Privacy Policy

1. Introduction

Give Back Abroad ("GBA," "we," "us," or "our") is a fee-free volunteer matching platform that connects volunteers with NGOs and host organizations worldwide. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform at givebackabroad.org.

2. Information We Collect

We collect the following types of personal information:

• Account Information: Name, email address, and password when you create an account.
• Profile Information: Country, bio, languages spoken, occupation, skills, and profile photo.
• Optional Volunteer Resume: If you use resume-assisted profile drafting, we process the PDF or Word document once to extract text and create a draft. We do not retain the resume file or its extracted text after that request.
• Communications: Messages exchanged between volunteers and hosts through our platform.
• Applications: Volunteer applications submitted to host organizations, including application status and history.
• Reviews: Reviews and ratings you leave for host organizations or volunteer experiences.
• Usage Data: Information about how you interact with our platform, including pages visited and features used.
• Host Documents: If you register as a host organization, you may upload documents such as registration certificates, organizational materials, or identity documents used for verification. See Section 4 for how these are stored and used.
• Listing Images: Photographs you upload to illustrate a volunteer opportunity. Unlike host documents, these are published publicly on your listing.

3. How We Use Your Information

We use your personal information to:

• Match volunteers with suitable host organizations and opportunities.
• Facilitate communication between volunteers and hosts.
• Operate, maintain, and improve the platform.
• Process volunteer applications and manage your account.
• Display reviews and ratings to help other users make informed decisions.
• Send important notifications about your account, applications, or messages.
• Ensure platform safety and prevent misuse.
• Verify that host organizations are genuine, using documents you choose to provide.
• Where you explicitly consent on a per-document basis, generate draft listing text from organizational documents you upload. See Section 4.
• Where you explicitly consent for that request, generate editable volunteer profile wording from a resume you choose. See Section 4.

4. Documents and Automated Drafting

Host organizations may upload documents to support verification or to help draft a listing. We accept PDF, Word (.docx), JPG, and PNG files up to 4 MB each. Because these documents can contain sensitive information, they are handled differently from anything else on the platform.

• They are stored privately. Host documents are held in Netlify Blobs private storage, not on the public web. They have no public URL and are not indexed by search engines. Retrieving one always requires an authenticated request.
• Access is limited to you and our administrators. Other hosts and volunteers cannot access your documents. Our administrators can open them in order to review a verification request.
• Identity images are never read by automated systems. JPG and PNG files uploaded for verification are never sent to any AI service and never transcribed. This restriction is enforced by our database, not only by policy.
• AI drafting is opt-in, per document. Only PDF and Word documents you have explicitly marked as usable for drafting are eligible. Consent is recorded for each individual document and can be withdrawn at any time.
• What is sent when you opt in. Text extracted from that document is sent to Moonshot AI to generate draft listing wording, limited to roughly 8,000 characters per document and 20,000 characters in total. We do not send the file itself, and we do not send documents you have not consented to.
• Generated text is a draft. Anything produced this way is shown to you for review and editing. It is not published until you submit it.
• Extracted text stays on our servers. Text we extract from your documents is never sent to a web browser, including your own.

Listing images are different: photographs you upload to illustrate an opportunity are delivered publicly through Cloudinary so they can appear on your listing.

Volunteer resume-assisted profiles

• The feature is optional and requires consent each time. You can complete onboarding without a resume. Selecting a file alone does not send it for drafting.
• The resume is not stored. The PDF or Word file is validated and parsed in memory for that request, then discarded. Give Back Abroad does not add the file or extracted text to your account or document storage.
• What is sent when you opt in. Up to approximately 8,000 characters of extracted resume text are sent to Moonshot AI. The prompt instructs the service not to use contact details or infer sensitive traits.
• The result is an editable draft. Suggested bio, occupation, and languages fill only empty onboarding fields. You must review them before creating your account.

5. Data Storage and Security

Your data is stored securely in a Neon PostgreSQL database hosted on US-based servers. Host documents are stored separately in Netlify Blobs private storage, and public listing images are stored with Cloudinary. Our platform is deployed on Netlify's infrastructure. We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Third-Party Services

We use the following third-party services:

• Netlify: Hosting, authentication via Netlify Identity, and private document storage via Netlify Blobs.
• Neon: Our PostgreSQL database provider, hosted on US-based servers.
• Cloudinary: Storage and delivery of public images, such as profile photos and listing photographs. Host verification documents are not stored with Cloudinary.
• Moonshot AI: Generates draft listing and volunteer-profile text. It receives extracted document text only after the person has given the explicit consent described in Section 4.
• Unsplash: For platform imagery. Unsplash may collect usage data according to their own privacy policy.
• Google Fonts: For typography. Google may collect usage data according to their privacy policy.

We encourage you to review the privacy policies of these third-party services.

7. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request corrections to any inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data and account.
• Data Portability: Request your data in a structured, machine-readable format.

To exercise any of these rights, please contact us at info@givebackabroad.org.

8. Cookies and Local Storage

We use session cookies provided by Netlify Identity for authentication purposes. We also use localStorage to save your preferences (such as cookie consent and UI preferences). These are essential for the platform to function properly. We do not use tracking cookies or third-party advertising cookies.

If you begin registering a host organization, we save your partially completed registration form in your browser's local storage so you can continue where you left off. This draft never contains your password. It is tied to the email address you are registering with, and a draft belonging to a different account will not be loaded or submitted. Completing or abandoning registration on that device clears it; you can also clear it through your browser's site data controls.

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. If you request deletion of your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or legitimate business purposes. Anonymized or aggregated data that cannot be used to identify you may be retained indefinitely.

Host documents follow a specific schedule. When you delete a document, it is immediately hidden from your account and immediately becomes ineligible for any AI drafting, but the file is kept for 30 days so that an accidental deletion can be reversed on request. After that period the stored file is permanently deleted. During those 30 days the document remains subject to this policy and continues to count toward your storage allowance.

10. Children's Privacy

Give Back Abroad is not intended for users under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe a child under 18 has provided us with personal information, please contact us at info@givebackabroad.org.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically. Your continued use of the platform after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: