Privacy Policy

Ksav builds and runs Hachnosas Sefer Torah campaign sites for shuls and schools. It is operated by Ariel Remer from Toronto, Ontario, Canada.

Two very different groups of people end up here, and what applies to you depends on which one you are:

• You run a campaign, or you are thinking about one. Read the first part.
• You gave to a campaign someone else is running. Read the second part.

Questions either way go to hello@ksav.co.

Part one: organizations using Ksav

What we collect from you

If you enquire through this site. Your name, your organization, your email address, and your message.

If you have a login. Your email address and the campaign it belongs to. Sign in is by password or by a link emailed to you.

What you put into your campaign. Your organization's details, who the campaign is dedicated to, the text you write, and any images you upload, including logos, hero images and photographs of the person being honored.

Your Stripe keys. So the campaign can take donations into your own Stripe account. They are stored separately from everything else and are not readable by anyone browsing the site.

Automatically. Standard analytics about visits, described further down.

Two things about images

Images uploaded to a campaign are stored in a public bucket. That means anyone holding the direct link to an image can open it, whether or not they can see your campaign. Please keep that in mind when you upload a photograph of a person, which is usually a photograph a family has given you.

Campaign pages are set to noindex, so they should not turn up in search results. That keeps them out of Google. It does not make them private.

What we do with it

We run your campaign, answer your questions, send you the emails the system needs to send, and keep the service working. That is the whole of it. Nothing is used to advertise anything, to anyone.

Part two: if you donated to a campaign

Who holds your information

The campaign you gave to belongs to a shul or a school. They decide what happens to your information. Ksav is the software they use. We hold your details on their behalf and act on their instructions.

If you want your information changed or removed, the fastest route is to contact the organization you gave to. You can also write to hello@ksav.co and we will help, but the decision is theirs.

What is held about you

Your name, your email address, the message you wrote if you wrote one, what you gave towards, and the amount.

Your card details are not held here

The donation is charged on the organization's own Stripe account, using their own keys. Ksav has no payment page and no card field. We keep a Stripe reference number and the amount, and never a card number.

The honor wall is public

This matters, so plainly: the campaign page shows an honor wall, and it can be seen by anyone with the link.

If you did not tick the anonymous box, your name appears on it.

If you did tick it, your name is hidden but your message is still shown. The message is treated as something you chose to write in public. If you would rather it were not there at all, ask the organization, or write to hello@ksav.co.

Who else handles information

• Supabase holds the database and runs sign-in. https://supabase.com/privacy
• Vercel hosts the site. https://vercel.com/legal/privacy-policy
• Stripe processes donations, on the organization's own account. https://stripe.com/privacy
• Resend sends the emails, including donation confirmations. https://resend.com/legal/privacy-policy
• Google provides Google Analytics. https://policies.google.com/privacy

These providers operate in the United States and elsewhere, so information is stored outside Canada and is subject to the laws of the country it sits in, including lawful access requests by authorities there. Ask at hello@ksav.co if you want more detail about any of them.

Nothing is sold. Nothing is rented. No donor list is shared with another organization, and no advertising or retargeting runs anywhere on this service.

Cookies

Sign-in uses a cookie to keep you signed in, which the service cannot work without. Google Analytics sets cookies so repeat visits can be told apart. There are no advertising cookies.

You can block or delete cookies in your browser settings. Blocking the analytics ones changes nothing you can see. Blocking the sign-in one means you cannot stay signed in.

How long things are kept

Campaign and donation records are kept for as long as the organization keeps its campaign with Ksav, because they are the record of who gave what and the organization needs it. If an organization asks for its campaign and its records to be deleted, they are deleted.

Enquiries sent through this site stay in our records after they are answered. Ask and yours will be removed.

Google Analytics keeps its data for the period set on the analytics property and deletes it automatically after that.

Your choices

Asking what is held about you. Write to hello@ksav.co. If you are a donor, say which campaign, and expect us to check with the organization before changing anything, because the records are theirs.

Correcting it. Tell us what is wrong and it will be fixed.

Deleting it. For an organization's own account, ask and it will be done. For a donation record, the organization decides, and we will pass the request on and tell you what they say.

Withdrawing consent. You can withdraw consent to us holding your information at any time, which may mean an account can no longer be used.

Complaining. If you are not satisfied with how a request was handled you can bring a complaint to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca or by calling 1-800-282-1376.

Children

Ksav is for adults running and giving to fundraising campaigns. It is not directed at children and information is not knowingly collected from anyone under thirteen.

Security

Access to the database is restricted at the row level, the browser never writes to it directly, and every write goes through a server that checks who is asking. Stripe keys are stored apart from everything else and are not readable by an ordinary visitor. The service is served over HTTPS throughout.

No service can promise that nothing will ever go wrong. If a breach ever created a real risk of significant harm, affected people and the Office of the Privacy Commissioner of Canada would be notified as soon as feasible, and the affected organizations would be told so they could tell their donors.

Changes

If this policy changes in a way that matters, the effective date at the top changes and the new version is posted here. Organizations using Ksav will be told directly.

Contact

Ksav
Ariel Remer
hello@ksav.co