Privacy Policy

1. About this policy

Members Collect, Inc., a Delaware corporation doing business as Bricks ("Bricks", "we", "us" or "our"), provides financial operations and fund-accounting software to organizations in the United States. This Privacy Policy explains how we collect, use, share and protect personal information through our website at joinbricks.co, the Bricks app, the giving pages we host for organizations, and Bricks by text message (together, the "Services"). It also explains the choices and rights you have.

Bricks is offered only to organizations, for business and charitable purposes. Individuals use Bricks on behalf of an organization, give to an organization through it, or are paid by one.

2. Our role

Information we are responsible for. We decide how to use the information we collect to run Bricks and to meet our own legal and program obligations. This covers the people who sign up for and use Bricks, the representatives, officers and board members of organizations that apply, cardholders, people who contact us, and visitors to our website.

Information we process for an organization. Organizations use Bricks to keep records about their donors, members, payees and vendors, and to store documents. For that information, we act as a service provider to the organization and process it on the organization's behalf and under its instructions. The organization decides what it collects and how it uses it, and its own privacy notice applies. If you are a donor, member, payee or vendor of an organization and have a question or request about your information, please contact that organization. If you contact us, we will pass your request to the organization and help it respond.

3. Information we collect

Who	What we collect
People who use Bricks	Name, email address, role in the organization, and sign-in details. If you add a mobile number: the number, which we store encrypted, and your text-message consent preferences, including whether you have opted in or opted out. Providing a number does not by itself mean you consent to recurring text messages.
The person who applies for an organization	Title and phone number, and the organization's details: legal and trade names, employer identification number, physical address, phone number, website, mission, annual revenue, number of workers, and whether it operates outside the United States.
A second officer named in an application	Name, email address and title.
Officers, directors and trustees	Name, title and role from the organization's most recent public IRS Form 990, and term, independence, hours and compensation where the organization adds them.
Cardholders	Date of birth, phone number and billing address when a card is activated, and a shipping address for a physical card. We pass these to Stripe to issue the card. We do not keep our own copy in our cardholder records, but the copies of Stripe's card updates that we receive, which can include them, are kept as account records. Full card numbers are displayed in Stripe's secure frames and are not sent to our servers.
Donors and payers	Name and email address, and, where provided, postal address, phone number, tribute or dedication details, contact preferences and consents, giving history, and notes the organization records.
Payees and vendors	Name, email address, the last four digits of the payment method, and, for tax reporting, legal name, address and taxpayer identification number. We encrypt taxpayer identification numbers with dedicated keys and display only the last four digits. The W-9 form provided with a taxpayer identification number is kept as a tax record. Payout account and routing numbers are passed to Stripe and are not stored by us.
Accounts and transactions	Payments, refunds and disputes; financial account balances and transfers; card authorizations and transactions, with merchant names and categories; the last four digits and references Stripe gives us for cards and payment methods; the organization's ledger entries, fund allocations and reconciliations; and signals we use to review applications and prevent fraud.
Documents	Files an organization uploads, such as grant agreements, invoices, receipts and meeting minutes, and receipt photos you send us by text message or email.
People who contact us	Support and complaint messages, and the records we keep while resolving them.
People who accept an agreement in Bricks	The agreement and its version, the time, and the IP address and browser used.
Device and usage information	IP address and browser information in our request logs, and hashed IP address and browser information for sign-in sessions.
Website visitors	Pages viewed, the referring site and a random visitor identifier stored in your browser; and your name, email address, phone number and organization if you ask us to call you or book a time.
AI features	What you send to the Bricks assistant and what it answers, and the suggestions AI features make (section 8).

Identity verification for an organization's representative and owners, such as date of birth and the last four digits of a Social Security number, is collected by Stripe through Stripe's own form displayed inside Bricks and is handled under Stripe's Privacy Policy.

4. Where we get information

From you, when you sign up, apply, use Bricks, give, or contact us.
From your organization, when it adds you as a user, cardholder, donor, payee or vendor.
From Stripe, about the status of an organization's verification, financial account, cards and payments.
From the IRS, which publishes exempt-organization records and Form 990 returns. We use them to confirm an applicant's status and to prefill its officers.
From public filings, if your organization uses donor research: Form 990 returns through ProPublica, SEC EDGAR, and the Federal Election Commission. Only a donor's name and US state are sent to these sources.
From services your organization connects, such as gift platforms (for example Givebutter, Donorbox, Fundraise Up, Chariot or Every.org) and accounting software (Intuit QuickBooks).

5. How we use information

To provide the Services: accounts, payments, financial accounts, spend cards, fund accounting, receipts, donor acknowledgments and tax forms.
To review applications, including checks in addition to Stripe's verification, and to prevent fraud and losses.
To secure the Services, including requiring a second verification step for sensitive actions.
To provide support, and to handle complaints and disputes.
To meet legal, tax and recordkeeping obligations, including those that Stripe and its bank partners set for the financial accounts and cards on Bricks.
To send service communications, such as receipts, notices and security messages. If we send you marketing email, you can unsubscribe using the link in it.
To maintain and improve the Services.

6. Stripe and our bank partners

Payments, financial accounts and spend cards on Bricks are provided by Stripe. When you provide personal data in connection with payments, financial accounts or spend cards on Bricks, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.

We may provide personal data to Stripe, its affiliates, Fifth Third Bank N.A., which holds financial account funds, and Celtic Bank, which issues spend cards. Stripe, its affiliates and these banks may collect, use, retain and disclose that personal data. By applying for a financial account or spend cards, you consent to Stripe's Privacy Policy. Celtic Bank's privacy policy is available at celticbank.com/privacy-policy.

Stripe processes personal data in the United States and may transfer it to other countries under its own safeguards.

At checkout. Donors and payers pay on Stripe's hosted checkout page. We use Stripe for payments, analytics, and other business services. Stripe may collect personal data including via cookies and similar technologies. The personal data Stripe collects may include transactional data and identifying information about devices that connect to its services. Stripe uses this information to operate and improve the services it provides to us, including for fraud prevention and detection, authentication, analytics related to the performance of its services, and to enhance and customize the user experience. Stripe's Link service can recognize a returning payer by email address, phone number or browser cookie. You can learn more about Stripe and read its privacy policy at https://stripe.com/privacy.

Within your organization. People in your organization see information according to the roles the organization assigns. For example, a cardholder's spending is visible to the people who manage the organization's finances.
Service providers who host, secure and operate the Services for us under contracts that limit their use of the information. They are listed at joinbricks.co/subprocessors.
Services your organization connects, such as accounting software or gift platforms, which handle information under their own terms.
Bricks staff, who can access an organization's workspace to provide support, review applications, investigate fraud and meet legal obligations. This access is recorded in our audit log.
Legal and safety. When we believe disclosure is required by law, regulation or legal process, or is needed to protect the rights, property or safety of Bricks, our users or others, including to prevent fraud.
Business transfers. In connection with a merger, acquisition, financing or sale of assets, subject to this Privacy Policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

The restrictions on mobile information and text-message consent in section 9 apply to the sharing described in this policy, including business transfers.

8. Artificial intelligence features

Some Bricks features use AI models provided by Anthropic and OpenAI, reached through Respan, which routes and monitors our requests to them, to read documents and suggest actions, including categorizing transactions, reading grant agreements and receipts, drafting messages to donors, answering questions in the Bricks assistant, and sorting support requests and complaints.

What the models receive. Depending on the feature: grant documents, receipt images, messages you send to the assistant, information about the page you are viewing, and donor names and giving history when drafting messages. Donor email addresses, phone numbers, postal addresses and notes are withheld from the assistant's donor tools. Requests to model providers carry organization and conversation identifiers, not your name or email address.
How the providers use it. We use Anthropic's and OpenAI's commercial services, under which they do not use this information to train their models. They may retain it for up to 30 days, and longer where needed to investigate misuse or where required by law. Respan keeps logs of our requests to monitor and troubleshoot them, under its contract with us.
People decide. AI features make suggestions; people make decisions. An AI agent can propose a payment but cannot approve one, and no money moves on an AI model's decision. An organization can choose to let some drafted messages, such as thank-you notes for gifts under a limit it sets, send without review.
Conversations. Messages exchanged with the Bricks assistant, in the app or by text message, are deleted from our active systems after 24 hours; copies in our encrypted backups expire within 35 days. Answers from the grant-eligibility assistant are kept with the organization's financial records (section 11) as a record of the advice given.
Assistants you connect. If your organization connects its own AI assistant to Bricks, that assistant's provider handles what it receives under its own terms.

9. Text messages

Bricks text messaging. Members Collect, Inc., doing business as Bricks, operates this SMS/MMS program. With your consent, Bricks can send recurring requests for a receipt or note on a card purchase, confirmation when a receipt you send is matched, and replies from the Bricks assistant. You can reply with a photo of a receipt. These are service messages; this program does not send marketing or promotional texts.

Your choice. You opt in to recurring texts by selecting the separate, optional SMS consent checkbox shown when you add your mobile number in Bricks. The checkbox is not selected by default. Adding a number, accepting our Terms of Service, or having your organization add you as a User does not by itself enroll you in recurring texts. SMS consent is not a condition of creating an account, purchasing a service or using Bricks' non-SMS features.

Frequency, costs and help. Message frequency varies with your card activity and use of text-message features. Message and data rates may apply to messages you send and receive. Reply STOP to stop receiving messages or HELP for help. You can also contact support@joinbricks.co. After you opt out, we may send one confirmation text; we will not send further program messages unless you opt in again. You can remove your number in Bricks at any time.

Message content. Texts can include amounts, merchant names and links; they do not include full card numbers or taxpayer identification numbers.

Mobile information and consent. By "mobile information" we mean your phone number and your SMS opt-in and consent records. We do not sell, rent or share your mobile information with third parties, affiliates or lead generators for marketing or promotional purposes. We do not buy, sell, rent or transfer text-message consent to another sender, including in a business transfer. We share mobile information only with the providers that deliver or administer our messaging program (Pinnacle for SMS and RCS, and Photon for iMessage), or where disclosure is required by law. Those providers may not use it for their own marketing or another sender's messaging program. AI providers never receive your phone number or consent records.

What you write in a text. The content of a text you send us, and any photo you attach, is used to provide the feature you are using. When you write to the Bricks assistant or send a receipt photo, the minimum content needed is sent to the AI providers in section 8, without your phone number.

10. Cookies and similar technologies

The Bricks app sets one cookie, which keeps you signed in for up to 7 days, and uses your browser's storage to remember display preferences. Our sign-in provider, WorkOS, maintains its own sign-in session.
Stripe sets its own cookies where its forms and components load and on its checkout page (section 6).
Giving pages use Cloudflare Turnstile to block automated abuse and, where an organization accepts gifts from donor-advised funds, Chariot. Chariot receives the donor's name and email address to start the gift. Videos an organization embeds load from YouTube's privacy-enhanced mode or from Vimeo with tracking turned off, and only when played.
The app and giving pages do not use analytics or advertising cookies.
Our website counts page views and "Book a call" clicks using a random identifier stored in your browser, not a cookie, and does not use advertising trackers. If you book a time, Cal.com handles the booking.
Do Not Track and Global Privacy Control. Because we do not sell personal information or use it for targeted advertising, there is nothing for these signals to turn off on our Services; we treat a Global Privacy Control signal as an opt-out request where the law requires.

11. How long we keep information

Information	How long we keep it
Financial records: ledger entries, receipts, acknowledgments, tax forms and supporting W-9 forms	At least the life of the organization plus 7 years
Agreement acceptances, compliance records, and notices sent about financial accounts and cards	At least 5 years
Taxpayer identification numbers	As long as tax law requires for the forms that used them
Audit log and grant-eligibility answers	With the organization's financial records
Bricks assistant messages	24 hours in active systems
Request logs	About 30 days
Backups	35 days, after which copies of deleted information are gone
Website contact and booking requests	Until you ask us to delete them, or we no longer need them to follow up

"The life of the organization" means as long as the organization keeps its Bricks account. We keep other information while the organization uses Bricks and for as long as needed for the purposes in this policy, and then delete or de-identify it. A legal hold can suspend deletion.

12. Your choices and rights

Your account. You can remove your mobile number in Bricks at any time. Your organization's administrators manage your role and access.
Requests. You can ask us to tell you what personal information we hold about you, to give you a copy, to correct it or delete it, or to stop a particular use, by emailing support@joinbricks.co with "Privacy request" in the subject. We will verify your identity before acting on a request, respond within the time the law requires, and explain if we cannot fulfill it, for example because we must keep financial, tax or program records. You may use an authorized agent, who must provide proof of your permission.
Information an organization holds. For donor, member, payee and vendor records, we pass your request to the organization (section 2). An organization can erase a donor's contact details in Bricks; gift records needed for receipts and tax reporting are kept.
Information Stripe holds. We will help you correct information Stripe holds for a financial account or card. Stripe's Privacy Policy describes its own process.
State privacy rights. Depending on where you live, you may have the right to know what personal information we collect and how we use and share it, to access, correct and delete it, to obtain a portable copy, to opt out of its sale, use for targeted advertising or certain profiling, and to appeal our decision on a request. We do not sell personal information or use it for targeted advertising. We will not discriminate against you for exercising these rights. To appeal a decision, reply to it with "Appeal" in the subject line; if we deny your appeal, you may contact your state attorney general.
California residents. Sections 3, 4, 5 and 7 describe the categories of personal information we collect, their sources, the purposes for which we use them and the categories of recipients, and section 11 describes how long we keep them. We do not sell or share personal information as those terms are defined under California law, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it.

13. Security

We protect personal information with technical and organizational measures. These include encryption at rest; dedicated encryption keys for taxpayer identification numbers, phone numbers and stored credentials; separation of each organization's data in our application and database; a second verification step for sensitive actions; and an audit log that cannot be edited. No system is completely secure. If you believe your account has been accessed without permission, contact us right away at support@joinbricks.co.

14. Children

The Services are not directed to children. Users must be at least 18 years old. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it.

15. United States only

The Services are offered only in the United States. We store Bricks data in the United States. Some service providers may process information in other countries under their own safeguards.

16. Links to other sites

The Services link to sites and services we do not operate, including Stripe's. Their privacy practices are governed by their own policies.

17. Changes to this policy

We will post any change to this policy here with a new version number and effective date. We will email organization administrators at least 30 days before a material change takes effect, as our Terms of Service provide. Earlier versions are available on request.

18. Contact us

Members Collect, Inc. 1235 Delaplane Grade Road, Upperville, VA 20184 support@joinbricks.co