Privacy Policy

Effective Date: July 1, 2026  ·  Impact Outbox, operated by Custom Fundraising Solutions (CFS)

1. Information We Collect

We collect the following categories of information when you create an account and use Impact Outbox:

• Account information: Your name, email address, phone number, and company/territory details.
• Campaign data: School name, program name, sponsor name and contact information, sale dates, event locations, fundraising goals, and meeting dates.
• Email content: Subject lines and body text for campaign emails generated or edited within the platform.
• Uploaded files: Meeting notes, audio recordings, and PDF/Word documents you upload for AI-assisted campaign setup.
• Social media tokens: Facebook Page access tokens if you connect a Facebook Page.
• Microsoft OAuth credentials: If you connect your @cfsbeds.com email, we store the OAuth access and refresh tokens issued by Microsoft.
• Usage data: Log data including IP address, browser type, pages visited, and actions taken within the app.

2. How We Use Your Information

We use collected information solely to operate and improve Impact Outbox:

• Sending fundraiser campaign emails on your behalf to school directors, faculty, and parents via the sponsor's contact email.
• Generating email sequences, checklists, and social media posts using campaign data you provide.
• Processing uploaded documents and audio through AI services to extract campaign details.
• Displaying your campaign schedule, analytics, and upcoming sends on your dashboard.
• Authenticating your account and maintaining session security.
• Improving platform features and fixing bugs.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. Third-Party Services

Impact Outbox integrates with the following third-party services to deliver its features:

• SendGrid (Twilio): Used to deliver campaign emails. Email content, recipient addresses, and sender details are transmitted to SendGrid for delivery. See SendGrid's Privacy Policy.
• Anthropic (Claude AI): Used to generate email content, social posts, and extract campaign data from uploaded documents. Document contents and campaign details may be sent to Anthropic's API. See Anthropic's Privacy Policy.
• OpenAI (Whisper): Used to transcribe audio recordings you upload for campaign setup. Audio files are sent to OpenAI's API for transcription. See OpenAI's Privacy Policy.
• Meta (Facebook): If you connect a Facebook Page, your page access token is stored and used to post campaign content on your behalf. See Meta's Privacy Policy.
• Microsoft (Azure AD / Entra ID): If CFS Corporate IT authorizes Microsoft OAuth integration, your @cfsbeds.com email OAuth tokens will be stored to send emails from your address. See Microsoft's Privacy Statement.
• Hostinger: Our VPS hosting provider. All data is stored on servers operated by Hostinger. See Hostinger's Privacy Policy.

4. Microsoft OAuth Data Handling

When you connect your CFS email account via Microsoft OAuth:

• We store your Microsoft OAuth access token and refresh token in our database to send emails on your behalf.
• We use the minimum required permission scopes (mail send only).
• Tokens are encrypted at rest and never exposed to other users.
• You can disconnect your Microsoft account at any time from the Settings page, which revokes and deletes stored tokens.
• This feature is subject to approval by CFS Corporate IT.

5. Data Retention

We retain your data for as long as your account is active. Specifically:

• Account data: Retained until you request account deletion.
• Campaign and email data: Retained for the life of your account to support your campaign history.
• Uploaded files: Retained until you delete them or close your account.
• OAuth tokens: Deleted immediately upon disconnection from the Settings page.
• Log data: Retained for up to 90 days for security and debugging purposes.

6. Data Deletion

To request deletion of your account and all associated data, contact us at danny.hinton@cfsbeds.com. We will process deletion requests within 30 days. Note that some data may be retained longer if required by law or for legitimate business purposes (e.g., billing records).

7. Security

We take reasonable technical and organizational measures to protect your data, including encrypted database credentials, JWT-based authentication, and restricted database access. However, no system is completely secure, and we cannot guarantee absolute security.

8. Children's Privacy

Impact Outbox is intended for use by adult CFS operators only. We do not knowingly collect personal information from individuals under 18. Student names and contact information are never collected — campaign emails are sent only to adult school administrators and parents who have opted into school communications.

9. Changes to This Policy

We may update this Privacy Policy periodically. We will notify active users of material changes via email. Continued use of Impact Outbox after changes constitutes acceptance of the updated policy.

10. Contact

For questions, data requests, or concerns about this Privacy Policy, contact:

Danny Hinton
Custom Fundraising Solutions
danny.hinton@cfsbeds.com
(559) 314-4662