← Back

MissionAligned Connect

Privacy Policy

Effective date: October 14, 2026

This Privacy Policy explains how WithSocialAI Inc ("WithSocialAI", "we", "us", or "our") collects, uses, discloses, and protects information in connection with MissionAligned Connect (the "Service"), available at connect.missionaligned.net (opens in a new tab).

MissionAligned Connect is a business-to-business platform that helps nonprofit organizations operate their programs, publish public pages and feeds, coordinate funding, and engage their communities. This policy applies to information we process when nonprofits and their teams use the Service, when members of the public visit organization pages, and when constituents submit information through the Service.

1. Our two roles: controller and processor

The Service is offered to nonprofit organizations ("Customer Organizations"). Depending on the data involved, we act in one of two capacities:

  • As a processor / service provider. For data that a Customer Organization uploads, imports, collects from its constituents, or otherwise manages within its workspace ("Customer Data"), the Customer Organization is the data controller. We process Customer Data only on the Customer Organization's behalf and according to its instructions and our agreement with it. If you are a constituent, volunteer, donor, or community member of a nonprofit that uses the Service, that nonprofit — not WithSocialAI — determines how your information is used. Please direct requests about that data to the relevant organization; we will support them in responding.
  • As a controller. For the account and contact information of the individuals who administer or use the Service (for example, organization administrators and team members), for billing information, and for usage and device data we collect to operate and improve the Service, WithSocialAI is the controller.

2. Information we collect

Account and profile information. Name, email address, password credentials, role, organization affiliation, job title, profile details, and pronouns when provided.

Organization and workspace content. Organization profiles, programs, posts, feeds, funding records, distributions, activity types, and related content that Customer Organizations create or upload.

Constituent and submission data. Information submitted through public data-collection forms and distributions, such as survey responses and contact details that constituents choose to provide. This is Customer Data processed on behalf of the relevant organization.

Embeds and links on an organization's own website. An organization can show its feed or calendar from the Service on its own website, and can place links there to its forms and events on the Service. The embedded feed and calendar set no cookies and run no analytics, and we collect nothing about the people who view them. When someone follows a link an organization placed, we add one to a daily click total for that link (clicks we recognize as automated, such as crawlers and link previews, are totaled separately). We do not store the person's IP address, browser details, or the page they came from with that total, we do not set a cookie, and we do not try to recognize the same person across visits or websites. To limit automated clicks, we keep a keyed one-way hash of the network address in a short-lived counter; it is never linked to a click total or a form response, and it is deleted within a day. If the person then submits the organization's form, the submission is Customer Data processed on that organization's behalf, as above. It is recorded with the link it came through and with a record of the consent and privacy statements shown on the form at that time and the choices the person made. An organization can cite its daily click totals in its own grant-reporting records; they count clicks, never people.

Socially connected content. When an organization connects an Instagram or LinkedIn account, we import that account's own public posts and aggregate engagement counts to generate reviewable feed drafts and platform signals. Unless a platform administrator has turned comment capture off for the organization, we also collect the public comments left on those posts, as described in "Public comments on an organization's own social posts" below. We import only content from the connected account's own posts; we do not scrape third-party accounts, and we never match likes, comments, or commenters to individual people or their records. Access tokens for connected accounts are encrypted at rest.

Usage, log, and device data. IP address, browser and device type, pages viewed, referring pages, timestamps, and similar diagnostic data, including aggregate analytics collected via Vercel Analytics.

Cookies and similar technologies. We use strictly necessary cookies to keep you signed in and to secure the Service. See Section 8.

We do not intentionally collect special categories of personal data, and we ask that organizations not collect them through the Service unless they have a lawful basis to do so.

Public comments on an organization's own social posts

For an organization that uses the Service (unless a platform administrator has turned comment capture off for it), we collect the public comments that people leave on that organization's own Instagram posts, through Instagram's official API and only for an account the organization has connected. We do this on the organization's behalf, as its processor. We do not collect comments from any other account, comments the organization has hidden on Instagram, or (currently) the text of LinkedIn comments.

What we collect. For each comment: its text, when it was posted, its like count, whether it replies to another comment, and the commenter's platform account identifier and (on Instagram) username. We do not collect commenters' names, profile pictures, profile details, follower lists, or direct messages.

Why. So the organization's administrators can review the public response to the organization's own posts and, if they choose, cite an included comment (one an administrator has not excluded or redacted) as evidence of public engagement in the organization's internal grant-reporting records.

What we never do with it. We do not match commenters to people, constituents, donors, members, or any other records. We do not build profiles of commenters, score or rank them, or analyze the sentiment of what they wrote. We do not use comment text for AI processing or advertising. We never reply to, hide, or delete comments on the platform, and we never post anything back.

Who can see it. Only the organization's owners and administrators, and our own platform administrators when providing support. Comment text and commenters' usernames are not shown to the organization's other members, are never published on the Service's public pages, feeds, or embeds, and are not included in exports. If an administrator cites a comment in a grant-reporting record, other members of the organization can see only that the record cites a public comment on one of the organization's posts, and when it was posted, never its text or who wrote it.

How long we keep it. Comments are kept while the organization's social connection and the post they belong to remain on the Service.

  • If a comment is deleted on the platform (or the organization hides it there), its text is removed from the Service the next time that post's comments are fully re-read. Its identifiers and the administrator's review decision remain. If the comment becomes visible again, it is captured again.
  • An administrator can permanently remove a comment's text (redaction). No hidden copy is kept.
  • An administrator can permanently delete everything captured from a particular commenter. So that later syncs do not capture that commenter again, we keep a one-way marker derived from their platform identifier (never their username or any comment text) for as long as the organization uses the Service.
  • When an organization removes our app's access from within Instagram, or asks Instagram to delete the data our app holds, we delete all captured comments and commenter records for that account. A data-deletion request also removes the organization's imported posts.
  • Grant-reporting records that cite an included comment never store its text, its username, or its platform identifiers. Administrators see the comment's current text only while it is still held as described above, so redaction, removal on the platform, or deletion at the commenter's request removes it from those records too. The record itself is then flagged for the organization's review.

Deletion requests. If you commented on an organization's post and want the data captured from your comments deleted, contact that organization, or email privacy@missionaligned.net and we will work with the organization to act on your request. Tell us the platform, the organization, and your username so we can find the data. We will never ask for your password.

3. How we use information

We use information to:

  • Provide, operate, secure, and maintain the Service;
  • Authenticate users and enforce tenant isolation and access controls;
  • Process constituent submissions, social imports, and (unless turned off for the organization) public comments on its own social posts, on behalf of Customer Organizations;
  • Count clicks on the links an organization places on its own website, in daily totals per link, so the organization can see how those links are used;
  • Provide optional AI-assisted features that an organization turns on — drafting and editing data-collection forms, explaining aggregate form results, and suggesting events from the organization's own social post captions — as described in Section 4;
  • Generate dashboards, analytics, and "Mission Pulse" signals for organizations about their own activity;
  • Communicate with administrators about their account, security, and Service updates;
  • Provide support and respond to requests;
  • Detect, prevent, and investigate fraud, abuse, and security incidents;
  • Comply with legal obligations and enforce our agreements.

For account data we control, our legal bases (where the GDPR or similar laws apply) are performance of a contract, our legitimate interests in operating and securing the Service, and compliance with legal obligations.

4. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We disclose information only as follows:

  • Within a Customer Organization's workspace. Content is visible to authorized members of that organization according to its roles and permissions.
  • With service providers (subprocessors). We use vetted vendors to host and run the Service, including Supabase (database, authentication, and storage), Vercel (application hosting, analytics, and the AI Gateway that relays AI requests), Anthropic (AI model processing for the optional AI-assisted features an organization turns on), and the Instagram/Meta and LinkedIn platform APIs for accounts an organization connects. These providers process data on our behalf under contractual confidentiality and security obligations. An AI-assisted feature sends only what it needs: an administrator's form-drafting instructions, the form being drafted or edited, and the program, activity type, or event the administrator chose for it; aggregate counts and percentages from form results, never free-text answers, names, contact details, or counts small enough to identify someone; or the caption of one of the organization's own social posts. AI-assisted features never receive public comments, commenters' data, or access tokens.
  • For public pages. Content an organization chooses to publish — such as a public organization page (`/o/...`), the network directory, or a public data-collection form — is intentionally visible to the public.
  • For legal and safety reasons. Where required by law, legal process, or to protect the rights, property, or safety of WithSocialAI, our customers, or the public.
  • In a business transfer. In connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

5. Data retention

We retain account and Customer Data for as long as an organization's account is active or as needed to provide the Service. The Service uses a two-stage deletion model: records are first soft-deleted (archived) and then hard-deleted with a snapshot retained in an archival store for a limited period to support recovery, audit, and legal obligations. When an organization ends its use of the Service, we will delete or return Customer Data in accordance with our agreement and applicable law, except where retention is required. Public comments captured from an organization's own social posts follow the rules in Section 2 and are not archived: when they are deleted, the deletion is permanent.

6. Security

We maintain administrative, technical, and organizational safeguards designed to protect information, including row-level security for tenant isolation, encryption in transit, encryption of sensitive secrets at rest, role-based access controls, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. International data transfers

The Service is operated from the United States, and information may be processed in the United States and other countries where we or our subprocessors operate. Where required, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses — for transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland.

8. Cookies

We use only strictly necessary cookies to provide secure authentication and to keep you signed in. We do not use advertising cookies. The feed and calendar embeds and the placed links that organizations put on their own websites set no cookies at all. Aggregate usage analytics are collected in a privacy-preserving manner via Vercel Analytics. You can control cookies through your browser settings, but disabling necessary cookies will prevent you from signing in.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, to object to certain processing, and to withdraw consent. Residents of the EEA, UK, and Switzerland have rights under the GDPR; California residents have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them.

  • For account data we control, contact us at privacy@missionaligned.net and we will respond as required by law. We will verify your identity before acting on a request.
  • For Customer Data held on behalf of a nonprofit (for example, your constituent submission to an organization), please contact that organization directly. As a processor / service provider, we will assist the organization in fulfilling your request.
  • If you commented on an organization's social post and that comment was captured, you can contact the organization or email privacy@missionaligned.net; we will work with the organization to delete the data captured from your comments.

We do not "sell" or "share" personal information as those terms are defined under the CCPA/CPRA.

10. Children's privacy

The Service is intended for nonprofit administrators and is not directed to children under 16. We do not knowingly collect personal information from children under 16 through accounts we control. If an organization uses the Service to collect information from minors, it is responsible for obtaining any required parental or guardian consent.

11. Third-party services and links

The Service integrates with and links to third-party platforms, including Instagram/Meta and LinkedIn. Your use of those platforms is governed by their own terms and privacy policies. We are not responsible for the practices of third parties.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, where appropriate, provide additional notice. Your continued use of the Service after an update constitutes acceptance of the revised policy.

13. Contact us

WithSocialAI Inc Operator of MissionAligned Connect Email: privacy@missionaligned.net

If you are in the EEA or UK and have an unresolved concern, you have the right to lodge a complaint with your local data protection authority.