PrivacyPolicy
Your privacy matters to us. Learn how we collect, use, and protect your information.
Last updated: October 2, 2026
This Privacy Policy describes how we collect, use, and protect your information when you interact with our website and services. As a nonprofit organization, we are committed to respecting your privacy and safeguarding your personal information.
Information We Collect
We collect the following types of information to better serve you and fulfill our ministry mission:
- First and last name
- Email address
- Phone number
- Mailing address
- Donation amount
- Donation purpose or designation
- Event RSVP details (party size, special requests)
- Newsletter sign-up details and a record of when and how you agreed to receive our emails
- For staff and volunteers who submit expense reports: name, email, and expense details
Note: This information is collected when you make donations, RSVP to events, subscribe to our newsletter, submit an expense report, or contact us through our website. We do not share your phone number, address, or giving history outside the ministry's own team. We do not collect credit card or bank account numbers.
How We Use Your Information
Your information helps us serve you better and advance our mission. We use your data to:
- Process and acknowledge your donations
- Send donation receipts and updates
- Communicate with you about our mission and activities
- Contact you by phone when necessary for donation or ministry purposes
- Comply with legal and tax requirements
Email Communications:
When you provide your email address, you may receive:
- • Donation receipts and confirmations (required for tax purposes)
- • Ministry updates and newsletters, only after you confirm your subscription by clicking a link we email to you (you can unsubscribe anytime)
- • Important account or service notifications
You can opt out of non-essential communications at any time by clicking unsubscribe in any email or contacting us directly. Donation receipts are still sent because they are needed for your tax records. When a newsletter is opened or a link in it is clicked, our email provider tells us, and we keep a record of that against your email address to understand what is helpful to readers. The provider also reports the IP address and device used; we keep those for 30 days in case misuse needs looking into, then remove them. The whole record is deleted when you unsubscribe.
How We Protect Your Information
We implement reasonable security measures to protect your personal information from unauthorized access, disclosure, or misuse. Your data is only accessible to authorized personnel and is stored securely using industry-standard encryption and security practices.
Administrator Security Monitoring:
To protect our systems and donor information, we maintain security audit logs for administrative access:
- Login Monitoring: We log all administrator login attempts including timestamps, hashed IP addresses, and device information for security purposes
- Geographic Data: We collect country and region information from IP addresses to detect unusual access patterns
- Device Information: Browser type, operating system, and device information are logged to identify suspicious activity
- Risk Assessment: We automatically calculate risk scores based on login patterns, location, and timing
- Data Protection: IP addresses in login logs are hashed with a secret key so they cannot be read back, while still letting us spot repeated attempts. The location we record is only the approximate country and region. We do not use GPS or ask your device for its location.
- Passkeys: Administrators may sign in with a passkey. We store only the public part of the passkey, never a fingerprint, face scan, or private key. Sign-in may also ask for a one-time code sent to the administrator's email; only a scrambled copy of the code is kept, for ten minutes.
Legal Basis: This monitoring is conducted under our legitimate interest in protecting donor data and ministry operations. Security logs are deleted automatically after 90 days and are only accessed by authorized security personnel. When an expense report is submitted, we keep a shortened network address (the last part removed) to help detect misuse.
Sharing Your Information
We respect your privacy and do not sell or rent your personal information. We may share your data with trusted third parties only as necessary to process your donation or comply with legal requirements.
Payment Processing:
When you give online, you choose one of these ways to pay:
- • Square: credit or debit card, Apple Pay, Google Pay, and recurring gifts
- • Venmo and Zelle: payments you send from your own app or bank to our account
- • Check: mailed to our PO Box
- • These services store and process your payment information under their own privacy policies
- • We do not store your credit card or banking details on our servers
- • You can manage recurring donations directly through Square
Service Providers That Help Us Run This Website:
These companies handle information on our behalf to provide their service:
- • Vercel: website hosting
- • Supabase: secure database and file storage for donation, RSVP, newsletter, and expense records
- • Resend: delivery of receipts, confirmations, and newsletters
- • Cloudflare Turnstile: a check that keeps automated bots from using our forms
- • Upstash: short-term rate limiting that briefly stores an IP address or email address (about an hour) to stop form abuse
All third-party partners are bound by their own privacy policies and security measures. We encourage you to review their privacy policies for details on how they protect your information.
Analytics, Cookies and Embedded Content
- No advertising or tracking cookies. We do not use advertising, retargeting, or cross-site tracking, and we do not record what you type into our forms.
- Privacy-friendly analytics. We use Vercel Web Analytics and Speed Insights to count page views and measure how fast pages load. They use no cookies and do not follow you across websites. They see general information such as the page visited, referring site, browser and device type, and country.
- Fonts are served from our own website, so your browser does not contact Google or any font provider.
- Videos. Some pages embed YouTube videos in its privacy-enhanced mode, and show video thumbnails. YouTube (Google) may receive your IP address when these load and may set cookies if you play a video. Links to Facebook and other sites only share data if you click them.
- Essential cookies only. The administrator sign-in uses cookies required for security. Visitors who do not open the sign-in page receive no cookies from us. Pages with a form run a bot check from Cloudflare, which may set its own cookie for that check. While you complete a gift, the details you typed are held in your own browser until the next page loads, so you do not have to retype them.
- Do Not Track. We do not track visitors across websites, so the site behaves the same whether or not your browser sends a Do Not Track signal.
Children's Privacy
Our website is intended for adults. We do not knowingly collect personal information from anyone under 18, and we do not direct our services to children under 13. Stories and photos on our ministry pages describe children we serve overseas; they are not a way for children to use this site. If you believe a child has given us personal information, contact us and we will delete it.
Your Rights
You have the right to control your personal information. You may contact us to:
- Access your personal information
- Correct inaccurate information
- Request deletion of your data
- Opt out of communications
To make a request, email info@pemusa.org or write to us at the address below. We will verify your identity and respond within 30 days. Donation records the law requires us to keep for tax purposes cannot be deleted before the retention period ends.
Data Retention
We retain your personal information only as long as necessary to fulfill our ministry purposes and comply with legal requirements:
- Donor information: Kept for at least 7 years for tax and legal compliance. It is not deleted automatically after that; you may ask us to delete it
- Contact inquiries: Kept in our email for up to 3 years unless deletion is requested
- Newsletter subscriptions: Kept until you unsubscribe, when your address and your record of opens and clicks are removed
- Event sign-ups: Kept with our event records until you ask us to delete them
- Expense reports and receipts: Kept for at least 7 years as financial records
- Record of staff actions: We keep a log of what administrators do, such as confirming or correcting a gift. It can include the donor's name and email, and is kept as an audit trail
- Security audit logs: Administrator login and security data retained for 90 days maximum
Note: Some information may be retained longer if required by law or for legitimate business interests (such as preventing fraud). You may request early deletion of your data by contacting us. Security logs are automatically deleted after 90 days unless required for an ongoing security investigation.
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. Any updates will be posted on this page with an updated effective date. We encourage you to review this policy periodically.
Contact Us
If you have any questions about this Privacy Policy or how we handle your information, please don't hesitate to contact us: