How we protect your data.And theirs.

OrphanGive is a child-sponsorship service operated by Goodverse Foundation (Reg. S-14837/2026), a Bangladesh-registered organization (registered address: Ta 135/B, Gulshan Badda Link Road, Dhaka 1212, Bangladesh), in partnership with Children's Heaven Trust(Reg. iv-98/2021). Goodverse Foundation is the operating entity that holds donor data and runs the donor-facing service; Children's Heaven Trust performs ground verification of every listed child.

For the purposes of this policy, "we," "us," and "OrphanGive" refer to Goodverse Foundation acting as the data controller for donor information and as a joint custodian (alongside Children's Heaven Trust) for child profile data.

From donors: name, email address, postal country, phone number (optional), profile photo (optional), sign-in credentials (email + password hash; password itself is never stored in plain text and is salted-and-hashed by our authentication system), payment-method metadata (last 4 digits of card, expiry, brand — never the full PAN), Stripe customer identifier, donation history, sponsorship history, reveal- request history.

From children listed on the site:display name, date of birth (used to compute age), Bangladesh division and district, gender, photo (only with documented guardian consent), schooling and household information collected by Children's Heaven Trust's field team. Sensitive fields (exact address, school name, guardian name + contact, full date of birth) are encrypted at rest and never appear in the public surface.

Automatic: IP address (recorded transiently in server logs for security and rate-limiting), browser user-agent string, referring page. We do not use tracking pixels, ad cookies, or third-party analytics scripts.

We use donor data to:

• Match donors to verified children awaiting sponsorship.
• Process donations and recurring sponsorship charges via Stripe.
• Send transactional emails (welcome, receipts, sponsorship updates, quarterly reports, password resets).
• Surface your sponsorship history and donor dashboard.
• Detect and prevent fraudulent charges or account abuse.
• Issue receipts for tax purposes through Children's Heaven Trust where applicable.

We use child profile data exclusively to facilitate sponsorship matching, on-ground delivery of support, and quarterly reporting to the sponsoring donor. Child data is never used for marketing, never sold, and never shared with parties outside the verification + delivery flow.

Child profile data is gated by donor tier. Each tier exists because the next one would compromise the child if it were public.

• Tier 1 — public, no sign-in: display name, Bangladesh division, age in years, support need, consented photo.
• Tier 2 — authenticated donors: a richer profile (additional consented photos, sponsorship history, sponsor-queue state, broader narrative).
• Tier 3 — sponsoring donor with approved reveal: visible only after a donor sponsors a specific child AND requests + receives approval to view more details. Includes Tier 2 plus: more detailed family situation, direct progress updates from the field team, and approved photographs over time.

Never visible to donors at any tier: the child's school name, exact home address, full date of birth, guardian's name and contact information, or precise geographic location. These fields are held internally for operational purposes only and are protected by encryption at rest.

We share data with a limited set of service providers strictly necessary to operate the service:

• Stripe — payment processing. Full payment- card data is collected and stored by Stripe; we receive only tokenised references.
• Resend — transactional email delivery. Donor names and email addresses are passed to Resend for the limited purpose of email send.
• Cloudinary — image hosting for child photos and brand assets. Photos are served with a watermark to discourage unauthorised reuse.
• Children's Heaven Trust — our field partner. CH Trust receives the donor name and sponsorship amount tagged to each child, so that ground delivery can be attributed correctly.
• Directus — our self-hosted content and user management backend. Directus is operated by Goodverse Foundation on a private server; no third party has access to it.

We do not sell donor or child data, do not share data with advertisers, data brokers, or social media services, and do not participate in cross-site tracking networks.

We use a small number of strictly-necessary cookies for sign- in, session continuity, and protection against cross-site request forgery. Stripe sets its own cookies during the checkout flow for fraud prevention. We do not use third-party advertising cookies, tracking pixels, or web-analytics scripts.

For details, see the Cookie Policy.

Donor account data:retained while the account is active. On account closure, personal data is deleted within 30 days. Donation transaction records and receipts are retained for at least seven (7) years in aggregate form to satisfy tax-record and audit obligations applicable to Children's Heaven Trust as a registered charity in Bangladesh.

Child profile data:retained for as long as the guardian's consent remains in force and the child continues to be supported. If a guardian withdraws consent or a child's circumstances change such that listing is no longer appropriate, the profile is retired and identifying information removed within 30 days. Aggregate sponsorship records are retained for the same seven-year period above.

You have the right to request a copy of the personal data we hold about you, the right to correct inaccurate data, and the right to request deletion of your data subject to the retention obligations described above. To exercise any of these rights, write to support@orphangive.org from the email address associated with your account.

For child data, requests should originate from the guardian-of-record and are handled jointly by OrphanGive and Children's Heaven Trust.

OrphanGive operates under the laws of the People's Republic of Bangladesh. Where applicable we observe applicable Bangladesh law including the Cyber Security Ordinance, 2025 with respect to personal-data handling, and the protections available under the Children Act, 2013 with respect to child welfare and identifying information.

This policy is not framed by, and does not claim compliance with, the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), or other foreign frameworks. Donors based in those jurisdictions may have additional rights under their local law that we cannot guarantee through this Bangladesh-operated service.

Child profile data carries heightened protection:

• No child is listed on the public surface without their guardian's documented consent.
• Photo consent is recorded per-photo and can be withdrawn at any time; the photo is removed within 24 hours of withdrawal.
• Identifying details (exact address, school name, guardian name and contact) are encrypted at rest and never appear at Tier 1 or Tier 2.
• Child data is never used for marketing, fundraising appeals to non-sponsoring donors, or any commercial purpose.
• Child data is never sold or shared with parties outside the OrphanGive + Children's Heaven Trust delivery flow.

OrphanGive does not knowingly process the personal data of anyone under 18 as a donor. If we become aware that a donor account has been created by someone under 18, the account is closed and any data deleted in accordance with section 7.

We may amend this policy from time to time. Material changes (those that meaningfully alter how data is collected, used, or shared) will be notified to active donors by email at least 14 days before the change takes effect. Non-material changes will be reflected by an updated "Last updated" date at the top of this page.

For privacy-related questions, requests under section 8, or to report a privacy concern, write to support@orphangive.org. For child-welfare concerns specifically, please use the Safeguarding channel described in our Safeguarding Policy.