Privacy & Data Protection Policy

Last updated: 14 September 2026

PollyReg is a tool made by PollyLabs that helps US nonprofits register for charitable solicitation and stay compliant across states. This policy explains, in plain language, what personal data we process when you use PollyReg, why we process it, who we share it with, how long we keep it, and the rights you have over it. It is written to meet the transparency requirements of the EU and UK General Data Protection Regulation (GDPR) Articles 13 and 14 and applies to everyone who uses PollyReg, wherever they are.

If your organization has signed a contract or data processing agreement with PollyLabs, that agreement controls where it differs from this page.

1. Who we are and our roles

PollyReg is provided by PollyLabs, [Company legal name and registered address]. Two roles apply, depending on the data:

• Organization data — your nonprofit is the controller. Information you or your colleagues enter or upload about your organization (officer names, business contact details, filing history, financial summaries, documents) is controlled by your nonprofit. PollyLabs processes it as a processor, only on your organization's instructions and only to provide the service.
• Account and usage data — PollyLabs is the controller. Your sign-in details from Google, your profile settings, your activity history in the app and technical server logs are controlled by PollyLabs, because we decide how they are used to run, secure and improve PollyReg.

2. How to contact us

For any privacy question or request, email matan@polly-labs.com. Our data protection contact is [Data protection contact name or role], reachable at the same address; put "Data protection" in the subject line so it is routed directly. If PollyLabs appoints a formal Data Protection Officer or an EU/UK representative under GDPR Article 27, their details will be listed here: [DPO / EU-UK representative details, if appointed].

3. The personal data we process

• Account data (from Google sign-in): your name, email address and Google account ID, plus the username and display name you choose in Settings. We never see or store your Google password.
• Organization contact data: names, titles and business contact details (work email, phone, business address) of officers, directors and registered agents that you enter for filings.
• Organization records: legal name, DBA names, EIN, state registration IDs, filing and registration history, and summary financial figures. These are mostly about the organization, but can include personal data such as a signatory's name.
• Uploaded documents: PDFs you choose to upload, such as formation documents, IRS determination letters and financial statements, which may contain names and signatures. Please do not upload information unrelated to registration work or unusually sensitive data (for example passwords, payment card numbers or health data).
• Activity data: a log of actions taken in your account (for example "signed in", "uploaded document", "profile updated") with timestamps, which you can see and export.
• Technical data: IP address, browser type and version, device type, pages requested and error details, held in server logs.
• Public IRS data: when you search for or claim an organization by EIN, we retrieve public Form 990 data from ProPublica Nonprofit Explorer. This can include names of officers as published in public IRS filings.

We do not intentionally collect special-category data (such as health, religion or political opinions), and we do not process payment card details.

4. Why we process it and our legal bases

Under GDPR Article 6 we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): creating and running your account, storing your organization profile and documents, pre-filling state forms, tracking deadlines, and responding to support requests.
• Legitimate interests (Art. 6(1)(f)): keeping PollyReg secure, preventing abuse and fraud, debugging errors, and keeping an activity log so you and we can see what happened in the account. We balance these interests against your rights and only collect what is needed for these purposes.
• Legal obligation (Art. 6(1)(c)): keeping records we are legally required to keep, and responding to lawful requests from authorities.
• Consent (Art. 6(1)(a)): only where we ask for it explicitly, for example if we ever offer optional product emails. You can withdraw consent at any time without affecting the service.

Where PollyLabs acts as a processor for your organization's data, the legal basis is your organization's to determine; we process only on its documented instructions.

5. Who receives your data (recipients and subprocessors)

We do not sell personal data and we do not share it with advertisers. We use the following providers to deliver the service:

• Google (Google LLC): sign-in with Google OAuth. Google tells us your name, email and account ID when you sign in.
• Microsoft Azure (Microsoft Corporation): hosting of the application and API, SQL Server and MongoDB databases, and Azure Blob Storage for uploaded documents.
• ProPublica Nonprofit Explorer: when you look up an organization, we send the EIN or organization name you typed to ProPublica's public API to retrieve IRS Form 990 data. No account data is sent.
• State government portals and agencies: when you choose to file, the information you approve is submitted to the relevant state charity regulator, either by you directly or with the PollyReg browser extension filling in the form on your behalf. Each state is an independent controller of what it receives.
• Professional advisers and authorities: lawyers, auditors or public authorities where required by law or to protect our legal rights.

We keep this subprocessor list current. Customers with a signed data processing agreement are notified in advance of any new subprocessor and may object; everyone else will see the change reflected on this page with an updated "Last updated" date.

6. International transfers

PollyReg is built for US nonprofits and its data is hosted in the United States on Microsoft Azure. If you are in the EU, EEA, UK or Switzerland, your personal data is therefore transferred outside your region. For those transfers we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) with our providers, or on an equivalent lawful mechanism such as the EU-US Data Privacy Framework where the provider is certified. You can request a copy of the relevant safeguards by emailing matan@polly-labs.com.

7. How long we keep data

The periods below are PollyLabs' stated retention policy. Where your organization has given us different written instructions as controller, those instructions apply.

• Account data: for the life of the account, then deleted within 30 days of a deletion request.
• Organization profile, officers and uploaded documents: for as long as the account is active and per your organization's instructions; deleted with the account unless a legal retention duty applies.
• Filing records: retained for as long as state law requires charitable registration records to be kept (this varies by state) and as instructed by your organization, then deleted.
• Activity log: kept with the account and deleted with it; the final "account deleted" entry is kept without personal identifiers as evidence the request was fulfilled.
• Server logs (IP address, browser): 90 days.
• Backups: deleted data may persist in encrypted backups for up to 35 days before it is overwritten. Backups are never used to restore deleted personal data except as part of a full disaster recovery.

8. Your rights and how to exercise them

Under the GDPR (and similar laws such as the UK GDPR and some US state laws) you have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16). You can edit your profile in Settings and your organization data in the app at any time.
• Erase your data ("right to be forgotten", Art. 17).
• Restrict processing while a dispute is resolved (Art. 18).
• Portability: receive your data in a structured, machine-readable format (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Withdraw consent at any time where consent is the legal basis (Art. 7(3)).

Self-service: on the Settings page you can download a JSON copy of your account, organization profile, document list, activity and deadlines ("Download a copy of my data") and permanently delete your account ("Delete my account"). Uploaded files can be downloaded individually from the Documents page.

By email: for any other request, email matan@polly-labs.com. We respond without undue delay and within one month (GDPR Art. 12), extendable by two further months for complex requests, in which case we will tell you. We may ask you to verify your identity first. Requests are free unless they are manifestly unfounded or excessive.

Requests about your organization's data: where PollyLabs is a processor, we will pass your request to your organization and help it respond, or act on it directly where your organization has instructed us to.

Complaints: you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or UK country where you live, work or where the alleged infringement occurred. We would appreciate the chance to address your concern first, but you are not required to contact us before complaining.

9. Cookies and local storage

PollyReg uses only strictly necessary cookies:

• A session cookie set by our API when you sign in with Google, so you stay signed in. It is HttpOnly (not readable by page scripts), sent only over HTTPS, and is cleared when you sign out or it expires.
• An admin context cookie, used only when a PollyLabs administrator is acting on an organization's behalf to provide support. It is also HttpOnly and is cleared at sign-out.

We use no advertising cookies, no analytics cookies and no third-party tracking. Because these cookies are strictly necessary for the service you asked for, no consent banner is required under the ePrivacy rules; the small notice at the bottom of the page is for information only.

Your browser's localStorage holds only interface preferences (for example whether you dismissed the cookie notice or a sidebar state) and your answers to the exemption questionnaire. Questionnaire answers are cleared when you sign out. Nothing in localStorage is sent to third parties.

10. How we protect your data

We apply technical and organizational measures appropriate to the risk (GDPR Art. 32), including:

• Encryption in transit (TLS/HTTPS) for all traffic between your browser, our API and our providers, and encryption at rest on Azure storage and databases.
• HttpOnly, Secure session cookies and short-lived tokens for the browser extension.
• Access controls so that each user can reach only their own organization's data, with administrator actions logged.
• Least-privilege access to production systems for PollyLabs staff, limited to people who need it for their role.
• Logging and monitoring designed to detect unusual or unauthorized activity.
• Vulnerability management: dependency updates, security reviews of changes, and a published security contact for responsible disclosure.
• Vendor due diligence: providers are selected for their security certifications and bound by contractual data protection terms.

No system is completely free of risk. If a personal data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and affected users and organizations without undue delay, as GDPR Articles 33 and 34 require.

11. Automated decision-making and AI assistance

PollyReg does not make automated decisions that produce legal or similarly significant effects about you (GDPR Art. 22). The exemption questionnaire, deadline calculations, fee estimates and any AI-assisted extraction from uploaded documents are guidance only: they pre-fill and summarize, and a person at your organization reviews and decides before anything is filed. They are not legal, tax or regulatory advice.

12. Children

PollyReg is a professional tool for nonprofit staff and advisers. It is not directed at anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, email matan@polly-labs.com and we will delete it.

13. Changes to this policy

We may update this policy as PollyReg or the law changes. We will post the new version here and update the "Last updated" date at the top. For material changes, for example a new purpose of processing or a new subprocessor, we will also notify signed-in users in the app or by email before the change takes effect. Continued use after the effective date means the updated policy applies.

14. Sources for figures on our website

The numbered notes on the PollyReg home page refer to the following sources.

1. National Council of Nonprofits: Charitable Solicitation Registration and About America's Nonprofits.
2. Filing firms' published prices range from about $175 to $250 per state per year, plus state fees. Savings vary with the number of states.
3. One license type is one distinct state registration, permit or license. Counted from PollyReg's rules corpus, September 2026.
4. California Attorney General, May Not Operate or Solicit for Charitable Purposes List, as of September 2, 2026: 29,660 organizations.

To return to your registrations, go back to the dashboard.