Privacy Policy

The controller of personal data processed under this Privacy Policy is:

We are responsible for deciding how and why your personal data is processed in connection with the Services.

This Privacy Policy applies to personal data we collect from or about users of the Services, including when you:

• Create or use a Ritmo account
• Browse causes, nonprofit content, or impact information
• Make contributions or related payments through third-party payment providers
• Direct advisory grant recommendations to nonprofit organizations
• Participate in donation credits, rewards, badges, levels, points, referrals, or other engagement features
• Visit our website
• Communicate with us
• Otherwise access or interact with the Services

This Privacy Policy does not cover the privacy practices of third parties, including Givinga Foundation, payment providers, analytics providers, or nonprofit organizations. We encourage you to review their privacy notices separately.

All monetary contributions made through the Services are processed by Givinga Inc. and directed into a donor-advised fund administered by The Givinga Foundation, a US 501(c)(3) public charity (the "DAF"). Givinga Inc. handles payment processing and transaction execution. The Givinga Foundation handles fund custody, grant disbursement to nonprofit recipients, and donation receipt issuance.

Details regarding fees are set out in our Terms of Service.

When you make a contribution or payment through the Services, your transaction may be processed by one or more third parties, including Givinga Inc., The Givinga Foundation, Stripe, Apple Pay, Google Pay, PayPal, or other payment or wallet providers made available through the Services. Those third parties may process your personal data under their own privacy notices and terms.

Where applicable under US law, The Givinga Foundation will provide donation receipts to US residents for tax purposes in connection with contributions made through the Services.

4.1 Account and Profile Information

Name; email address; account credentials or authentication information; country, region and city; profile details you choose to provide; cause preferences and interests; communication preferences.

4.2 Contribution and Transaction-Related Information

Records of contributions initiated through the Services; contribution amounts, frequency, and related preferences; Service Contribution amounts; nonprofit selections and advisory grant recommendations; cause categories selected; transaction status; donation receipt information received from Givinga Foundation; limited payment-related metadata we receive from payment or donation-processing partners.

4.3 Cause Preferences and Recommendation Data

Cause categories and nonprofit organizations you browse, select, save, or interact with; your responses to daily cause recommendations; time spent viewing nonprofit profiles or impact information; patterns of app usage behavior over time. We use this data to personalize your experience, including to generate daily recommendations matched to your values and interests. This constitutes profiling as described in Section 7.

4.4 Donation Credits, Rewards, and Engagement Data

Donation credit balance and history; badges, points, levels, and rewards earned; referral or invite activity, including email of the users your invite; campaign participation; engagement metrics.

4.5 Device, App, and Usage Information

Device type, model, and operating system; app version and identifiers; log data (timestamps, actions, errors); IP address; approximate location inferred from IP address; app events, interactions, screens viewed, session duration, and usage analytics; advertising identifiers (where permitted by your device settings); referral source and attribution data.

Location information you provide. During onboarding or in your account settings, you may provide your city, region, or other location information. We use this to personalize your experience, including recommending causes and nonprofit organizations that operate near you. This location data is stored in your account profile and used for recommendation profiling as described in Section 7. You can update or remove this information at any time in your account settings.

Push notification tokens. If you enable push notifications, we collect device tokens necessary to deliver notifications through Apple Push Notification Service (APNs) or Google Firebase Cloud Messaging (FCM). You can disable push notifications at any time through your device settings.

4.6 Communications

Messages you send to us; support requests; email communications and related metadata; survey responses; feedback.

4.7 Contest and Leaderboard Lookup Data

When you use a contest or leaderboard "search my rank" feature, we collect the email address you submit, the result of the lookup (whether your account was found), the page you searched from, and any UTM parameters present. This helps us run the contest, display your anonymized rank, and understand interest in our campaigns.

4.8 Information From Third Parties

We may receive information from third parties, including:

• Givinga Inc. and The Givinga Foundation (transaction confirmations, receipt status, grant disbursement status)
• Payment providers such as Stripe, Apple Pay, Google Pay, and PayPal (payment status, limited transaction metadata)
• Authentication providers such as Clerk (account verification, login events, session data)
• Analytics and product intelligence providers such as PostHog and RudderStack (usage analytics, feature engagement, event data)
• Attribution providers such as Adjust (install attribution, campaign performance - activated when paid acquisition begins)
• Communication and engagement providers such as Customer.io (message delivery status, engagement data)
• Cloud infrastructure and backend providers such as TBD (database hosting and backend processing)
• Brand sponsors participating in donation credit programs (participation and eligibility data, where applicable)

• Directly from you when you create an account, make contributions, use the "search my rank" feature on a contest or leaderboard page, interact with app or marketing content, or communicate with us.
• Automatically through cookies, mobile SDKs, pixels, analytics tools, and similar technologies when you use the Services or visit our website. See Section 9 for details.
• From third parties involved in payment processing, donation execution, analytics, attribution, messaging, and service delivery, as described in Section 4.8.

We use your personal data for the following purposes:

• To provide and operate the Services, including processing your contributions, crediting your account, and transmitting your advisory grant recommendations to Givinga Foundation.
• To personalize your experience, including generating daily cause recommendations matched to your values, interests, and giving history.
• To manage donation credits, rewards, badges, referrals, and other engagement features.
• To communicate with you, including sending service-related messages (contribution/donation confirmations, account updates, security alerts), and where permitted, promotional communications about the Services.
• To analyze, improve, and develop the Services, including understanding usage patterns, measuring feature effectiveness, and conducting research and development.
• To ensure the security and integrity of the Services, including detecting, preventing, and addressing fraud, abuse, security incidents, and technical issues.
• To comply with legal obligations, including tax reporting, regulatory requirements, and responding to lawful requests.
• To protect rights, safety, and the public, including enforcing our Terms of Service and protecting the rights, property, and safety of Ritmo, its users, partners, and others.

We process your personal data only where we have a valid legal basis to do so:

• Contract. Processing necessary to provide the Services - e.g., setting up your account, processing contributions, and transmitting advisory grant recommendations to Givinga Foundation.
• Legitimate interests. Processing necessary for operating, securing, improving, and promoting the Services, provided these interests do not override your fundamental rights. This includes analytics, fraud prevention, and direct marketing (where permitted without consent). Where we rely on legitimate interests, we have conducted a balancing assessment and concluded that the processing is proportionate and does not unduly affect your rights.
• Consent. Processing for which we have received your specific consent - e.g., certain non-essential cookies or certain marketing communications where consent is required by law. You may withdraw consent at any time without affecting prior lawful processing.
• Legal obligation. Processing necessary to comply with legal requirements - e.g., tax record-keeping or responding to lawful requests from authorities.

Profiling for Personalized Recommendations

You have the right to object to this profiling at any time by contacting us at corporate@joinritmo.com, and we will cease personalized recommendations for your account. This will however have a considerable impact on your experience as donation recommendations will be random.

We may share personal data with the following categories of recipients:

Donation and Payment Partners

Givinga Foundation receives contribution data (amounts, frequency, nonprofit selections) to administer the donor-advised fund, process grants, and issue donation receipts. Payment providers such as Stripe, Apple Pay, Google Pay, and PayPal receive payment data necessary to process your transactions.

Service Providers

We share personal data with service providers who perform functions on our behalf, including analytics and attribution (Adjust, RudderStack, Posthog); communications and email (Customer.io); cloud hosting and infrastructure (Railway); customer support tools; and fraud prevention services. These providers process personal data only on our instructions and subject to appropriate contractual safeguards.

Brand Sponsors

If you participate in donation credit programs funded by brand sponsors, we may share limited information with the sponsoring brand, such as aggregated participation data. We will not share your personally identifiable data with brand sponsors without your consent, unless required to administer the program.

Professional Advisers and Corporate Transactions

We may share personal data with our legal, financial, and other professional advisers, and in connection with a merger, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality protections.

Authorities and Legal Obligations

We may share personal data where required by law, regulation, legal process, or governmental request, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Ritmo, its users, or the public.

9.1 What We Use

We and our service providers use cookies on our website (www.joinritmo.com) and mobile SDKs, pixels, tags, and similar technologies in the Ritmo app to operate the Services, understand usage, attribute installs or activity, communicate with users, and improve performance.

These technologies may be provided by third parties, including the ones listed in the service provider table.

9.2 Types of Technologies

• Strictly necessary cookies and technologies: Required for the Services to function and cannot be disabled. These include authentication, security, and load-balancing technologies.
• Analytics and performance technologies: Help us understand how the Services are used, measure feature effectiveness, and identify errors. These include Mixpanel and RudderStack SDKs.
• Attribution technologies: Help us understand how users discover and install the app. These include the Adjust SDK.
• Communication technologies: Enable us to send personalized messages, emails and push notifications. These include Customer.io.

9.3 Your Choices

On our website, where required by applicable law, we will request your consent before using non-essential cookies or similar technologies. You can manage your cookie preferences through the cookie banner displayed on the website or through your browser settings.

In the Ritmo app, you can manage certain tracking preferences through your device settings (such as limiting ad tracking on iOS or Android). Some analytics technologies are necessary for the Services to function and cannot be disabled.

Ritmo is based in Switzerland. However, the Services are offered primarily to users in the United States, and we use service providers located in the United States and other countries. Your personal data may therefore be transferred to and processed in countries outside your country of residence.

Where we transfer personal data to countries that do not provide an adequate level of data protection under applicable law, we implement appropriate safeguards. These may include Standard Contractual Clauses approved by the relevant authorities, the recipient's participation in a recognized certification framework, or other legally recognized transfer mechanisms.

Your personal data may be processed in the following jurisdictions: the United States (Givinga Foundation, Stripe, Mixpanel, Adjust, Customer.io, and other service providers); and such other jurisdictions as our service providers operate in.

You may request information about the specific safeguards we apply to international transfers by contacting corporate@joinritmo.com.

We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain records required for tax and regulatory compliance, resolve disputes, enforce agreements, and comply with legal obligations.

As a general guide:

• Account and profile data: For the duration of your account and for 3 years after account closure, unless a longer retention period is required by law
• Contribution and transaction records: At least 7 years to comply with tax and financial record-keeping obligations
• Analytics and usage data: Retained in identifiable form for 2 years, after which it may be aggregated or anonymized
• Communications and support records: 3 years after the last interaction

If you request deletion of your account or personal data, we will honor your request subject to any legal obligations to retain certain records (for example, tax records related to donations processed by Givinga Foundation).

Depending on where you are located and applicable law, you may have some or all of the following rights with respect to your personal data:

• Access. You may request confirmation of whether we process your personal data and, if so, access to that data along with information about how it is used.
• Correction. You may request correction of inaccurate or incomplete personal data.
• Deletion. You may request deletion of your personal data, subject to legal retention requirements. Certain records (such as tax-related transaction records held by Givinga Foundation) may need to be retained even after deletion of your Ritmo account.
• Data portability. You may request to receive your personal data in a commonly used, machine-readable format, or to have it transmitted to another controller where technically feasible.
• Objection. You may object to processing of your personal data based on our legitimate interests, including profiling for personalized cause recommendations. If you object to profiling, we will cease personalizing recommendations for your account.
• Restriction. You may request that we restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have challenged.
• Withdrawal of consent. Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Complaint. You have the right to lodge a complaint with a competent supervisory authority. Depending on your location, this may be the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch; a supervisory authority in your EU/EEA member state; or the California Attorney General's office at oag.ca.gov.

This section provides supplementary disclosures required by certain regional laws. If you are not located in one of these jurisdictions, this section may not apply to you.

13.1 For California Residents (CCPA/CPRA)

In the preceding 12 months, we have collected the following categories of personal information as defined under the CCPA:

• Identifiers (name, email address, IP address, device identifiers)
• Financial information (contribution amounts, payment metadata - we do not store full payment card numbers)
• Commercial information (contribution history, nonprofit selections, cause preferences)
• Internet or electronic network activity (app usage, browsing history within the Services, device and session data)
• Geolocation data
• Inferences drawn from the above (cause recommendations, giving patterns, engagement scores)

We collect personal information from you directly, automatically through the Services, and from third parties as described in Sections 4 and 5. We use personal information for the business purposes described in Section 6 and share it with the categories of third parties described in Section 8.

We do not collect sensitive personal information as defined under the CCPA/CPRA, except to the extent that account login credentials (email/password) or financial information (payment metadata) are categorized as such. We use this information only as necessary to provide the Services.

We retain personal information as described in Section 11.

We honor Global Privacy Control (GPC) signals as a valid opt-out request under the CCPA/CPRA. If we detect a GPC signal from your browser or device, we will treat it as a request to opt out of any sale or sharing of personal information, to the extent applicable.

13.2 For Residents of Other US States

Several US states have enacted privacy laws that provide rights similar to those described in Section 12. If you reside in a state with an applicable privacy law, we will honor your rights in accordance with that law. To exercise your rights, contact us at corporate@joinritmo.com.

13.3 For EU/EEA Residents

If GDPR applies to our processing of your personal data, the legal bases for our processing are described in Section 7 (which references the relevant GDPR provisions). In addition to the rights described in Section 12, you have the right to lodge a complaint with the supervisory authority in your member state of habitual residence or place of work.

13.4 For Swiss Residents

Our processing of your personal data complies with the revised Swiss Federal Act on Data Protection (FADP), which entered into force on September 1, 2023. The legal bases described in Section 7 correspond to the applicable provisions of the FADP. You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch.

We may send you service-related communications necessary to operate the Services, such as contribution confirmations, account security alerts, and important updates. These are not marketing communications and cannot be opted out of while you maintain an account.

We may also send you marketing or promotional communications where permitted by law. You can opt out of marketing communications at any time by:

• Using the unsubscribe mechanism in the message
• Adjusting your notification preferences in the app
• Contacting us at corporate@joinritmo.com

The Services are intended for adults aged 18 and over only. Ritmo does not intend the Services for children and does not knowingly collect personal data from persons under 18.

If you believe that a person under 18 has provided personal data to us, please contact corporate@joinritmo.com so we can take appropriate steps, including deletion of such data.

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures include encryption of data in transit and at rest, access controls, and regular security assessments.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.

The Services may contain links to third-party websites, services, nonprofits, donation partners, payment providers, or policies. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy notices.

This includes, without limitation, the privacy notices of Givinga Foundation, Stripe, Apple, Google, PayPal, and any other third-party service accessible through or integrated with the Services.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Services, by email, or by other appropriate means. The updated version will be indicated by the "Last updated" date above.

We encourage you to review this Privacy Policy periodically.

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we process your personal data, please contact us at the address above.