Privacy Policy
Effective November 9, 2026
Karma (“we”, “us” or “our”) respects your privacy. This policy explains what information Karma Compass (the “Service”), our board management product for nonprofits, collects, how we use it, and the choices you have. It applies to the Service, the emails it sends, and this website.
Your organization decides what it puts into Karma Compass. For board content (the roster, meeting records and documents) we act on the organization’s behalf, and questions about that content are best directed to the organization first.
1. Information we collect
Information you or your organization provide
- Account details, such as your name and email address.
- When you use the public board composition check: the website you enter, the board names and answers you confirm, and your email address if you request a report. We use public website content to suggest names; you can correct or remove them. We email the detailed report using our email provider and request to add the address to our updates list with the notice version and submission time. Our team also receives a copy of the report. Updates include an unsubscribe link. The check does not change an organization’s account roster.
- Your organization’s profile, such as its name, website, mission and programs, including public information our assistant researches when you ask it to.
- The board roster: directors’ and officers’ names, email addresses, roles and terms. People on a roster may receive email from the Service even if they have never created an account.
- Board work: agendas, board packets, minutes, votes, RSVPs, decisions, action items, and documents you upload or import from a connected service such as Google Drive or Microsoft 365.
- Messages you send to Ask Compass, and its replies.
- Billing details for paid plans. Payments are processed by our payment provider; we do not store full card numbers.
Information collected automatically
- Technical and security information, such as IP address, browser, device, sign-in times and error reports.
- When you create an organization: how it found us, meaning the campaign named in the link you followed, the website that sent you (its domain, not the page) and the first page of ours you opened. We keep this with your organization, not in a cookie.
- Only if you allow analytics: which pages you open and what you click, and recordings of the screen with the text on it and anything you type hidden.
We do not ask for sensitive personal information such as government ID numbers or health information. Please do not put it in the Service unless your board’s work requires it.
2. How we use information
- To run the Service: sign you in, keep your board’s records, send meeting emails, collect RSVPs and votes, and bill paid plans.
- To provide AI features. Karma Compass uses AI models to draft agendas, minutes and summaries, research your organization and answer questions. Drafts are suggestions for a person to review before they are approved. We do not use your organization’s records or your personal information to train AI models, and the AI model providers we use do not train on what we send them. They keep no copy of it, except that Google may keep a request to its own models that its safety systems flag as possible abuse, for up to 90 days, so its staff can review it.
- To keep the Service secure and to fix problems.
- To understand how the Service is used and improve it, using analytics only where you have allowed them.
- To reply when you contact us, and to meet legal obligations.
We do not sell personal information, and we do not use it for advertising.
3. Sharing
We share information only as follows:
- Within your organization, with the members and board your organization has added, according to their roles.
- With service providers that run the Service for us: hosting and storage, email delivery, payment processing, AI model providers, error monitoring, customer support chat and, with your consent, analytics. They may use the information only to provide their service to us. Our Security page names the AI model providers.
- With a service you connect, such as Google Drive or Microsoft 365, to the extent needed to bring your documents in.
- With an AI assistant you connect to Karma Compass, such as Claude or ChatGPT, to the extent you ask it to read or act on your organization’s records. The company behind that assistant then handles the information under its own terms, which we do not control.
- When required by law, or to protect the rights, safety or security of our users, the public or Karma.
- As part of a merger, acquisition or sale of assets, subject to this policy.
5. Your rights and choices
Depending on where you live, you may have the right to:
- access, correct or delete your personal information;
- receive a copy of it;
- object to or restrict certain processing; and
- withdraw consent, such as for analytics, at any time.
To make a request, email support@karmahq.org. If your information was added by an organization, we may refer your request to that organization.
6. Retention
A public board composition report is sent directly and is not saved as an organization record. The updates provider keeps your address and subscription information until you unsubscribe or request deletion. Our team mailbox, email delivery provider, and local development logs may retain a copy under their applicable retention settings. Contact us to request deletion. We keep your organization’s records for as long as its account is active, since a board’s records are meant to last, and as needed to meet legal obligations and resolve disputes. When an account is closed, or on a valid deletion request, we delete or anonymize the information unless we are required to keep it.
7. Security
We use reasonable technical and organizational safeguards, including encryption in transit, encryption of uploaded files at rest, access controls and audit logs. Our Security page describes them. No system is completely secure, so please tell us at support@karmahq.org if you suspect a problem.
8. Children
Karma Compass is meant for adults doing the work of an organization. It is not directed to children under 16, and we do not knowingly collect their information.
9. International transfers
We are based in the United States, and our service providers may process information in other countries. Where the law requires it, we use appropriate safeguards for these transfers.
10. Changes to this policy
We may update this policy from time to time. We will post changes here with a new effective date and, if they are significant, tell you by email or in the Service.
11. Contact us
Questions about this policy? Email support@karmahq.org. See also our Terms of Service.