Privacy notice
This notice covers this website. If you are a member of staff at an organization using the FARO Portal, a separate and more detailed policy covers the Portal and the people your organization serves. Ask us and we will send it to you.
We do not sell data
FARO does not sell, rent, or share personal information with advertisers, data brokers, or any third party for their own marketing purposes. We never have, and this will not change without telling affected people first and giving them the chance to say no.
This is not a compliance formality. The people who read this site are mostly nonprofit staff looking for help delivering aid to people in difficulty. We are not in the business of monetizing that.
What we collect, and why
| What | When | Why |
|---|---|---|
| Website analytics Pages viewed, approximate location, browser and device type, how you arrived |
Every page | To understand which guidance is useful and which is not. Collected through Google Analytics |
| What you send us Your name, email address, organization, and whatever you write |
Only if you fill in a form or email us | To reply to you |
| Access records for shared documents A one-way scrambled version of your IP address, a rough location, browser and device type, and which link was used |
Only on documents shared with a specific person through a private link | So we know a document we sent has been opened, and so we can withdraw a link |
| Donations Your name, email address and the amount |
Only if you donate | To acknowledge the gift and meet our own record-keeping obligations |
On access records, plainly. When we send someone a private link to a document, we can see when it was opened. We think that is fair as long as we say so, which is why every such page carries a line telling you. We never store your IP address itself: it is put through a one-way function first, so we can tell two visits apart without holding the address.
A difference worth stating
The FARO Portal, which organizations sign into, runs no third-party analytics at all. This public website does. We are telling you because the two are different, and because we would rather you heard it from us than discovered it.
Cookies and browser storage
We use no advertising cookies and no cross-site tracking.
- Analytics cookies, set by Google Analytics, to tell a returning visit from a new one.
- A session cookie, set only if you open a password-protected document, so you are not asked for the password on every page. It lasts 90 days.
- A partner cookie, set only if you arrive through a partner's QR code or link. It holds the partner's short code, nothing about you, and lasts 60 days. The first partner who sent you is the one it keeps, so a later link does not replace it. We use it to credit the partner if you get in touch.
- Your text-size preference, kept in your own browser. It never reaches us.
Who we share it with
Only the services that make the site work:
- Google, for analytics and for hosting this site.
- Formspree, which delivers contact form submissions to our inbox.
- FARO HQ, hosted on Supabase, where the enquiries you send through our forms are recorded, so one is not lost in an inbox. Only the FARO team can read them.
- Every.org, which processes donations. Card details go to them and never to us.
- A court or regulator, if we are legally required to.
We do not share anything with data brokers, advertising networks, or any party for behavioral advertising.
How long we keep it
- Analytics: 14 months.
- What you send us: for as long as we are talking, and then up to three years in case you come back to us.
- Leads, QR code scans and quotes: a lead and any quote you built are kept for as long as we are talking, and then up to three years. A scan of a partner's QR code that never became an enquiry holds no name, and is kept for two years.
- Access records for shared documents: two years.
- Donation records: seven years, matching standard financial record-keeping.
Your rights
You can ask us what we hold about you, ask us to correct it, or ask us to delete it. We extend these rights to everyone, wherever you are, rather than only where the law requires it. If you are in the United Kingdom or the European Union you also have the right to object to processing and to complain to your data protection regulator; in the UK that is the Information Commissioner's Office.
Use our contact form and we will answer.
Where information is processed
FARO is a United States nonprofit and information is stored and processed in the United States. Some of our team work outside the United States and may access this information from there.
Children
This site is written for people running aid programs. It is not directed at children and we do not knowingly collect information from them.
Changes
We will post any change here and update the date at the top. If a change is significant we will say what changed rather than quietly replacing the text.
Contact
Questions about this notice, or about anything we hold: use our contact form.