Last updated: 24 Oct 2026
When you register an organization or are invited to join one, we collect your name, email address, and password (securely hashed, never stored in plain text). When you submit a demo request, we may also collect your organization, phone number, country, requested modules, IP address, and browser information for security and follow-up. Organizations using the Platform may additionally store beneficiary data (which may include names and phone numbers, stored encrypted at rest), project data, financial records, and uploaded documents, entered by that organization's own staff.
We use account data to operate the Platform: authenticating you, sending transactional emails (password resets, verification, deadline reminders, team invitations), and providing support. We do not sell personal data to third parties.
Data belonging to one organization (tenant) is never visible to another organization on the Platform. This is enforced at multiple independent technical layers, not just the user interface.
Data is stored on servers operated by us or our infrastructure provider. [Specify your actual hosting region here once a hosting decision is made — this affects which data protection regime applies, e.g. GDPR for EU-hosted data.]
You may request a copy of your personal account data at any time from your account settings, or request deletion of your account. Deletion requests are reviewed by an administrator (rather than processed instantly) to prevent an organization from being left without any administrator — see your account settings for these options.
Organizations using the Platform to record beneficiary information (e.g. for NGO program delivery) are themselves responsible for obtaining appropriate consent from those individuals under applicable law. The Platform provides consent-tracking tools to support this, but the underlying legal obligation to obtain valid consent rests with the organization collecting the data.
We retain account and organizational data for as long as an account remains active, plus a reasonable period after account closure to allow for data export requests, unless a shorter period is required by applicable law or requested via a verified deletion request.
We apply tenant data isolation, encryption of sensitive fields at rest, rate-limited login attempts, mandatory email verification for self-registered accounts, and audit logging of significant account actions. No system is perfectly secure; we encourage strong, unique passwords and prompt reporting of any suspected unauthorized access.
We use a session cookie strictly necessary to keep you logged in, and no third-party advertising or tracking cookies.
Questions about this Privacy Policy, or requests regarding your personal data, can be directed to the Foras NGO MIS team through the contact details provided on our website.