Privacy Policy

The two roles we play

• For organizations that use Envolv. When a clinic, shelter, food bank, museum or other organization uses Envolv, that organization decides what volunteer information to collect and how to use it. We store and process that information on the organization’s behalf, under our agreement with it, as its service provider. If you volunteer (or applied to volunteer) with an organization that uses Envolv, that organization is your first contact about your information — and we will help it answer you.
• For our own website and customers. For visitors to this website, people who request a demo or email us, and the people who sign up for and manage an Envolv account, we decide how information is used, and this policy describes it directly.

Information in the Envolv app

Depending on what your organization uses, the app may hold:

• Contact and profile details: name, email, phone, photo, preferred language, and an emergency contact.
• Your volunteer application: your answers to the organization’s application form (the organization chooses the questions), plus the date and the IP address it was sent from, which we keep to block spam.
• Your volunteer record: roles, status, onboarding steps, notes and flags added by coordinators, background-check status, date and reference number (checks themselves are run by consumer reporting agencies, not by us), and credentials such as license numbers and expiration dates.
• Documents: files uploaded to your profile by you or your organization, such as a license or certificate. Some organizations ask for health-related records — see “Consumer health data” below.
• Your activity: shifts you sign up for, clock-in and clock-out times and hours, your handbook acknowledgment (the name you type and when), training progress and quiz scores, and messages your organization sends you.
• Your login: your email address. Passwords are stored by our login provider as a one-way hash; nobody at Envolv or your organization can read them.
• Location at clock-in, only if you allow it: when a shift’s location has a boundary set, the volunteer app asks your phone for its location at the moment you clock in. We compare it with the boundary and keep only whether you were on site. We do not store your coordinates, and we do not track your location at any other time. You can say no and still clock in.
• Notifications, only if you turn them on: a device token from your browser’s push service, so we can send shift reminders and your organization’s messages. You can turn notifications off at any time in your phone or browser settings.
• Technical information: like most websites, our hosting providers record things such as IP address, browser type and the pages requested, to run and secure the service. The app uses Vercel’s web analytics, which counts page visits without cookies. This website uses no analytics at all.

We use this information only to provide the service to your organization — scheduling, hour tracking, onboarding, messaging and reports — and to support, secure and fix it. We may use data that has been aggregated or de-identified so that it does not identify anyone, such as overall usage numbers, to improve Envolv.

We do not sell personal information, we do not share it for targeted advertising, and we do not use volunteers’ contact details to market to them.

Envolv is for administering volunteers. Organizations that use Envolv agree not to enter information about patients or the care they receive. Envolv does not sign business associate agreements.

Information from our website and customers

• Demo requests: your name, email, organization, industry, approximate number of volunteers and any notes. They are emailed to the Envolv founders and saved in our sales records (we use Notion for these). If you give your email on the live-demo page, it is saved the same way.
• Email to support@envolv.org: we receive and keep your message so we can answer it.
• Customer accounts: the names and contact details of the people who sign up for and manage an Envolv account, and billing records. We bill by invoice today; if we add card payments, a payment processor will handle card numbers and we will not see them.
• The live demo: the demo is one shared sandbox that everyone can see, and it resets every night. Please don’t enter real personal information there.

We use this information to respond to you, to run demos and onboarding, to follow up about your request, and to run our business. If we email you about Envolv and you’d rather we didn’t, say so and we’ll stop. This website sets no advertising or analytics cookies.

Who we share information with

• Your organization. Its administrators and coordinators see the volunteer records in its account.
• Service providers that run Envolv for us: Supabase (database, login and file storage), Vercel (app and website hosting, and the app’s analytics), Resend (email delivery and our support inbox), the push service of your browser or device maker (such as Apple, Google or Mozilla) for notifications, and Notion (our sales records — demo requests only, never volunteer records). They may use the information only to provide their service to us.
• Background-check agencies, only if your organization uses one, under that agency’s own terms and privacy policy.
• When the law requires it, or when needed to protect someone’s safety or rights, or to prevent fraud or abuse.
• If Envolv is sold or merges, information may move to the new owner, who must keep honoring this policy for it.

We don’t share personal information with anyone else.

Consumer health data

Some organizations collect health-related information about their volunteers — for example, immunization or TB-test records, or the results of a health screening. Washington’s My Health My Data Act and similar state laws call this “consumer health data.”

• How we handle it: we process it only for the organization that collected it, on that organization’s instructions and to provide the service. We never sell it, and we share it only with the service providers above that store or deliver it.
• Who can see it: the organization’s authorized staff, and Envolv staff only when needed to support or secure the service.
• Your rights: you can ask to see or delete your consumer health data, or withdraw a consent you gave. Contact your organization, or email us and we will pass your request to them and help them respond.

How long we keep information

• App records stay for as long as the organization keeps its account. The organization can change or delete records at any time. Records the organization archives are kept, at no charge, until the organization deletes them.
• When an organization closes its account, we send it a notice explaining how to export its data, and we delete its data from our live systems 90 days after the account closes. Copies in backups are deleted on the normal backup cycle.
• Demo requests and support email are kept as long as they’re useful for the conversation and our records. Ask us and we’ll delete them.
• Technical logs are kept by our hosting providers for a limited time.

How we protect information

Information is encrypted in transit and at rest. Each organization’s records are kept separate, our database refuses access by default except through the app’s own permission checks, and staff access is limited to what the work requires. No system is perfectly secure; if a security incident affects personal information, we tell the affected organization within 72 hours of confirming it, and you will be notified as the law requires.

Your choices and rights

• Volunteers: you can see and update your contact details, emergency contact and language in the volunteer app’s Profile tab. To see, correct or delete anything else, ask your organization — or email us and we will pass your request to them and help.
• Everyone else: email us to see, correct or delete the information we hold about you. We will answer within the time the law requires, and we never treat you differently for asking.
• Location and notifications are always optional and can be turned off in your phone or browser settings.

Children and teens

Some volunteer programs include teenagers. An organization that enters a minor’s information is responsible for getting any parental or guardian consent the law requires. Envolv is not directed to children under 13. If you believe a child’s information was entered without the required consent, contact the organization or email us and we will help delete it.

Where information is stored

Envolv is based in the United States, and our service providers store the information in the United States. If you use Envolv from another country, your information is transferred to and stored in the United States.

Changes to this policy

When we change this policy, we post the new version here with a new date. If a change is significant, we tell the organizations that use Envolv before it takes effect.

Contact us

Questions or requests: support@envolv.org. Envolv, LLC is a North Carolina limited liability company based in Buncombe County, North Carolina.