Terms of use & privacy policy

1. Eligibility

You must be at least 13 years old to set up an assessment or answer a survey. If you are under 18, use it with the involvement of a parent, guardian, or the organization you are answering on behalf of. There is no account and no password. Setting up an assessment gives you a private link; holding that link is what grants access to it, for anyone it is shared with.

2. Acceptable use

Do not use automated tools to access the service, attempt to identify who submitted a particular response, try to access another organization’s roster or report without its link, or use the free-text fields to transmit unlawful content, malicious code, or content that infringes someone else’s rights. We may suspend access that violates this.

3. Content you provide

Your organization’s profile information, any questions you write yourselves, and everything respondents write in free-text fields belong to your organization. You give us a limited license to store, process, and display that content back to you, solely to run the service and generate your report. We do not use it to train any model, and free-text answers never leave your organization’s own report, never get aggregated with any other organization’s, and are never shown to us in a way that identifies who wrote them.

4. No warranty

The service is provided as is, without warranties of any kind. We do not guarantee it will be uninterrupted, error free, or available at any particular time.

5. Limitation of liability

Nonprofit Assessment is free, so no fee is ever paid for it. To the extent the law allows, our total liability to you for anything arising from your use of the service is limited to one hundred U.S. dollars ($100). We are not liable for indirect, incidental, or consequential damages.

6. Disputes and governing law

These terms are governed by Washington State law. Any dispute will be resolved through binding individual arbitration in Whatcom County, Washington, rather than in court, and neither of us may bring a claim as part of a class action.

7. Changes to these terms

We may update these terms from time to time. The effective date at the top of this page always reflects the current version. Continuing to use the service after a change means you accept the update.

1. What we collect

From whoever sets up an assessment: their name and email, and information about the organization (name, state, and whatever else is entered, such as an EIN or budget band). From an organization’s chief executive, if the board is surveyed: their name and email, used only to deliver their personal link and up to two reminders. From respondents: their answers, which carry no name, no email address, no IP address, and no submission time. Our hosting provider also logs standard request data (like IP address) at the infrastructure level, the way any web server does, separately from anything stored against a response.

2. How we use it

To deliver surveys and generate reports, to send the admin and chief executive their own links and reminders, to aggregate anonymized scores into the cross-organization benchmark, and to tell an admin when their report is ready. Occasionally we may email an admin about something new we’ve built. They can opt out of that at any time without affecting anything else.

3. Who we share it with

Three service providers, each processing data on our behalf under its own agreement with us, never sold to anyone: Vercel (hosting), Supabase (database), and Resend (email delivery). We do not use any payment processor, because nothing here is ever paid for.

4. Why a response can’t be traced back to a person

This is not a policy we are promising to follow. It is how the data is built. A respondent’s invitation and their answers are stored in places that share only which assessment they belong to, nothing else. There is no field anywhere that connects the two. That also means that if someone later asks us which response was theirs, we cannot answer, not because we choose not to, but because the system was built so that answer does not exist. A section of a report is only released once enough people have answered it: board and staff reports need 4 or more responses and at least 60% of the roster, and community reports need 15 or more. Below that, an organization gets no report rather than a thin one.

5. Legal basis

Where GDPR applies, we rely on performing our contract with the organization using the service, our legitimate interest in operating and improving it, and consent where we ask for it directly, such as for occasional product email.

6. Where data is processed

Our infrastructure is located in the United States. Where data originates outside the US, we rely on Standard Contractual Clauses and our processors’ own safeguards for the transfer.

7. How long we keep things

8. Your rights

An admin can request access to, correction of, or deletion of their own contact details at any time by emailing us below. There is a self-serve way to get a fresh admin link if one is lost: the “Find your link” page on this site. We cannot honor a request to access or delete a specific respondent’s answer, because nothing in our system identifies which answer is whose, which is the protection itself rather than a limit on it.

9. Security

Data is encrypted in transit and at rest through our hosting and database providers. The database is reachable only from our own servers, never directly from a browser, and every page that grants access to organization data does so through an unguessable link rather than a password.

10. Cookies

We do not use cookies of any kind, tracking, advertising, or otherwise. There is nothing to consent to.