Privacy policy

Version 1.19, updated on 14 October 2026 · What changed

We built CauseHub to collect as little about you as possible. No ads, no tracking cookies, no data sales, and no profiling of your giving. This page lists everything we collect, why, who else sees it and for how long.

Who is responsible

The controller is SevinHub, Sergiu Vincze, Belgian sole proprietorship (eenmanszaak), Blivensstraat 43 bus 101, 2100 Antwerpen, Belgium, KBO/BCE 1042.245.006. Contact for anything about your data: admin@sevinhub.com.

When you donate

You do not need an account. We collect:

Your email address, to send your receipt, to remind you once, about a day later, of a bank transfer or PayPal gift you have not yet marked as sent, to tell you once when the organiser posts a receipt or delivery for the cause you gave to (every such email has a link to stop them), to handle refunds, and to prevent fraud. CauseHub never shows it publicly, never shows it to the organiser on CauseHub and never uses it for marketing.
If you stop proof emails, we keep only a keyed fingerprint (hash) of your address, so we remember not to write to it; never the address itself.
Your name, only if you give it. It is shown on the supporters list only if you tick that option, and shown to the organiser unless you choose to hide it.
A public message, only if you write one and choose to show your name. A visitor reading the page in another language can tap Translate under it: see "AI translation providers" below.
The donation itself: cause, amount, processing cost you covered, optional tip, payment method type, date and status, and the reference numbers the payment provider gives us.
A shortened IP address (the last part removed, for example 203.0.113.0/24) stored with the donation to detect fraud and repeated attacks.
The language you used on the site (for example Dutch), stored with the donation, so your receipt and any later message about it are written in that language.

Your card or bank details go only to Stripe, on Stripe's own page. We never see or store them.

If you choose a bank transfer, you pay from your own banking app straight into the organiser's own bank account. We never see your bank account or the payment itself. We keep the amount you planned to give, the reference of your transfer, when you told us you sent it, and whether and when the organiser confirmed that it arrived, with the amount that arrived. As with any bank transfer, the organiser sees in their own bank account the name of the account you send from; CauseHub's "hide my name" option controls only what CauseHub shows.

If you choose PayPal, you pay on paypal.com straight into the organiser's own PayPal account, by card or with a PayPal account. We send you there with only the organiser's account, the amount, the currency and the reference of your gift, nothing about you. What you enter on paypal.com goes to PayPal, under PayPal's own terms and privacy notice, and PayPal shows the organiser the name and email you pay with; CauseHub's "hide my name" option controls only what CauseHub shows. We keep the same details as for a bank transfer: the amount you planned, the reference, when you told us you paid, and whether and when the organiser confirmed it arrived.

Good to know: your payment goes directly into the organiser's own Stripe account, so, as with any online payment to a seller, the organiser can see in their Stripe account the details you enter on Stripe's payment page, such as your email address and the name on your card. CauseHub's "hide my name" options control what CauseHub shows, not what Stripe shows the organiser. Organisers may use these details only to handle your donation.

When you create an account

Name and email address. Your name is shown on causes you organise.
The language you used when you registered, so security notices and decisions about your causes are written in that language.
Password, stored only as an Argon2id hash. When you choose it, we check it against known data breaches using the Have I Been Pwned service: only the first 5 characters of a SHA-1 hash of the password leave our server, never the password.
Two-step verification: the secret key for your authenticator app, encrypted, and your recovery codes, stored only as hashes.
Confirmation that you are 18 or older, when you accepted the terms, when you last signed in, and a count of failed sign-in attempts (to lock out password guessing).
A sign-in log: each time someone signs in to your account, or tries with a wrong password or code, we record the date and time, the full IP address, the country and city estimated from it, a short browser description (for example "Chrome on Android") and the result. The place is looked up in a database on our own server (IP Geolocation by DB-IP), so your address is not sent to anyone. You see your last 10 sign-ins under Account security. It helps you and us notice when someone else uses your account.

When you organise a cause

The cause: title, summary, story, how the money will be used, category, country, town if you give one, goal, photos and an optional YouTube link. This is public once the cause is approved.
Links to your own Facebook page or Instagram, if you add them to a cause (or ask us to add them for you). We store only the link, cleaned of tracking parts such as fbclid or utm_ tags, and show it on the cause page as a plain link. You can change the links in your dashboard until the cause is closed or suspended, and remove them there, or ask us to, at any time; a removed link is deleted at once. Our security log notes only that a link was added, changed or removed, and by whom, never the link itself; when we add or remove the links for you, it also keeps a short note of how and when you agreed or asked. When you add or change a link on a public page, the owner of CauseHub gets a short internal email saying which link changed, without the link itself, so a link that does not lead to your own page can be removed quickly.
An optional faith connection of the cause, for example a church roof. Because it can reveal religious belief, it is special category data under Article 9 GDPR: you choose to publish it with your cause, and you can remove it while the cause is a draft or by writing to us. We never use it for anything else.
The name of the person, organisation or group you raise for, and your relationship to them. These are not shown publicly. We use them for review and to screen against official sanctions lists.
Your confirmations that the story is true, that people shown agreed, and that you follow the dignity guidelines, with the time you gave them.
Updates and proof you post: text, receipts and photos. Photos are re-encoded and all hidden data is removed, including GPS location.
Your payout account status: the Stripe account number and the status flags Stripe reports (for example "can receive donations"). Stripe collects your identity documents and bank details directly. We do not receive or store them.
If you switch on bank transfers: the account holder name, the IBAN and, if you give it, the BIC of your euro bank account, your consent and its date. The IBAN is stored encrypted, together with its last four digits and a keyed fingerprint (hash) so we notice the same account entered by two people. We show the name and account only to donors who choose a bank transfer to one of your pages, on their private page and in their email, never publicly on the page itself, and we screen the holder name against the sanctions lists. You can switch bank transfers off at any time; the record stays with the gifts it received, for the period accounting law requires.
If you switch on PayPal: the name on your PayPal account, your PayPal merchant ID or the email address of the account, your consent and its date. It is stored encrypted, with a masked form for lists. We use it only to send donors who choose PayPal to paypal.com, where PayPal shows them your account name, and we screen the holder name against the sanctions lists. You can switch PayPal off at any time; the record stays with the gifts it received, for the period accounting law requires.
Sanctions screening results: whether your name or the beneficiary's name resembles an entry on the EU, UN, UK or US sanctions lists. A possible match is always checked by a person; nobody is blocked automatically.
Status emails to the owner of CauseHub: when the status of your Stripe payout account, your bank account or one of your causes changes, the owner of CauseHub gets an internal email with your name and email address, your organisation, your causes and the new status, including the reasons Stripe gives (for a bank account: the holder name, the last four digits and the sanctions screening result). It never contains documents or a full IBAN, goes only to the owner through our email server, and is kept for 12 months like our other emails.

Organisers outside the EU and EEA

Organisers can be based in the European Union and the European Economic Area. We open other countries one by one, and this paragraph always names the ones open today.

When you give by card to a cause whose organiser is outside the EU and EEA, your payment goes to the organiser's own Stripe account in their country. The details Stripe shows the organiser, as described above (such as your email address and the name on your card), then reach that country, and the organiser is responsible for them under the law of their country. For the United Kingdom, Switzerland, Canada (for commercial organisations), Japan and New Zealand, the European Commission has decided that they protect personal data adequately. For other countries, the transfer is necessary to make the gift you ask for (Article 49(1)(b) GDPR), and Stripe applies its own safeguards, described in its privacy policy. CauseHub sends nothing else to the organiser; what we keep is handled as the rest of this policy describes.

If you organise from outside the EU and EEA, we keep the same data about you as about any organiser (listed above), plus the currency of your page. Stripe checks your identity under the rules of your country. If you give an official register and number for your organisation, its public page links to that register so readers can check it themselves; the link sends nothing about you.

Organisers in the United Kingdom

If your page is run from the United Kingdom: the date and time you agreed to keep to the Fundraising Regulator's Code of Fundraising Practice, as UK fundraising rules ask of platforms.
If you sign the fundraising agreement for a UK registered charity: your name and role as you type them, the charity's name, number and postal address, the full text you signed with its fingerprint (SHA-256), whether it names a tip, the date and time, and a shortened IP address (the last part removed). We keep it as proof of who signed for the charity and when (Charities Act 1992 section 59), for as long as the agreement runs and 6 years after it ends, then delete it. Legal basis: our legal obligation and our legitimate interest in proving the agreement (Article 6(1)(c) and (f)). The record cannot be changed afterwards.

When you set up a creator profile

Handle, display name and short description. If you verify your channel, we receive your YouTube channel id and channel name from Google, then revoke our access immediately. We do not keep any Google token.

When you report something

Your name, email, the reason and your explanation, as the Digital Services Act requires, so we can tell you our decision, plus the language you used, so we answer in it. The organiser is not told who reported them. Reports about child sexual abuse material can be made without name or email. A report about a supporter's public message is linked to that gift, so we can take the message down. If we do, our security log keeps only a fingerprint (hash) of the removed text, not the text.

When we contact you about working together

We look for organisations, companies, journalists and creators who could run or help a cause, and write to them ourselves. For each one we keep: the name, the organisation, the country and town, the email address, phone number and website they publish or gave us, why we think they could help, where we found them (for example their own website), our notes, the messages we prepared and sent, and when. This is never public and never in a feed; at CauseHub only the owner sees it. We prepare these messages with the help of an AI assistant (Claude, by Anthropic, in the United States), which sees these details while helping us.

Some messages are sent by WhatsApp from the owner's own phone: our server builds a WhatsApp link with the number and the text and sends nothing to WhatsApp itself; WhatsApp (Meta) handles the message like any other you receive. We keep a contact while working together is still possible and delete it when you ask. A prepared WhatsApp message is deleted 90 days after it was sent or skipped; what was sent stays in our notes on the contact. Legal basis: our legitimate interest in finding partners and support for causes (Article 6(1)(f)). You can object at any time: write to us and we stop and delete your details.

When you just visit

No tracking cookies. A session cookie is set only when you use a form or sign in. It is strictly necessary for security and is deleted when you close the browser or after 12 hours.
Your colour theme (light or dark) is remembered in your own browser only if you choose one. It never reaches us. The Auto setting works out day or night on your device from its clock and stores nothing.
Your language is in the web address (for example /nl/). On a first visit without a language in the address we follow your browser's language setting. If you pick a language from the flag menu, a cookie named ch_lang keeps that choice for one year so the site opens in it next time. It holds only the two-letter language code, is needed to honour the choice you made, and is not used for anything else. Delete it in your browser to go back to following your device.
Page statistics on public pages. The home page, explore, cause pages, creator pages, fees, trust, transparency and the legal pages load Rybbit, a cookieless analytics script, so we can see which pages are read and where visitors come from. It records the page viewed, the referring site, your browser, device type, screen size and language, page load timings, and a country derived from your IP address; Rybbit states that the IP address itself is never stored. It sets no cookies and writes nothing to your browser's storage. It does not run on donation, thank-you, receipt, report, account, dashboard or owner pages, and it never receives your email, name, amount or any donation data. Any content blocker stops it, and nothing on the site depends on it. QR codes and some shared links carry a short tag in the page address that names where they were shown, for example utm_source=stiri-brasov for a newspaper or a poster, and Rybbit sees it with the page viewed, so we can tell which place brought visitors. The tag names a place, never a person: the site accepts only lowercase letters, digits and dashes there, drops anything else before the statistics script loads, and stores no tag itself. Donation forms never load the statistics script. When someone opens one through a QR code or a link with a place tag, our own server adds one to a counter for that page, that tag, its medium (for example qr) and that day. The counter holds only those and the number: no IP address, no cookie, nothing about the device, and it is never linked to a gift. It is kept as long as the page exists.
Links to Facebook or Instagram on a cause page are plain links the organiser added. Opening the page loads nothing from Facebook, Instagram or Meta: no button, script, picture or tracking pixel, so Meta learns nothing about your visit from us. Only if you click one do you leave CauseHub for Facebook or Instagram; the link does not tell them which cause page you came from, and from then on Meta's own privacy policy applies.
A daily visitor count. To publish user numbers as the Digital Services Act requires, we count unique visitors per day with a keyed hash of the IP address and browser. The key is random, changes every day and is destroyed the next day, so we cannot recognise you across days and no identifier is ever stored.
Server logs (IP address, page, time, browser) kept for 14 days for security, then deleted.

Why we may do this (legal bases)

To carry out our agreement with you (Article 6(1)(b)): processing donations, accounts, causes, refunds and receipts.
Legal obligations (Article 6(1)(c)): accounting records, sanctions law, the Digital Services Act and answering lawful requests from authorities.
Legitimate interests (Article 6(1)(f)): preventing fraud, card testing and abuse, keeping the platform secure, the audit log of security events, the sign-in log, the cookieless page statistics described above, telling donors once when proof is posted for a cause they gave to, and contacting organisations, companies, journalists and creators who could run or help a cause. Our interest is keeping donors and causes safe, knowing which pages are read and finding partners and support for causes; you can object, and we will weigh your situation.
Consent (Article 6(1)(a)): showing your name publicly. You can withdraw it at any time from your receipt page.
Special category data (Article 9): a faith connection you choose to publish with your cause (Article 9(2)(a) and (e)).

Who else processes your data

Stripe (Stripe Payments Europe Ltd, Ireland) processes payments, verifies organisers' identity, pays out and fights fraud. For identity checks and fraud prevention Stripe acts as a separate controller under its own privacy policy.
PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), only if you give or receive through PayPal. You pay on paypal.com; we never send PayPal anything about you, and PayPal is a separate controller under its own privacy notice.
Cloudflare runs the Turnstile human check on donation and report forms. It reads technical signals from your browser to tell people from bots and does not use them for advertising.
Google, only if you verify a YouTube channel, and YouTube, only if you press play on a video (loaded from youtube-nocookie.com).
Have I Been Pwned, only the 5-character hash prefix described above.
AI translation providers: Groq (United States), OpenRouter (United States) and Google Gemini. The public text of a cause and of its proof entries (title, summary, story, what the money pays for, updates) is sent once to be translated into the languages of the site; the first provider that answers is used and nothing else is sent, never beneficiary names kept private, emails, names of donors or donation data. One exception: when a visitor taps Translate under a supporter's public message, that message alone is sent, never the supporter's name, the amount, the date or the cause. The translation is stored next to the message, so it is made only once per language, and it is deleted with the message: when the supporter or we remove the message, when it is reported, or when the supporter asks us to erase their data. Machine translations are marked as such on the page and we can correct them. An organiser who does not want this can write to us and we translate by hand.
AI assistant: Claude, by Anthropic (United States), helps us find the organisations and people we contact about working together and prepare our messages to them, described under "When we contact you about working together". It sees their contact details, our notes and the drafts while it helps us. We use Claude under Anthropic's own terms and privacy policy: we have no separate contract with Anthropic, and the safeguards for transfers in the next paragraph do not cover it.
Rybbit (app.rybbit.io) hosts the page statistics described above under its own privacy policy. It receives only the technical facts listed there, from public pages, and nothing about donations or accounts.
Our hosting provider Contabo, in the European Union (France), where the site and database run.
Our email server at our web host Interserver, in the United States, which sends the emails we send you (confirmations, receipts, proof notices, decisions). It receives only your email address and the text of the email.

Some of these companies, including our email server, process data in the United States. Transfers rely on the EU-US Data Privacy Framework where the company is certified, and otherwise on the European Commission's standard contractual clauses. The AI assistant is the exception, as described above.

How long we keep it

Fundraising agreements with UK charities: while the agreement runs and 6 years after it ends.
Donation and payout records: for the period Belgian accounting law requires (currently 7 years after the end of the financial year). If you erase your details, the record stays without your email and name.
Your account and causes: while your account exists. Ended causes stay public for 24 months, then are unlisted; the financial records stay as above.
Reports and their decisions: 12 months after the decision, or longer if a case is still open.
Security and audit log: 7 years, because it proves who changed money-related settings. It holds account numbers and shortened IP addresses, not names or emails.
Sign-in log: the full IP address and the city for 90 days; after that only the shortened IP address and the country, deleted after one year.
Emails we sent you: 12 months.
Rate-limit counters: at most one day. Visitor-count hashes: one day. Server logs: 14 days.
Page statistics at Rybbit: aggregate, without IP addresses, for up to 3 years.
Partnership and press contacts: while working together is still possible, or until you ask us to delete them. Prepared WhatsApp messages: 90 days after they were sent or skipped.

Your rights

You can ask to see your data, correct it, erase it, restrict or object to its use, and receive it in a portable format. Donors can erase their contact details themselves from their private receipt page. For everything else write to admin@sevinhub.com from the email address you use with us; we answer within one month. You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be).

Automated decisions

We make no decisions about you by automated means alone. Sanctions screening and fraud signals only flag things for a person to review.

Children

You must be 18 to organise a cause and 16 to donate. Causes about children follow extra rules: first names only, never a school or address, and consent from a parent or guardian.

Security

Encrypted connections, hashed passwords, encrypted two-step secrets, an append-only audit log, strict separation of who can change money records, and regular encrypted backups. If a breach puts your data at risk, we tell the Data Protection Authority within 72 hours and tell you without delay when the risk to you is high. Found a security problem? See our security contact.

Version history

We will tell you here, and by email if you have an account, before any important change.

1.19, 14 October 2026 current version We added the links an organiser can add to their own Facebook page or Instagram, shown on the cause page as plain links that load nothing from Meta (see "When you organise a cause" and "When you just visit").
1.18, 8 October 2026 We added what we keep about the people and organisations we contact about working together, and that an AI assistant (Claude) helps us prepare those messages (see "When we contact you about working together" and "AI assistant").
1.17, 8 October 2026 We added that a supporter's public message can be translated when a visitor taps Translate under it (see "When you donate" and "AI translation providers").
1.16, 7 October 2026 We added one reminder email about a bank transfer or PayPal gift you have not yet marked as sent (see "When you donate").
1.15, 6 October 2026 We added gifts through the organiser's own PayPal account (see "When you donate" and "When you organise a cause") and PayPal to the list of other companies.
1.14, 6 October 2026 We added the status emails the owner of CauseHub gets when an organiser's payout account, bank account or cause changes (see "When you organise a cause").
1.13, 5 October 2026 For organisers in the United Kingdom, we added the time an organiser agrees to the Fundraising Regulator's Code, the fundraising agreement a UK charity signs, and reports about a supporter's message (see "Organisers in the United Kingdom" and "When you report something").
1.12, 5 October 2026 We added that donation forms opened through a QR code or link with a place tag are counted per page, tag and day (see page statistics under "When you just visit").
1.11, 5 October 2026 We added that organisers can also be based in countries outside the EU and EEA that we open one by one (see "Organisers outside the EU and EEA").
1.10, 5 October 2026 We added that QR codes and shared links can carry a short tag that names where they were shown (see page statistics under "When you just visit").
1.9, 3 October 2026 We added that organisers can receive bank transfers straight into their own bank account (see "When you donate" and "When you organise a cause").
1.8, 29 September 2026 We added that when an organiser posts a receipt or delivery, we email the donors of that cause once, with a link to stop these emails.
1.7, 28 September 2026 We added a sign-in log with IP address and place for the safety of your account, kept in full for 90 days.
1.6, 27 September 2026 We added that public cause text is machine-translated by the AI providers listed under "AI translation providers".
1.5, 27 September 2026 We added a small cookie that keeps a language you pick yourself.
1.4, 27 September 2026 With the site in five languages, we added that we remember the language you used so we can write to you in it.
1.3, 26 September 2026 We added page statistics on public pages, without cookies.
1.2, 26 September 2026 We added what organisers see in their Stripe account about your payment.
1.1, 26 September 2026 We added our email server, which sends the emails we send you.
1.0, 26 September 2026 The first version of this policy.