Privacy Policy

Effective date: May 1, 2026

1. Scope of this policy

This policy applies to information we collect through our website at songsoflove.org, our online donation forms, our song request forms, our vehicle donation pages, our Google Ads lead forms, our email newsletters, and our direct phone and mail communications with supporters and song recipient families.

It does not apply to third-party websites we link to. When you click a link to leave our site (for example, when you click “Start Your Donation” on our car donation page, you are taken to our donation processor’s site), the privacy practices of that third party will apply to your activity there.

2. Information we collect

2.1 Information you give us directly

We collect information you choose to provide when you:

• Donate money — name, mailing address, email address, phone number, donation amount, and any tribute information you include (such as a name to honor or memorialize). Payment card information is not stored on our servers; it is handled by our payment processor.
• Donate a vehicle — name, address, email, phone, vehicle make, model, year, condition, title status, and pickup details. Vehicle donations are handled by our partner processor (see Section 5); we receive a record of completed donations from them.
• Request a personalized song — the requester’s contact information, the recipient’s first name, age, medical or emotional challenge, and personal details you choose to share so our musicians can write a meaningful song. This is sensitive information; we treat it accordingly (see Section 7).
• Submit a Google Ads lead form — name, email, phone number, and any optional fields you complete (postal code, vehicle type, the occasion of a gift, and similar). Google may pre-fill these fields with information from your Google account; you choose whether to submit.
• Subscribe to our newsletter — email address and, optionally, name and ZIP code.
• Contact us by email, phone, or mail — whatever information you choose to share in your message.
• Apply to volunteer or perform as a Songs of Love musician — name, contact information, professional background, and any materials you submit.

2.2 Information we collect automatically

When you visit our website we automatically collect:

• Standard log data including your IP address, browser type, device type, referring URL, pages visited, time on page, and approximate geographic location derived from your IP address.
• Information from cookies and similar technologies (see Section 6).

2.3 Information we receive from third parties

We receive limited information from:

• Payment and donation processors — confirmation of completed donations, transaction amounts, and the donor’s name and contact information for tax-receipt purposes.
• Vehicle donation partners — donor contact information, vehicle details, and net proceeds for completed vehicle donations.
• Google, Meta, and other advertising platforms — aggregated reports about how our ads perform, and pseudonymized identifiers used for conversion measurement.
• Hospitals, social workers, and care providers — when a healthcare professional submits a song request on behalf of a patient, we receive the recipient’s information through them.

3. How we use information

We use the information we collect to:

• Create and deliver personalized songs to recipients.
• Process donations, send tax-deduction receipts, and acknowledge gifts to the donor or to a tribute recipient.
• Coordinate vehicle pickups and complete the vehicle donation paperwork.
• Respond to inquiries submitted through our website, lead forms, email, or phone.
• Send newsletters, donation appeals, and program updates to people who have given us their email address. You can unsubscribe at any time using the link at the bottom of every email.
• Operate, maintain, and improve our website and our online forms.
• Measure the performance of our advertising campaigns and improve targeting so our ads reach people likely to support our mission.
• Comply with our legal and tax obligations as a 501(c)(3) nonprofit, including IRS reporting and donor-acknowledgement requirements.
• Protect our website, our donors, and our recipients against fraud, abuse, and security threats.

We do not use your information to make automated decisions that produce legal or similarly significant effects on you.

4. When we share information

We share personal information only in the following limited circumstances:

• With service providers who help us operate, including our website host, email service provider, donation processor, vehicle donation processor, customer-relationship database, and analytics providers. These providers are contractually required to use the information only to perform services for us.
• With song recipient families when you make a tribute donation in honor or memory of someone, if you ask us to notify them. We share your name and message with the recipient or recipient’s family. We do not share your contact information unless you give explicit permission.
• With our musicians who write the personalized songs. They receive the recipient’s first name, age, medical situation, and the personal story you provide. They do not receive the requester’s contact information unless you specifically authorize it.
• To comply with the law when required by valid legal process, court order, or government request, or when we believe in good faith that disclosure is necessary to protect our legal rights, the safety of any person, or to investigate fraud.
• In connection with a merger, acquisition, or organizational restructuring, if Songs of Love Foundation ever combines with or is succeeded by another nonprofit organization. In that case we will notify you and continue to honor the privacy commitments in this policy.

We do not sell your personal information. We do not rent, lease, or trade donor or recipient lists to other organizations.

5. Third-party processors

The following third parties process information on our behalf. Each operates under its own privacy policy, which governs how that company handles your information.

Service	Purpose
Online donation processor	Processes credit card and ACH donations made through our website.
Kids Car Donations	Processes vehicle donations made through our car donation page, including pickup, title transfer, sale, and the donor’s tax receipt.
Google Ads and Google Analytics	Delivers and measures our online advertising; provides aggregated information about how visitors use our website.
Email service provider	Sends our donor newsletters, tax receipts, and transactional emails.
Web host and security provider	Hosts our website and protects against fraud and abuse.

6. Cookies and tracking

We use cookies and similar technologies on songsoflove.org to:

• Remember your preferences and keep you signed in to forms during your visit.
• Measure how visitors find and use our site, so we can improve it.
• Measure the performance of our online ads and stop showing the same ad to people who have already taken action.

You can control cookies through your browser settings. Most browsers let you block or delete cookies, or warn you before a cookie is set. Some parts of our donation flow may not work properly if you block all cookies.

We honor the “Global Privacy Control” signal sent by some browsers and extensions, and we treat it as an opt-out of advertising-related cookies for residents of states that recognize it (including California).

7. Children’s privacy and song recipient information

Songs of Love serves recipients of all ages, including children. We take particular care with information about minors.

• We do not knowingly collect personal information directly from children under 13 through our website forms. Song requests are submitted by a parent, family member, healthcare provider, or other adult on the child’s behalf.
• We collect only the information needed to write a meaningful song: the child’s first name, age, medical or emotional situation, and details the requester chooses to share.
• We do not publish the recipient’s last name, address, or specific medical records on our website or in marketing materials.
• We do not target advertising to children. Our paid advertising is targeted at donors and supporters, and we comply with the Children’s Online Privacy Protection Act (COPPA) and Google’s policies on advertising to minors.
• If you are a parent or guardian and believe we have collected information from a child in a way that doesn’t match this policy, please contact us using the information in Section 14 and we will promptly review and remove the information.

8. How long we keep information

We keep information only as long as needed to fulfill the purposes for which it was collected, comply with our legal obligations (including tax record-keeping for charitable contributions), resolve disputes, and enforce our agreements. Specifically:

• Donation records: retained for at least seven years to meet IRS substantiation requirements.
• Song request records: retained indefinitely as part of our historical archive of the more than 50,000 songs we have created since 1996, because families often ask for replacement copies years later. We will delete a song request record at the family’s request.
• Lead form submissions where no donation or song request resulted: retained for up to 24 months, then deleted.
• Newsletter subscribers: retained as long as you remain subscribed; deleted within 30 days after you unsubscribe.
• Website analytics data: retained according to Google Analytics’ default retention settings (currently 14 months).

9. How we protect information

We use industry-standard administrative, technical, and physical safeguards to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS) for all forms, restricted staff access, and reputable third-party processors for sensitive payment data.

No method of transmission over the Internet or electronic storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security. If we become aware of a security incident affecting your information, we will notify you as required by law.

10. Your rights and choices

You have the following rights regarding your personal information:

• Access: You can request a copy of the personal information we have about you.
• Correction: You can ask us to correct information that is inaccurate or incomplete.
• Deletion: You can ask us to delete your personal information, subject to our legal obligations to retain donation records for tax purposes.
• Opt-out of email: You can unsubscribe from our newsletter or appeals at any time using the link in any email, or by contacting us.
• Opt-out of advertising cookies: You can disable advertising cookies in your browser, use a Global Privacy Control signal, or opt out through industry programs at optout.aboutads.info and optout.networkadvertising.org.
• Complain to a regulator: If you believe we have violated your privacy rights, you have the right to file a complaint with your state attorney general or, where applicable, your data protection authority.

To exercise any of these rights, contact us using the information in Section 14. We will respond within 30 days, or sooner where required by law.

11. California residents (CCPA / CPRA)

If you live in California, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• The right to know what categories of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• The right to request deletion of your personal information, subject to legal exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under California law.
• The right not to be discriminated against for exercising your privacy rights.

To exercise your California rights, contact us using the information in Section 14. We will verify your identity before responding, typically by confirming the email address or phone number we have on file.

12. European residents (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation. Our legal bases for processing your information are:

• Consent — for newsletter sign-ups, optional cookies, and advertising measurement.
• Performance of a contract — for processing donations and fulfilling song requests you have asked us to create.
• Legitimate interests — for measuring the performance of our website and ads, and for protecting against fraud and abuse, balanced against your privacy interests.
• Legal obligation — for tax record-keeping and responding to lawful government requests.

You have the rights of access, rectification, erasure, restriction, portability, and objection. You can withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You can lodge a complaint with your national data protection authority.

We transfer personal information from Europe to the United States, where our servers and operations are located. We rely on standard contractual clauses or other legally recognized transfer mechanisms to protect your information during these transfers.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. When we do, we will revise the “Effective date” at the top of this page. If the change is material, we will notify you by email (if we have your email address) or by posting a prominent notice on our website before the change takes effect. Your continued use of our website after a change becomes effective means you accept the updated policy.

14. How to contact us

If you have a privacy concern that we have not been able to resolve to your satisfaction, you can also contact your state attorney general or, in the European Union, your national data protection authority.