Pedal Privacy Policy

Effective Date: October 15, 2026

Pedal Works, Inc. ("Pedal," "we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, share, and protect information when you use our website and Services.

1. Information We Collect

Information You Provide

We may collect:

• names and contact information
• account credentials
• organization information
• budgets and financial information
• program and operational information
• strategic planning information
• communications with Pedal
• information submitted through forms, surveys, onboarding, or support requests

Information Collected Automatically

We may automatically collect:

• IP addresses
• browser and device information
• operating system information
• usage activity
• session information
• referral information
• diagnostic and performance data

2. How We Use Information

We use information to:

• provide and operate the Services
• authenticate users
• support customer accounts
• communicate with users
• improve user experience
• maintain security
• detect misuse or fraud
• comply with legal obligations
• develop new products and features

3. Product Improvement, Research, AI Development, and Benchmarking

A core purpose of Pedal is helping nonprofit organizations make better decisions through shared learning and sector wide insights.

We may use information collected through the Services to:

• improve product functionality and performance
• develop new features and services
• train, evaluate, and improve artificial intelligence, analytics, and machine learning systems
• create recommendations, insights, forecasts, and decision support tools
• identify organizational trends and patterns
• develop benchmarking datasets and comparative metrics
• conduct research related to nonprofit governance, finance, fundraising, staffing, programming, and organizational effectiveness
• create reports, articles, blog posts, white papers, educational materials, presentations, and research publications
• support marketing, communications, and thought leadership activities

Where we rely on a third party AI provider to deliver these features, we do so under business terms that prohibit that provider from using the information we send to train the provider's own models. The providers we use are listed in Section 5.

We may create aggregated, deidentified, anonymized, statistical, or otherwise non identifiable information from data collected through the Services.

We may use and disclose such information for any lawful business purpose, including benchmarking, research, analytics, publications, and product development.

Examples may include:

• fundraising efficiency benchmarks
• staffing allocation trends
• board engagement patterns
• program spending analyses
• revenue diversification metrics
• operating reserve benchmarks
• organizational sustainability indicators

We will not intentionally identify a specific customer organization or individual in public materials without permission.

4. Analytics and Tracking Technologies

We use cookies and similar technologies to operate the Services, keep you signed in, remember your preferences, and understand how the Services are used.

We use PostHog on our public website and inside the Pedal application, and we use Google Analytics on our public website, so we can understand how visitors and users interact with Pedal.

On our public website (pedaltogether.com)

• PostHog, for website traffic and usage analytics, loaded only after you accept the cookie notice. When you accept, PostHog sets a cookie on pedaltogether.com that the Pedal application also reads, so a visit to our website can be connected to a later sign up.
• Google Analytics, provided by Google LLC, for traffic and website usage analytics on our public website, loaded only after you accept the cookie notice. Google Analytics uses cookies, including the _ga cookie, and collects information such as pages viewed, time on site, approximate location derived from IP address, device and browser information, and the site you visited before coming to our website. We do not send names or email addresses to Google Analytics. For information about how Google collects and processes data when you use our website, see How Google uses information from sites or apps that use our services atwww.google.com/policies/privacy/partners/. You can also opt out by installing the Google Analytics Opt-out Browser Add-on athttps://tools.google.com/dlpage/gaoptoutor by using the Cookie settings link on our website.
• HubSpot, which receives what you submit through our contact and interest forms. Our Get Started and Request Demo forms send your submission to our own servers, which pass it to HubSpot; our beta survey page uses a form hosted by HubSpot.
• Loom, which plays the walkthrough and help center videos. Nothing is requested from Loom until you choose to play a video.

In the Pedal application (app.pedaltogether.com)

• PostHog, for product analytics, error monitoring, session replay, and monitoring of our AI features
• Stripe, whose payment form loads on our billing pages when you add or change a payment method. Card details are entered into Stripe's form and never pass through our servers.

Product analytics events are keyed to an internal account identifier. We do not send names or email addresses to our product analytics provider.

To monitor the quality, cost, and reliability of our AI features, we also send PostHog the content of requests to and responses from our AI providers, such as a question asked in the planning assistant and the organization budget, financial, program, and mission information used to answer it. This content can include personal information, such as a name or email address typed into a question, or the names of staff listed in a budget. When we extract information from a file you upload, the content of that file is not sent to PostHog.

Session Replay

Session replay records a masked reconstruction of how users move through the application, which we use to diagnose problems and improve usability. Text and form inputs are masked in your browser before a recording is sent, so a recording shows page layout and interaction but does not show legible budget, donor, or financial figures. Session recordings are automatically deleted after 30 days.

5. Service Providers and Subprocessors

We rely on a small number of third party providers to operate the Services. These providers process information only as needed to perform their function for us, and they are bound by contractual confidentiality and security obligations.

We access OpenAI and Anthropic through their business APIs. Under those terms, the information we send is not used to train OpenAI's or Anthropic's models. This list reflects our providers as of the Effective Date above, and we will update it when it changes.

6. Other Sharing of Information

We do not sell personal information or identifiable customer data, and we do not share it for cross context behavioral advertising.

Beyond the providers listed in Section 5, we may disclose information:

• when required by law, regulation, subpoena, or other legal process
• to protect our legal rights, or the safety of our users or the public
• to investigate or prevent fraud or misuse of the Services
• in connection with a merger, acquisition, financing, or sale of company assets, in which case the information will remain subject to protections consistent with this Privacy Policy

7. Data Security

We maintain reasonable administrative, technical, and organizational safeguards designed to protect information. These include encryption of data in transit and at rest, access controls, and network isolation of our databases.

A small number of Pedal staff can access customer organization data in order to provide support, operate the Services, and check the quality of our AI features. That access is limited to staff who need it for those purposes.

No security system can guarantee absolute protection.

8. Data Retention

We retain information for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, enforce our agreements, and improve our products. The periods below reflect our current practice.

• Account and organization data. Retained for as long as the account is active. When an account or organization is closed, we deactivate it and retain the underlying records so the account can be restored and so we can meet legal, tax, and audit obligations. We delete these records on request, as described in Section 9.
• Sign in identity. When a user is deleted, that user's record is removed from our authentication provider.
• Encrypted database backups. Retained on a rolling 7 day basis. We also take a database snapshot before each software release that changes the database structure and keep at most the five most recent of those snapshots. At each such release we remove any snapshot beyond the five most recent and any snapshot older than 60 days, whichever applies first, always keeping the most recent one so that a restore point exists. Information deleted from the Services may persist in rolling backups for up to 7 days after deletion, and in a pre-release snapshot until that snapshot is removed at one of those releases.
• Uploaded files. The original file you upload, such as a budget spreadsheet or a board document, is automatically deleted from our file storage 90 days after upload. Information extracted from that file, such as budget figures and document text used to answer questions in the Services, is part of your organization data and is retained as described above. An organization logo is stored with the organization's other data rather than in file storage and is retained as organization data. When an organization is deleted, the files it uploaded are removed from file storage at that time.
• Server logs. Our application logs, which record which account made a request and any errors that occurred, are retained for 30 days. They do not include the contents of requests, IP addresses, or the content of AI requests and responses.
• Infrastructure audit logs. Records of access to our cloud infrastructure and file storage, such as which system or staff account read or wrote a file and the network address the request came from, are retained for 400 days.
• Planning assistant conversations. Your conversations with the planning assistant are retained with your organization's data so you can return to them. A conversation you delete is hidden from the Services and retained until the organization's data is deleted.
• AI quality records. When Pedal staff test our AI features against an organization's data to check quality, the inputs and outputs of those tests are retained as that organization's data.
• AI content held by our providers. PostHog retains the AI request and response content described in Section 4 for the same period as product analytics events. Our AI providers and monitoring tools retain the requests we send them under the terms described in Section 5.
• Session recordings. Automatically deleted 30 days after the session.
• Product analytics events. Retained for up to 84 months.
• Public website analytics. Retained in PostHog for up to 84 months, the same period as product analytics events. Google Analytics retains website analytics data under our configured Google Analytics retention settings.
• Prospect and customer contact records. Retained in our CRM for as long as we have an active or prospective business relationship, and afterwards as needed for legal and record keeping purposes.
• Aggregated and deidentified information. May be retained indefinitely, because it no longer identifies any individual or organization.

9. Your Privacy Rights and Choices

Subject to applicable law, you may request to:

• access the personal information we hold about you
• receive a portable copy of that information
• correct information that is inaccurate or incomplete
• delete your personal information
• restrict or object to certain processing
• opt out of marketing communications

Two of these are available directly in the Pedal application. In Account settings you can turn off sharing usage analytics and session recordings with Pedal; when you do, we stop sending product analytics events and session recordings about you to PostHog, errors are reported without identifying you, and monitoring of the AI features keeps usage metrics only, without the content of your requests. Account settings also has a Manage marketing email button that opens your personal email preferences page at HubSpot.

How to Make a Request

Email privacy@pedaltogether.com. We will acknowledge and respond within 30 days of receiving your request. We may need to verify your identity, and we may ask for additional information to locate the relevant records. We do not charge a fee for making a request, and we will not deny you service or treat you differently for exercising these rights.

Requests Involving Organization Data

Most Pedal customers are organizations, and much of the information in the Services is uploaded and controlled by the customer organization rather than by us. Where we process information on an organization's behalf:

• requests to export or delete an organization's data must come from an authorized administrator of that organization
• if you are an individual whose information an organization uploaded to Pedal, such as a donor, board member, or staff member, please contact that organization directly. We will support the organization in responding to your request.

Account and Organization Deletion

An authorized administrator may request deletion of an organization and its data by emailing privacy@pedaltogether.com. We will confirm the scope of the request before acting. Deletion removes the organization's records from the Services, subject to the backup window described in Section 8 and to any information we are required to retain by law.

Cookies and Marketing

On our public website, we set analytics and attribution cookies, including PostHog cookies, Google Analytics cookies, and attribution cookies, only after you choose Accept in the cookie notice. If you decline, the website still works and sets no such cookie. You can change your choice at any time using the Cookie settings link in the website footer, which also removes the cookies already set. In the Pedal application, cookies and analytics are part of operating the Services for signed in users; you can turn off usage analytics and session recordings for your account in Account settings. You may also disable cookies through your browser settings, though some features may not function properly.

Our marketing email is sent through HubSpot. You may unsubscribe at any time using the link at the bottom of any marketing message, from the Manage marketing email button in Account settings, or by contacting us. Service emails about your account, billing, and trial are always sent.

California and International Residents

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or the European Union and United Kingdom General Data Protection Regulation. These may include the right to know what personal information we collect and how we use it, the right to request deletion or correction, the right to a portable copy, and the right not to be discriminated against for exercising your rights. We do not sell personal information. To exercise any right, contact us at privacy@pedaltogether.com.

If you are in the European Union or the United Kingdom, you also have the right to lodge a complaint with your local data protection supervisory authority. In the United Kingdom that is the Information Commissioner's Office.

Our Services are hosted in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States.

10. Security Incident and Breach Notification

We monitor the Services for security incidents. If we confirm a breach of security that has resulted in the unauthorized access, disclosure, alteration, or loss of personal information we hold, we will:

• notify affected customer organizations without undue delay, and no later than 72 hours after we confirm the breach
• send that notice to the administrators of the affected organization, and post a notice in the Services or on this website where broader notice is appropriate
• describe what we know about the nature of the incident, the categories of information involved, the steps we are taking in response, and the steps affected parties can take
• notify individuals and regulators directly where applicable law requires it
• work to contain and remediate the incident, and conduct a review afterwards to reduce the chance of recurrence

Where Pedal processes information on behalf of a customer organization, we will notify that organization promptly so it can meet its own notification obligations.

11. Children's Privacy

The Services are intended for adults acting on behalf of organizations and are not directed to anyone under 18 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us at privacy@pedaltogether.com and we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically.

If we make material changes, we will post the updated policy and revise the Effective Date above.

13. Contact

Pedal Works, Inc.
privacy@pedaltogether.com