Terms & Privacy

1.1 Who can use the platform

• You must be at least 18 years old and able to enter a binding contract.
• You must provide accurate account information and keep your sign-in credentials secure.
• Campaign creators must complete identity and bank verification through our payment partner (Stripe) before receiving payouts.

1.2 Campaign rules

• Campaigns must pursue a genuine social impact purpose aligned with at least one UN Sustainable Development Goal.
• Campaigns must publish an itemized budget that adds up to the funding goal.
• All campaigns are subject to human review and may be rejected or removed at our discretion, with an explanation.
• Creators are responsible for fulfilling what their campaign promises and for keeping backers informed through updates.

1.3 Contributions & funding models

• Keep-What-You-Raise (KWYR): contributions are charged immediately and transferred to the campaign regardless of whether the goal is reached.
• All-or-Nothing (AON): your card is authorized but not charged. The pledge is only collected if the campaign reaches its goal by the deadline; otherwise the hold is automatically released.
• Contributions are voluntary support for a cause — they are not investments, loans or purchases, and confer no ownership or guaranteed returns.
• Reward tiers, where offered, are gestures of appreciation from creators; their delivery is the creator’s responsibility.

1.4 Fees & payouts

• We charge a 5% platform fee on successfully raised funds. Payment processing fees charged by Stripe are additional and deducted automatically.
• Payouts are transferred to the creator’s verified bank account via Stripe Connect after campaign funds are released.
• If a campaign raises nothing, it pays nothing.

1.5 Refunds & cancellations

• All-or-Nothing campaigns that fail to reach their goal never charge you — holds are released automatically.
• We may issue refunds to backers where a campaign is found to violate these terms or materially misrepresents itself.
• Refunds are returned to the original payment method, typically within 5–10 business days.

1.6 Prohibited conduct

You may not use the platform to:

• Raise funds for anything illegal, hateful, violent, discriminatory or deceptive.
• Misrepresent your identity, your campaign’s purpose or the use of funds.
• Launder money, finance terrorism or evade sanctions.
• Harass other users, scrape the platform or interfere with its operation.

Violations lead to campaign removal, account suspension, frozen payouts and — where appropriate — reports to authorities.

1.7 Our role & liability

socialchange.tech is a platform that connects creators and backers. We review campaigns for credibility, but we do not guarantee outcomes and are not a party to the relationship between creators and backers. To the maximum extent permitted by law, our liability is limited to the platform fees we received in connection with the matter giving rise to a claim.

2.1 What we collect

• Account data: name, email address, password (stored only as a salted hash), and optional profile details such as an avatar and bio.
• Campaign and contribution data: campaigns you create, causes you back and amounts you contribute.
• Sign-in security data: one-time verification codes (stored only as hashes) and password reset tokens, all short-lived.
• Technical data necessary to operate the service, such as request logs.

We do not collect or store your card details — payments are handled entirely by Stripe.

2.2 How we use it

• To operate your account, process contributions and deliver payouts.
• To send transactional emails: sign-in codes, receipts, campaign updates, approval decisions and refund notices.
• To review campaigns, prevent fraud and keep the platform safe.

We do not sell personal data, and we do not use your data for third-party advertising.

2.3 Who we share it with

• Stripe — to process payments and payouts (they act as an independent controller for payment data).
• Resend — to deliver the emails described above.
• Cloudinary — to store images you upload (campaign covers, galleries, avatars).
• Google — only if you choose to sign in with Google.
• Authorities — only where legally required.

2.4 How we protect it

• All traffic is encrypted in transit (HTTPS).
• Passwords are hashed with bcrypt; verification codes and reset tokens are stored only as SHA-256 hashes and expire quickly.
• Password sign-ins require a one-time email code (two-step verification) by default.
• Access to production data is restricted to what is strictly needed to operate the platform.

2.5 Your rights

• Access and update your profile information at any time from your account.
• Request a copy or deletion of your personal data by contacting us (legal and accounting retention obligations may apply to contribution records).
• Withdraw from marketing communications — though note we currently send only transactional emails.