Privacy policy

1. Who We Are and What This Policy Covers

Humanity Cares is the public name of Waveway Foundation Inc., a Florida nonprofit corporation and a 501(c)(3) public charity, recognised as tax-exempt since April 9, 2025. In this policy, "we", "us" and "the foundation" mean that organisation, and "you" means anyone who visits our website, donates, joins a cleanup or writes to us.

Legal entity

Waveway Foundation Inc.

EIN

33-4547181

Registered address

5861 SW 14th St, Miami, FL 33144

Privacy contact

Kelly@HumanityCaresFoundation.org

Scope

This policy covers humanitycaresfoundation.org and every page on it. It does not cover the separate websites of our payment processor, our partners or our social channels, each of which runs under its own policy.

"Personal information" here means information that identifies you or can reasonably be linked to you, such as your name, email address, postal address or the details of a gift you made.

2. Summary

This summary is written for speed and is not a substitute for the sections below, which govern.

3. Information We Collect

Information you give us

We only receive this when you choose to send it. Nothing on this website is collected silently from a form you did not fill in.

• When you donate.Through the DonorBox form on our donate page, or on DonorBox's own page: typically your name, email address, the amount, the date, whether the gift repeats, and anything else DonorBox asks for on that campaign. DonorBox passes the resulting donor record to the foundation. Payment card details go to DonorBox and Stripe and never to us. See section 5.
• When you submit a beach for a cleanup. The form at /submit-a-beach asks for the name of the beach, roughly where it is, an optional description of what you have seen there, and then your first name, last name and email address so we can come back to you.
• When you use the chat bubble. Whatever you type into it, and the contact details you give the person answering.
• When you email us or turn up to a cleanup. Whatever is in your message, and the sign-in details a crew member records on the day.

Information collected automatically

• Aggregate page counts. Every page loads Vercel Web Analytics, which counts page views, the referring site, an approximate country and a coarse device and browser type. It sets no cookie and writes nothing to your browser storage, so it cannot follow you from one website to another.
• Google Analytics. If you scroll, tap or click, the page then loads Google Analytics, which records the pages you view, roughly where in the world you are, your device and browser type, the site that sent you, and which buttons you press, such as a donate link. It sets two cookies so that a second page view is not counted as a second person. We do not give Google your name or your email address, we run no advertising with it, and you can switch it off in section 4.
• Ordinary web server records. The site is hosted on Vercel. Serving you a page necessarily involves your IP address and browser user-agent reaching the host. That is how the web works rather than something we gather for our own use. We run no logging, database or session store of our own.
• A short-lived abuse check. When you submit the beach form, our server holds your IP address in memory for sixty seconds to stop one sender flooding the form. It is never written to disk, never sent onward and is gone when the window closes.

Information from third parties

We receive donor records from DonorBox as described in section 5, and enquiries from people who reach us through our social channels. We do not buy contact lists, we do not append or enrich records from data brokers, and we do not build profiles about you from outside sources.

4. Cookies, Analytics and Similar Technologies

This website uses Google Analytics to understand how people find and use it, which pages are worth keeping and which calls to action work. That is the only reason it is here. There is no advertising tag, no retargeting pixel, no social share pixel, no heatmap tool, no A/B testing tool and no cross-site profiling.

Google Analytics does not load when the page opens. It loads only if you scroll, tap, click or type, so a visitor who arrives and leaves without touching anything is never measured by it at all. When it does load it sets two first-party cookies, _ga and a second beginning _ga_, which exist to tell a returning visitor from a new one so the same person is not counted twice. They expire after two years and they cannot be read by any other website.

We never send Google your name, your email address, your donation, or anything you type into a form. What it receives is the page you are on, the site that sent you, an approximate location, your device and browser type, and which buttons you press.

Two presses are also counted by our own server rather than by the Google tag in your browser: choosing a donation amount, and opening the sponsorship chat. Those two are how we know the site is working at all, and a browser extension that blocks Google hides them completely, so for those two we record the press ourselves and pass the count to Google from our end instead.

To be exact about what that carries, because it is the one place we send Google a number: if you press the $25 button, Google is told that a donation of that size was started. It is the figure printed on the button you pressed, not the amount you go on to give. What you type into DonorBox, whether you finish, and whether the payment succeeds are all invisible to us and are never sent. Neither is your name or your email address. If you turn analytics off below, this stops as well.

The only thing this site writes to your browser storage is the result of that choice, so we can remember it. Typefaces are served from our own domain, so loading a page here does not make a request to Google Fonts or any other font host.

Two third parties can set their own cookies inside their own embedded panels, under their own policies rather than ours: the DonorBox donation form on the donate page, and the chat bubble. Blocking third-party cookies in your browser will stop those panels working and will not otherwise affect the site.

We do no cross-context behavioural advertising, so a Do Not Track header or a Global Privacy Control signal has no advertising here to switch off. If you send one, we honour it in the sense that the behaviour it exists to stop does not happen on this site. To stop the analytics measurement described above, use the button in this section.

5. Donations and Payment Processing

Donations to the Show You Care!campaign are processed end to end by DonorBox, with Stripe processing the card behind it. The donate page embeds DonorBox's own form in a frame and loads a DonorBox script so the frame can size itself. What you type into that form goes to DonorBox and Stripe.

We do not collect, receive, process or store payment card numbers, expiry dates, security codes or bank account details at any point. There is no route in this website's code that could. Card data is handled by processors that maintain their own PCI DSS compliance.

Because that form is DonorBox's rather than ours, visiting the donate page means your browser connects to DonorBox and Stripe, and each applies its own privacy policy.

What that frame loads, and the cookies it sets, measured on the live page: DonorBox and its Cloudflare protection (which sets a cf_clearance cookie), Stripe (m), Google reCAPTCHA (_GRECAPTCHA), Google Tag Manager, Google Maps, New Relic and Cloudflare Insights. None of these are ours, none are used for advertising by us, and all of them arrive with DonorBox's embedded form. They load only on the donate page.

The chat widget loads on every page and its provider's network sets a __cf_bm cookie, which exists to tell humans from bots. It carries no advertising or profiling function. Read DonorBox's privacy policy and Stripe's privacy policy. You can also give directly at our DonorBox page, which skips this website entirely.

After a gift, DonorBox passes the donor record to the foundation: typically your name, email address, the amount, the date and anything else you chose to complete. We use it to send your receipt, to acknowledge the gift, to keep the records a charity is required to keep, and occasionally to tell donors what their money paid for.

To confirm: Which fields the Show You Care! campaign actually asks a donor for, in particular whether a postal address or a phone number is requested, and whether the donor record is copied from DonorBox into any other system such as an accounting package or a CRM. Both answers belong in this section.

6. How We Use Information

We use personal information for the charitable purposes of the foundation and for nothing else. Specifically:

• To process a donation, send a receipt and acknowledge the gift.
• To keep the financial, tax and governance records a US charity is required to keep.
• To answer a message you sent us, by email or through the chat bubble.
• To assess a beach you submitted and come back to you about it.
• To organise and run cleanups and other events, including telling you about one.
• To send updates about our work to people who asked to hear from us, and to tell donors what their gift did.
• To understand which pages of this site people read, using aggregate counts only.
• To protect the site and the foundation against fraud, abuse and misuse, and to comply with the law.

We do not use personal information to build advertising profiles, we do not run automated decision-making or profiling that produces legal or similarly significant effects, and we do not use it for any purpose incompatible with the ones listed above.

7. How We Share Information

We share personal information only in these situations.

• Service providers who work on our behalf. Vercel hosts this website. DonorBox and Stripe process donations. LeadConnector, part of GoHighLevel, carries the chat bubble and receives beach submissions. Each acts on our instructions for the purpose we engaged it for.
• Professional advisers. Our accountants, auditors and lawyers, where they need it to do their work for us.
• When the law requires it. To comply with a subpoena, court order, lawful request or reporting obligation, and to establish, exercise or defend a legal claim.
• To prevent harm. Where we reasonably believe disclosure is necessary to protect the safety of any person, or to investigate fraud or a security incident.
• On a merger, dissolution or transfer of assets. If the foundation merges with, or transfers its programmes to, another organisation, donor and supporter records may transfer as part of that. Any recipient would be bound by this policy or would have to give you notice before changing it.

Nobody outside that list receives your information for their own purposes, and none of the providers above is permitted to use it for their own marketing.

To confirm: Whether written data processing agreements are on file with Vercel, DonorBox and GoHighLevel. Each offers one, and having them signed is what makes the sentence above enforceable rather than merely intended.

8. Donor Lists: What We Never Do

Many large charities exchange, rent or swap donor names and postal addresses with other organisations to find new supporters. Under several state privacy laws that practice counts as a "sale" of personal information, and the charities that do it have to say so.

We do not do it. We do not sell, rent, trade, exchange or otherwise disclose your name, email address, postal address, phone number or donation history to any other charity, business, list broker, co-operative database or data broker, for their marketing or for anything else. We do not sell or share personal information for cross-context behavioural advertising, and we have not done so in the twelve months before the date at the top of this page. We do not sell or share the personal information of anyone we know to be under sixteen.

If that ever changes, we will say so in this section and give you a way to opt out before it starts, not after.

9. Donor Recognition and Giving Anonymously

We sometimes thank donors and sponsors publicly, by name, on this website, in social posts, in reports and on materials at events. Sponsor organisations that support a cleanup are listed on the site as a condition of that support.

Individual donors are never listed without being asked. If you would rather give anonymously, or you have been listed and want your name taken down, email Kelly@HumanityCaresFoundation.organd we will remove it. We never publish a donation amount against a named individual without explicit permission, and we never publish a donor's email address, postal address or phone number.

10. Your Communication Choices

You control every channel we might reach you on, separately, and you do not have to explain why.

• Email. Use the unsubscribe link at the foot of any message we send, or write to Kelly@HumanityCaresFoundation.org asking to be removed. We act on it as soon as we can and in any case within ten business days.
• Post. Write to Kelly@HumanityCaresFoundation.org or to the address in section 19 asking not to receive mail, and we will stop.
• Text messages. We do not currently run an SMS programme. If we ever do, it will be opt-in and replying STOP will end it.
• Recurring donations. Manage or cancel these through the DonorBox receipt you were emailed, or ask us at Kelly@HumanityCaresFoundation.org and we will do it for you.

Two things opting out will not stop, because they are not marketing: a receipt or tax acknowledgement for a gift you made, and a reply to a message you sent us.

11. Your Privacy Rights and How to Use Them

Wherever you live, and whether or not a statute gives you the right, we will honour these requests:

• To know what personal information we hold about you and where it came from.
• To get a copy of it in a portable form.
• To have it corrected if it is wrong.
• To have it deleted.
• To opt out of any marketing communication.
• To be told if we ever start selling or sharing information, which today we do not.

Email Kelly@HumanityCaresFoundation.org with your request. We will acknowledge it and respond within forty-five days, and we will tell you if we need longer. We may ask you to confirm your identity, usually by writing from the email address already on the record, so that we do not hand your information to somebody else. Using these rights costs nothing and we will never treat you differently for asking.

An authorised agent may make a request for you if they provide your written permission and we can verify it with you directly.

If we refuse a request we will tell you why, and you may appeal by replying to that answer with the word "appeal". A different person will review it and respond within forty-five days.

Some records we cannot delete. US tax law requires a charity to keep records substantiating charitable contributions, so we keep the minimum donation record the law requires even after a deletion request. We will delete everything else and tell you what was kept and why.

12. US State Privacy Rights

Most US state privacy statutes exempt 501(c)(3) nonprofit organisations outright, and Florida's own Digital Bill of Rights applies only to very large for-profit businesses. The foundation is therefore outside the scope of most of them. We have chosen to extend the substance of these rights to everyone anyway, in section 11, rather than audit which statute reaches us.

Colorado and Oregon

The Colorado Privacy Act and the Oregon Consumer Privacy Act are the two that do reach nonprofits. If you live in either state, you have the rights listed in section 11, including the right to opt out of the sale of personal information and of targeted advertising, and the right to appeal a refusal. Neither sale nor targeted advertising happens here, as section 8 sets out.

California

California's privacy statutes apply to for-profit businesses meeting revenue or data thresholds, and a 501(c)(3) is not one. We honour California-style requests regardless. For completeness: we have not sold or shared personal information in the preceding twelve months, so there is no "Do Not Sell or Share My Personal Information" link to provide, and we have disclosed no personal information to third parties for their own direct marketing purposes, which is what California's Shine the Light law is about.

Everywhere else

If your state gives you privacy rights we have not named, write to Kelly@HumanityCaresFoundation.org and we will honour them.

13. Children and Young Volunteers

This website is not directed at children under thirteen and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under thirteen without a parent or guardian's consent, we will delete it as quickly as we can. If you believe a child has sent us information, email Kelly@HumanityCaresFoundation.org and we will remove it.

Our cleanups are family events and children are welcome at them. A person under eighteen must be accompanied and supervised by a parent or guardian at a cleanup, and where we record any information about a young volunteer on the day, we take it from the accompanying adult rather than from the child.

To confirm: Whether the foundation collects anything about under-eighteens at events beyond a name on a sign-in sheet, and whether a parent or guardian signature is taken. If a youth programme, school partnership or internship is ever run, this section needs rewriting before it starts.

14. How Long We Keep Information

We keep personal information only for as long as we need it for the purposes described in this policy, unless a longer period is required or permitted by law. In practice that means:

• Donation records: kept for at least seven years, which is the period US tax and charity accounting practice calls for.
• Correspondence and beach submissions: kept while the matter is live and for a reasonable period afterwards, then deleted.
• Supporter contact details: kept while you want to hear from us, and removed when you ask.
• Aggregate analytics: no personal information is involved, so there is nothing to retain about you.

To confirm: The retention periods our providers apply to the records they hold on our behalf, in particular DonorBox's donor record retention, GoHighLevel's contact and chat transcript retention, and Vercel's server log window. Those numbers should replace this note.

15. Security

We use reasonable administrative, technical and physical measures to protect personal information. This website is served only over an encrypted connection, so anything you send travels encrypted in transit. Card payments are handled entirely by processors that maintain their own PCI DSS compliance, which is the single biggest reduction in risk available to a small charity: the most sensitive data never reaches us at all. The endpoint that receives beach submissions validates and rate-limits what it accepts, and the credentials it uses are held server-side and never appear in the pages your browser downloads. Access to donor records is limited to the people who need it.

No method of transmission over the internet and no method of electronic storage is completely secure, so we cannot guarantee absolute security. If a breach ever affects your personal information, we will notify you and the relevant authorities as the law requires.

16. Third-Party Links and Services

This website links out to other sites, including our donation provider, our Instagram and the sites of partners and sponsors. We do not control those sites and we are not responsible for their content, their terms or their handling of your information. Their policies apply from the moment you arrive on them.

The Instagram photo strip

The home page can show recent photos from the foundation's Instagram. The list of photos is fetched by our server rather than by your browser, so nothing about you reaches the feed service. The photographs themselves are loaded from whoever hosts them, so when the live feed is switched on your browser makes a request to that host, which necessarily shows it your IP address and browser type. The feed is off unless a feed address is configured, and when it is off the photos you see are stored on this site and no third party is contacted.

17. Visitors From the EEA and the UK

The foundation is based in Florida and the services we use store information in the United States. If you visit or donate from the European Economic Area or the United Kingdom, your information is transferred to and processed in the United States, which has different privacy laws from your own.

Where the UK GDPR or the EU GDPR applies to us, we rely on these legal bases: performing a contract, where you asked us to process a donation or answer a request; our legitimate interests in running a charity and keeping supporters informed; your consent, where you asked to hear from us; and compliance with a legal obligation. You may withdraw consent at any time, and you have the rights set out in section 11 as well as the right to complain to your national supervisory authority.

To confirm: Whether the foundation actually solicits or accepts donations from the EEA or the UK. If it does so meaningfully, this section needs a lawyer, a named transfer mechanism such as the Standard Contractual Clauses, and possibly a representative in the EU or UK. If it does not, this section can stay short as it is.

18. Changes to This Policy

We may update this policy. When we do, we change the effective date at the top of this page. If a change is material, such as adding a new form, a new provider or a new use of your information, we will describe it plainly rather than slip it in quietly, and we will give notice before it takes effect where the law requires that.

The version of this policy that was in place when you gave us your information will generally govern that information, unless you agree to the new version.

19. How to Contact Us

Questions about this policy, or a request under section 11, go to Kelly@HumanityCaresFoundation.org. We aim to acknowledge within five business days.

By email

Kelly@HumanityCaresFoundation.org

By post

Waveway Foundation Inc., 5861 SW 14th St, Miami, FL 33144

EIN

33-4547181

To confirm: Which provider hosts Kelly@HumanityCaresFoundation.org, since that provider stores the correspondence and ought to be named in section 7, and whether the foundation wants to publish a telephone number here as the large charities do.