Quorum is a board management platform for PTOs, nonprofits, HOAs, clubs, and similar groups. This policy explains what is public, what is private, and how we handle your data.

The following information may be visible to anyone on the internet without logging in:

• On Quorum's landing page: if you turn on Show our logo on Quorum, your logo appears in a cycling display of organizations that use Quorum.
• On your organization's public page: if you turn the public page on, visitors at your address see your org name, logo, mission statement, and the officer names, events, and documents you choose to show.
• Meeting agendas: when you share an agenda link with members, it is accessible to anyone with that link.
• Published meeting minutes: minutes you publish are accessible to anyone with the link. Written notes from a recording may be included. The recording itself is not.
• Sponsor banners: if your organization has active sponsors, their banner images and website links appear on public community pages by tier (org home, meeting agendas, campaign pages, and/or public calendar).
• Campaign donor pages: participant name, optional photo, campaign title, group, the organization’s donor message, progress, and supporter names, amounts, and optional notes on the public gift link.
• Volunteer sign-up pages: the event, shifts, and open spots are visible to anyone with the link. Other people's names, emails, and phone numbers are not shown.

The following is only accessible to authenticated board members and administrators:

• User account email addresses and passwords
• Budget lines, spending records, and financial data
• Reimbursement submissions and receipts
• Draft meeting content and unpublished minutes
• Meeting recordings. The audio stays with the board
• Annual officer statements and signed PDFs
• Sponsor contact information and pricing
• Volunteer rosters: names, emails, and phone numbers when the board asks for them

When an organization registers, we collect the org name (board display name), org type, EIN (optional at signup), and the admin's name and email. An EIN is required before Stripe Connect. You can add, change, or clear it under Settings → Payments when Stripe and Zeffy are disconnected. While either is linked, that EIN is locked until you disconnect. Board display name changes go through support. Additional information (logo, mission, officer roles, timezone, appearance) is optional in settings.

On EIN save, we look up IRS exempt-organization records via ProPublica Nonprofit Explorer and may store charity status and IRS legal name. After Stripe Connect, we may store Stripe account status, connected account id, company legal name Stripe returns, and whether a tax ID was provided (not the tax ID digits).

Board members invited by an admin provide their name and email. Reimbursement submitters provide their name, email, amount, description, and receipt files. Sponsors provide their business name, contact email, website, banner image, and selected tier. Campaign participants and leaders provide a name, email, and password for campaign access. Donors may pay via Stripe Checkout (email and billing details) or via Zeffy (donor details Zeffy sends in webhook events, including optional message answers). They may also leave an optional note shown on the campaign page. People who sign up to volunteer provide a name and email, and a phone number only if the board asks. We email a confirmation with a private cancel link, and a reminder the day before the shift, from Quorum Support via AWS SES.

When a local business sponsors an organization through Quorum, we collect business name, contact email, website URL, banner image, tier, and payment amount. This information is shared with the organization's board so they can review and approve the application.

Card payments for sponsorships and Stripe campaign gifts are processed by Stripe. Quorum does not store credit or debit card numbers. Stripe may collect billing details according to its own privacy policy. We retain payment status, amounts, and Stripe transaction identifiers for fulfillment, refunds, and records. We may prefill your organization's EIN and legal name into Stripe Connect Express.

For Zeffy campaign gifts, card data stays with Zeffy under Zeffy's policies. Quorum stores the organization's Zeffy webhook token and signing secret, and gift metadata from webhook deliveries (payment id, amount, donor name/email when provided, notes, and attribution fields).

For activity campaigns (such as reading rallies), we store participant and leader account details, optional participant photos, activity logs, fundraising goals, the organization’s donor message, and donation records (amount, optional donor name and note, email when provided, and Stripe or Zeffy identifiers).

Public donor pages may show the participant's name, photo, group, the organization’s donor message, progress, supporter names, gift amounts, and optional notes. Participant emails and passwords are not shown publicly. For Stripe gifts, donor receipt emails may be sent by Quorum via AWS SES from Quorum Support (quorum-support@makergully.com) when we have a donor email. Zeffy receipts, if any, are handled by Zeffy.

We use a single HttpOnly, Secure session cookie scoped to your organization's URL path to keep you signed in. It expires after 12 hours of inactivity. We do not use tracking or advertising cookies.

A board member who can edit minutes may record a meeting in the browser or upload an audio or video file, up to 90 minutes. They confirm that everyone at the meeting knew it was being recorded. The file is stored in AWS S3 and sent to Google Gemini to draft a note for each agenda item. Quorum does not keep a transcript.

An uploaded file is deleted from Quorum and from Gemini when the notes are ready. A recording made in the browser is the only copy, so Quorum keeps it until the minutes are published, then deletes it. A file that never finishes uploading expires after 7 days.

The audio stays private to the board. Published minutes may include the written notes. They do not include the recording.

Quorum is hosted on Amazon Web Services (AWS). Your data is stored in AWS DynamoDB and S3, both in the US East region. Authentication is handled by AWS Cognito. Email notifications are sent via AWS Simple Email Service from Quorum Support (quorum-support@makergully.com). Stripe processes sponsorship and Stripe campaign payments and Connect payouts. Zeffy processes Zeffy campaign gifts and sends webhook notifications to Quorum. ProPublica Nonprofit Explorer is queried to verify EIN charity status. Google Gemini drafts notes from a meeting recording the board chooses to send. We do not sell your data or share it with third parties beyond what is necessary to operate the service.

Organization administrators can turn the public page and the Quorum logo listing on or off in settings, and can remove the logo, mission statement, and officer information at any time. To change your board display name, or to request deletion of your organization's data, contact us at the address below.

Questions or requests regarding your privacy can be sent to:

quorum-support@makergully.com