1. Scope and overview
XtraPoint, Inc. ("Company," "we," "us," or "our") operates XtraPoint, a web and mobile service that enables eligible donors to support participating U.S. universities, colleges, schools, school districts and educational foundations (each, a "Participating Institution"). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when a person visits or uses the application, creates an account, links a financial account, makes a donation, communicates with us, or otherwise interacts with our services.
This Policy applies to donors, prospective donors, institutional representatives, campaign organizers, and website or application visitors in the United States. It does not govern a Participating Institution's separate collection or use of information outside the application.
2. Information we collect
Category: Identity and contact
Examples: Name, email address, telephone number, mobile number, mailing address, account identifier, date of birth or age attestation where used for eligibility.
Primary source: You; Participating Institution, subject to Section 5.
Category: Donation and campaign
Examples: Amount, frequency, beneficiary, event or campaign, donation history, receipt data, authorization records, cancellation choices.
Primary source: You; our systems; Participating Institution.
Category: Bank-linking and ACH
Examples: Bank name, masked account details, account token or alias, account type, balance and transaction information authorized through Plaid, ACH authorization records and proof of delivery.
Primary source: You; Plaid; payment and ACH providers.
Category: Card and payment
Examples: Card brand, last four digits, token, billing information, authorization status, disputes, refunds and chargebacks. We do not store full card numbers or card verification values.
Primary source: You; payment processor.
Category: Device and usage
Examples: IP address, device identifiers, browser, operating system, app activity, referring pages, logs, cookies and analytics.
Primary source: Your browser or device; analytics tools.
Category: Institutional due diligence
Examples: Entity name, tax status, addresses, authorized representatives, banking and settlement data, sanctions screening results, compliance records.
Primary source: Participating Institution; public sources; vendors.
Category: Communications
Examples: Support requests, complaints, surveys and related correspondence.
Primary source: You or the Institution.
3. Bank linking, tokenization and linked financial accounts
If you choose to link a financial account, Plaid and the relevant financial institution collect login credentials or other authentication information directly. The Company does not receive or store your online-banking password. Depending on the permissions presented at connection, Plaid may provide account identity, account and routing information, balances, and transaction data needed to calculate and process round-up donations, validate an account, prevent fraud, and support the service. Plaid's handling of information is governed by its own privacy disclosures, which are presented to you at connection.
Tokenization. Your full bank account and routing numbers are held by a specialized security provider that operates a secure vault on our behalf (Very Good Security). That provider issues an alias, which is a random reference value with no independent meaning, and the alias is what the application and our payment platform store and use. Your actual account and routing numbers are re-associated only at the point the payment instruction is delivered to the banking network. The Company does not store your full account number in the application or on its own servers.
4. Information received from Participating Institutions
A Participating Institution may provide us with contact information for its own representatives and administrators, and with information necessary to administer a donation you have made.
We do not accept student records or student directory information from a Participating Institution for marketing or donor-prospecting purposes. We will not knowingly accept education records subject to the Family Educational Rights and Privacy Act, alumni or student mailing lists, or similar institutional data sets except where the Institution has confirmed in writing that the disclosure is permitted under applicable law and its own policies, and the transfer is documented under our agreement with that Institution. A corresponding restriction appears in the Participating University and School Agreement.
5. How we use information
Provide accounts, bank linking, donation processing, receipts, history, round-up calculations, recurring donations, event campaigns, refunds, support, and communications.
Authenticate users; validate payment accounts; screen for sanctions; prevent fraud, abuse, duplicate transactions, account takeover, unauthorized activity, and security incidents.
Settle or facilitate settlement to Participating Institutions and reconcile funds, fees, returns, reversals, refunds, and chargebacks.
Verify and monitor Participating Institutions and their authorized representatives, including good-standing verification required by charitable fundraising platform laws.
Comply with payment-network rules, ACH rules, charitable-solicitation and platform reporting requirements, court orders, tax and recordkeeping requirements, and applicable law.
Operate, debug, secure, analyze, and improve the application and develop new features.
Send service communications and, where permitted and consented to, marketing messages. You may opt out of marketing without affecting transactional notices.
6. Text messages
If you provide a mobile number, we may send transactional text messages relating to your account, authorizations, scheduled debits, returned payments and support requests. We will send marketing or promotional text messages only with your prior express written consent, obtained separately from any other agreement and not as a condition of donating.
Message and data rates may apply. You may opt out of text messages at any time by replying STOP to any message or by contacting support@xtrapoint.com. Opting out of marketing texts does not stop transactional messages required to administer an authorization you have given.
7. How we disclose information
Participating Institutions: donor identity, contact details, donation amount, designation, receipt information, and other information needed to administer the donation and issue tax acknowledgments, subject to any available anonymous-donation option.
Service providers: Plaid; the tokenization and security-vault provider that holds account credentials on our behalf; payment processors; acquiring and sponsor banks; card networks; ACH operators; fraud and sanctions-screening providers; identity-verification providers; cloud hosts; analytics providers; communications providers; and professional advisers performing services for us and are available upon request.
Government, regulators, state charity officials, law enforcement, courts, or other parties when reasonably necessary to comply with law, satisfy platform reporting obligations, protect rights or safety, investigate fraud, or enforce agreements.
A buyer, successor, lender, investor, or adviser in connection with a financing, merger, acquisition, reorganization, or sale, subject to appropriate protections.
Other parties at your direction or with your consent.
We do not sell personal information for money.
8. Cookies, analytics and mobile technologies
We may use cookies, SDKs, pixels, local storage and similar technologies for authentication, preferences, security, and analytics.
9. Data retention
We retain personal information for as long as reasonably necessary to provide the service, comply with legal and payment-network obligations, resolve disputes, maintain authorization and transaction evidence, and enforce agreements.
Retention periods are governed by the Company's Master Records Retention Schedule which is the controlling schedule for all Company policies and procedures. Among other periods, ACH authorization records and proof of delivery are retained for not less than two years after the authorization is revoked or terminated. Information may be retained longer when subject to a legal hold, investigation, dispute, or regulatory obligation.
10. Security
We maintain administrative, technical and physical safeguards designed to protect personal information, including access controls, encryption in transit and at rest, tokenization of financial account data as described in Section 3, logging and monitoring, vendor oversight, secure development practices, and documented incident-response procedures. These safeguards are established and maintained under the Company's Information Security Policy and Incident Response Plan.
No system is completely secure, and we cannot guarantee absolute security. Do not send passwords, full payment-card numbers, card verification values, or online-banking credentials through email or support messages.
11. Your choices and privacy rights
Review or update account information through http://app.xtrapoint.com/profile.
Disconnect a linked financial account and cancel round-up or recurring donations through http://app.xtrapoint.com/profile, subject to the disclosed cancellation cutoff of three business days before a scheduled debit.
Opt out of marketing emails using the unsubscribe link, and marketing texts by replying STOP. Transactional messages will continue.
Request access, correction, deletion, portability, or other rights available under applicable state law by contacting support@xtrapoint.com.
Appeal a denied privacy request by privacy@xtrapoint.com. Authorized agents must provide authority and identity verification as permitted by law.
We will not discriminate against you for exercising applicable privacy rights. Certain information may be exempt, and we may retain information necessary for transactions, fraud prevention, legal compliance, disputes, or security. If the Company is subject to the Gramm-Leach-Bliley Act, some of the rights described above may not apply to financial information covered by that statute, and Section 4 will state the Company's position.
12. Age eligibility, children and students
The application is intended for persons age 18 or older. Age eligibility is enforced at account creation through [AGE GATE METHOD], not solely by this notice. We do not knowingly permit a person under [18] to create a donor account, link a financial account, or authorize a debit.
The application is not directed to children under 13, and we do not knowingly collect personal information online from a child under 13. Because Participating Institutions may include elementary and secondary schools and school districts, Institutions may not direct students to create donor accounts, may not use the application to solicit students, and may not submit student personal information through the service. If you believe a person under [18] has created an account or that a child under 13 provided information, contact [PRIVACY EMAIL] and we will close the account and delete the information as required.
13. Third-party services and links
The application may link to Participating Institutions, Plaid, payment processors, app stores, and other third parties. Their privacy practices are governed by their own notices. The Company is not responsible for independent third-party practices.
14. Changes
We may update this Policy. We will post the revised version and update the effective date. If required, we will provide additional notice or obtain consent before materially different processing.
15. Contact
XtraPoint, Inc.
Privacy: privacy@xtrapoint.com
Support: support@xtrapoint.com
Privacy request form: https://www.xtrapoint.com/support