Privacy policy

Who is responsible

Each institution decides what information it keeps about its members and donors and is responsible for it. [Company legal name] processes that information on the institution's behalf, only to provide the service.

For information about staff accounts and the public donation page, [Company legal name] is responsible. Questions about privacy: [Name], privacy@[yourdomain].ca.

What information

Staff accounts: name, email, password (stored encrypted), language, role.

Members and donors (entered by the institution): names, Hebrew names, contact details, family relationships, important dates (birthdays, yahrzeits), notes, donations, pledges and receipts, and email and text consent.

Online donors: name, email, mailing address, the gift and any dedication. Card details are entered on Stripe's secure page and are never stored by us.

Why we use it

To let the institution manage its community, record donations, issue tax receipts (the written acknowledgments donors need for their tax deduction), and send the emails and texts it chooses (receipts, thank-you notes, pledge and yahrzeit reminders).

We do not sell personal information, share it for advertising, or share it with other institutions.

Where it is stored

The database is hosted in Canada (Montréal), so the information of US institutions is stored outside the United States, where Canadian privacy law also protects it. Some service providers process information in the United States or elsewhere: Stripe (payments), our email provider (sending emails), our web host and, when an institution turns on its AI features (reading photos or scans of paper lists, help writing emails, questions about its records, sorting voice notes), Anthropic, which receives only what a person chooses to send. Text messages and WhatsApp messages travel through Twilio. Phone notifications travel through the phone maker's notification service (Google, Apple or Mozilla), encrypted so that service can't read them. We require these providers to protect the information.

How long we keep it

Donation and receipt records are kept at least 7 years, longer than the IRS generally requires, so the institution and its donors can support a deduction. Other information is kept while the institution uses the service, and deleted or anonymized when no longer needed or on request, unless the law requires otherwise.

Security

Information is encrypted in transit and at rest. Each institution's data is separated at the database level; staff only see what their role allows (for example, only finance roles see donations). Important changes are recorded in a permanent activity log.

If a security breach affects personal information, we will notify the institution and, where state law requires, the people concerned and the authorities, without unreasonable delay.

Cookies

Kehila only uses the cookies it needs to work: one keeps staff signed in, one keeps a family signed in to its member page, one remembers the language and one the version (Canada or the United States) you chose. There are no advertising or tracking cookies.

Emails, texts and consent

Receipts and payment emails are sent because of a donation. Other emails are sent by the institution, each with a working unsubscribe link, and unsubscribes are honored right away, as the CAN-SPAM Act requires.

Text messages are only sent to people who agreed to receive them. Reply STOP at any time to stop them.

Children

Kehila is used by institutions and is not offered to children. An institution may record children as members of a family; we don't knowingly collect information directly from children under 13.

Your rights

You can ask to see or correct your information, or to have it deleted. Contact your institution first; you can also write to us at the address above. Depending on your state, you may have more rights under its privacy law; we honor them where they apply.

Changes

We will post any change to this policy here with its date and tell institutions about important changes.