links to third-party websites, services, or applications that are not operated or controlled by EvolvArts. This Policy does not apply to any third-party websites, services, or applications. We are not responsible for the privacy practices of any third party. We encourage you to review the privacy policies of any third-party websites or services before providing your personal information to them.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our information practices, legal requirements, or business operations. If we make material changes, we will notify you by posting the updated Policy on the Site and updating the "Effective Date" above. We may also provide additional notice for material changes, such as an email notification or an in-application alert. Your continued use of the Services after the effective date of any modifications constitutes your acceptance of the updated Policy.

We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, or if you wish to exercise any of the rights described herein, please contact us at: