Your privacy matters
How we collect, use, and protect your information on the RoundPaper platform.
Last updated: March 12, 2026
Information We Collect
When you create an account or use our platform, we may collect the following categories of information: Identifiers: Your name, email address, and account credentials. Commercial information: Payment and billing details if you subscribe to a paid plan, processed securely by our third-party payment provider. Internet and electronic activity: Queries you run in Data Chat, pages you visit, features you use, IP address, browser type, and operating system. Inferences: We may derive usage trends from your activity to improve the platform experience, but we do not build advertising profiles about you.
Public Data Sources
The nonprofit data on our platform is sourced from IRS Form 990 filings, which are public records. This includes organizational financials, executive compensation, governance details, grants, and other information that tax-exempt organizations are required to disclose. We do not collect this data from private or confidential sources.
How We Use Your Information
We use the information we collect to: • Provide, maintain, and improve the platform and its features (basis: contract performance). • Process your Data Chat queries and deliver results (basis: contract performance). • Communicate with you about your account, updates, and support requests (basis: contract performance and legitimate interest). • Analyze usage patterns to improve platform performance and user experience (basis: legitimate interest). • Prevent fraud, abuse, and other harmful activity (basis: legitimate interest and legal obligation).
AI & Data Chat Privacy
Your Data Chat queries, conversations, and results are private to your account. We do not share your queries with other users or make them publicly visible. To process your natural-language queries, we send them to a third-party large language model (LLM) provider. The query text and relevant database context are transmitted to this provider solely to generate a response. Our LLM provider is contractually prohibited from using your queries to train their models or for any purpose other than providing the service to us. We may use anonymized, aggregated query patterns to improve the accuracy and performance of our AI systems, but your individual queries are never exposed to third parties beyond the LLM provider described above. The platform does not make automated decisions about you based on profiling. Data Chat returns query results from public IRS data — it does not evaluate, score, or make decisions about individual users.
Cookies, Analytics & Do Not Track
We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the platform is used. We may use third-party analytics services to help us measure traffic and usage trends. You can control cookie preferences through your browser settings. Some browsers offer a "Do Not Track" (DNT) setting and the Global Privacy Control (GPC) signal. We honor GPC signals as a valid opt-out of any sale or sharing of personal information. For general DNT signals, there is currently no industry-wide standard for how sites should respond, so we do not alter our data collection practices in response to DNT headers at this time.
Data Retention
We retain your account information for as long as your account is active or as needed to provide you with the platform. Usage logs and Data Chat query history are retained for up to 24 months to support platform improvements and troubleshooting. Payment records are retained as required by applicable tax and accounting laws. When you delete your account, we will remove your personal information from our active systems within 30 days. Some data may persist in encrypted backups for a limited period and will be deleted in the normal backup rotation cycle.
Data Security
We implement industry-standard security measures to protect your personal information, including encryption in transit and at rest, secure authentication, and regular security reviews. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
Third-Party Service Providers
We do not sell your personal information to third parties. We may share information with trusted service providers who help us operate the platform, including: • Cloud hosting and infrastructure providers for storing and serving the platform. • Payment processors for handling subscriptions and billing. • Email delivery services for account and support communications. • Analytics providers for understanding usage patterns. • AI/LLM providers for processing Data Chat queries (see "AI & Data Chat Privacy" above). These providers receive only the data necessary to perform their services and are contractually obligated to protect your information and not use it for their own purposes.
International Data Transfers
RoundPaper is based in the United States, and your data is stored and processed on servers located in the United States. If you access the platform from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence. By using the platform, you consent to this transfer. Where required by law, we implement appropriate safeguards for cross-border data transfers.
Children’s Privacy
The platform is not directed at children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us.
Your Rights
You may access, update, or delete your account information at any time through your account settings. If you wish to have your data fully removed from our systems, contact us and we will process your request in accordance with applicable law. Depending on your jurisdiction, you may have additional rights, including the right to: • Request a copy of the personal information we hold about you. • Request correction of inaccurate information. • Request deletion of your personal information. • Object to or restrict certain processing of your data. • Data portability — receive your data in a structured, machine-readable format. • Withdraw consent where processing is based on consent. If you are located in the European Economic Area or United Kingdom, you also have the right to lodge a complaint with your local data protection supervisory authority. Users in the United States may contact the Federal Trade Commission or their state attorney general with privacy concerns.
Changes to This Policy
We may update this privacy policy from time to time. If we make material changes, we will notify you by email or through a notice on the platform. Your continued use of the platform after changes take effect constitutes your acceptance of the updated policy. This policy is effective as of March 12, 2026.
Governing Law
This privacy policy is governed by and construed in accordance with the laws of the United States. Any disputes arising from this policy will be resolved in accordance with applicable law.
Contact Us
If you have questions about this privacy policy or how we handle your data, please reach out through our Help & Support page.