Privacy Policy

1. Introduction

BenefitsSafe, Inc. ("BenefitsSafe," "we," "our," or "us") operates a grant disbursement platform that helps nonprofit organizations manage restricted funds on behalf of beneficiaries receiving Supplemental Security Income (SSI), Social Security Disability Insurance (SSDI), Medicaid, Medi-Cal, CalFresh, and In-Home Supportive Services (IHSS) benefits.

This Privacy Policy describes the categories of personal information we collect, how we use and share that information, the rights available to you under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and how to exercise those rights.

By creating an account or using our platform you agree to this Privacy Policy. If you do not agree, please do not use BenefitsSafe.

2. Categories of Personal Information We Collect

We collect the following categories of personal information as defined under CCPA §1798.140(v):

Sensitive Personal Information

Under CPRA, we may collect the following sensitive personal information:

• Last 4 digits of Social Security Number (beneficiaries only, for identity verification)
• Government benefit program enrollment status (SSI, SSDI, Medi-Cal, CalFresh, IHSS)
• Financial account information processed through Stripe (we do not store full card numbers)

We use sensitive personal information only for the purposes of providing our services (grant disbursement, compliance verification, virtual card issuance) and not for profiling or advertising. You have the right to limit our use of sensitive personal information — see Section 7 below.

3. Sources of Personal Information

• Directly from you: When you register, create grants, submit expenses, upload documents, or contact support
• From your organization's administrator: When an admin adds you as a team member, beneficiary, or vendor
• Automatically: Login activity, device fingerprints, IP addresses, and session data collected for security
• Third-party service providers: Stripe (payment/card data), Google/Microsoft (OAuth authentication), AWS (infrastructure)
• Government databases: OFAC SDN list screening for sanctions compliance (name-matching only)

4. How We Use Your Information

We use personal information for the following business and commercial purposes:

• Providing, maintaining, and improving the BenefitsSafe platform
• Processing grant disbursements, expense approvals, and virtual card transactions
• Verifying nonprofit status through EIN verification
• Classifying expense requests for SSI/SSDI/Medicaid compliance
• Screening against OFAC sanctions lists as required by federal law
• Issuing and managing virtual payment cards via Stripe Issuing
• Generating financial reports, audit trails, and ledger entries
• Sending transactional notifications about account and grant activity
• Detecting fraud, unauthorized access, and session anomalies
• Responding to your support requests
• Complying with legal obligations (IRS record-keeping, anti-money laundering)

We do not use personal information for behavioral advertising, profiling for unrelated purposes, or cross-context behavioral advertising.

5. How We Share Your Information

We do not sell your personal information. We have not sold personal information in the preceding 12 months.

We do not share your personal information for cross-context behavioral advertising.

We disclose personal information to the following categories of third parties for business purposes:

• Stripe, Inc.: Payment processing, virtual card issuance, Treasury financial accounts, KYC verification, and transaction monitoring. Stripe acts as our payment processor under its own privacy policy.
• Amazon Web Services (AWS): Cloud infrastructure, database hosting (RDS PostgreSQL), file storage (S3), and encryption services. AWS processes data under our instructions as a service provider.
• Google / Microsoft: OAuth authentication only (if you choose to sign in with Google or Microsoft). We receive only your name and email.
• Anthropic: AI compliance assistant queries are processed by Claude. No personally identifiable financial data is sent to the AI model.
• Your organization: Admins within your nonprofit can view data related to their organization's grants, expenses, and beneficiaries.
• Legal requirements: When required by law, subpoena, court order, or government investigation.
• Business transfers: In connection with a merger, acquisition, or sale of assets (with prior notice to you).

6. Data Protection Measures

• TLS 1.2+ encryption for all data in transit
• AES-256-GCM encryption for sensitive data at rest
• TOTP-based multi-factor authentication (MFA) with encrypted backup codes
• Role-based access control (RBAC) with 12 distinct user roles
• Immutable, append-only audit logs for all financial transactions
• Session fingerprinting and trusted device tracking to detect stolen sessions
• OFAC sanctions screening before virtual card issuance
• Merchant category code (MCC) blocking at three layers (Stripe, webhook, grant-level)
• Rate limiting on authentication and financial endpoints
• AWS infrastructure with SOC 2 Type II compliance
• Stripe PCI DSS Level 1 certification for all card data handling
• Regular security assessments following OWASP Top 10 and NIST guidelines

7. Your Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights:

Right to Know / Access

You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collection, and the categories of third parties with whom we share it.

Right to Delete

You may request deletion of your personal information. We will comply except where retention is required by law (e.g., IRS 7-year record retention for nonprofit financial records, active legal proceedings, or fraud prevention). When we cannot fully delete, we will anonymize your data by replacing personally identifiable fields with anonymized values and deactivating your account.

Right to Correct

You may request correction of inaccurate personal information. You can also update most account information directly through your profile settings.

Right to Opt-Out of Sale / Sharing

We do not sell or share personal information for cross-context behavioral advertising. No opt-out is necessary, but we honor Global Privacy Control (GPC) signals.

Right to Limit Use of Sensitive Personal Information

You may request that we limit use of sensitive personal information (SSN last 4, benefit program status) to only what is necessary to provide our services. Contact us to exercise this right.

Right to Non-Discrimination

We will not discriminate against you for exercising any privacy right. You will not receive different pricing, quality of service, or access levels for exercising your rights.

Right to Data Portability

You may request a copy of your personal information in a structured, commonly used, machine-readable format (JSON). Use the "Export My Data" feature in your account settings or contact us directly.

8. How to Exercise Your Rights

You may submit a verifiable consumer request by:

• Emailing privacy@benefitssafe.com with the subject "Privacy Rights Request"
• Using the in-app data export or deletion features under Account Settings

Verification: We will verify your identity using your account email address and, for sensitive requests, may require additional verification (e.g., confirming recent account activity). We aim to respond within 45 calendar days. If we need additional time, we will notify you of the extension (up to 90 days total) and the reason.

Authorized Agents: You may designate an authorized agent to submit requests on your behalf. The agent must provide written authorization signed by you, and we may contact you directly to verify the request.

9. Data Retention

• Financial records and audit logs: 7 years minimum (IRS §6001 record-keeping requirement for tax-exempt organizations)
• Ledger entries: Permanently retained (immutable by design for audit integrity)
• Account data: Duration of active account plus 30 days after deletion request
• Session and security logs: 90 days (IP addresses, device fingerprints, login history)
• Uploaded documents: Retained until the associated grant is closed plus 7 years, or until deletion is requested
• Stripe card/transaction data: Managed by Stripe under their retention policy; we retain transaction references for 7 years

10. Cookies and Tracking Technologies

We use only essential cookies required for platform functionality:

• Session cookie (authjs.session-token): Maintains your authenticated session. HttpOnly, Secure, SameSite=Lax.
• Device fingerprint cookie (bs-device-fp): Detects session hijacking. HttpOnly, Secure, 30-day expiry.
• CSRF token: Prevents cross-site request forgery on form submissions.

We do not use third-party tracking cookies, advertising cookies, analytics cookies, or social media tracking pixels. We honor Do Not Track (DNT) and Global Privacy Control (GPC) signals.

11. Children's Privacy

BenefitsSafe is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected information from a child under 18, we will promptly delete it. If you believe a minor has provided us with personal information, please contact us at privacy@benefitssafe.com.

12. "Do Not Sell or Share My Personal Information"

BenefitsSafe does not sell personal information and has never sold personal information. We do not share personal information for cross-context behavioral advertising as defined under CPRA. Because we do not engage in these practices, no opt-out mechanism is required; however, we respect and process Global Privacy Control (GPC) signals as a valid opt-out request.

13. California "Shine the Light" (Cal. Civ. Code §1798.83)

California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. As stated above, we do not disclose personal information to third parties for their direct marketing purposes.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via email to the address associated with your account and/or by posting a prominent notice on our platform at least 30 days before the changes take effect. Your continued use of BenefitsSafe after the effective date constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights:

BenefitsSafe, Inc.
Email: privacy@benefitssafe.com
Website: benefitssafe.com

Terms of Service