Privacy Policy

1. Who we are and what this policy covers

This policy covers personal information we collect through:

• araceagainstblindness.org, including the Education Hub (/education), our blog, the Grants Portal (/grants), the Help Center and the Check Your Entries page;
• fundraiser.araceagainstblindness.org, our donation and fundraiser store, operated for us by Shopify;
• donor.araceagainstblindness.org, the donor portal where you check entries and update your contact information, and the Education Rewards portal where you can earn free entries;
• email, text messages, social media accounts we operate, phone calls, mail and events.

It does not cover websites we link to but do not operate, or the independent practices of companies such as Shopify, Meta or Google when they act on their own behalf; those are described in their own policies, which we link to in Section 16. Each fundraiser also has Official Rules that govern eligibility, entries and winner selection; where the Official Rules and this policy both speak to how we handle your information, this policy controls.

2. Information we collect

We do not knowingly collect precise geolocation, biometric data, government identification numbers (other than a winner's taxpayer identification number required by the IRS), or information about children under 13.

3. How we use information

We do not use your information to make automated decisions that have legal or similarly significant effects on you, and we do not use personal information to train artificial-intelligence models. Where a service provider uses AI features (for example, to draft a support reply), a person reviews the result before it reaches you.

If we want to use your information for a purpose that is not compatible with the one we collected it for (for example, using an email you gave us only for a research newsletter to solicit donations), we will ask for your consent first.

4. Cookies and tracking technologies

Our Cookie and Tracking Notice lists every cookie and tag we use. In summary:

• araceagainstblindness.org uses only essential cookies until you choose "Accept" on our consent banner. If you accept, we load Google Analytics 4, Google Ads measurement, Klaviyo and a Google Tag Manager container (through which our marketing agency manages the Meta pixel and similar advertising tags for us) on our public pages: the homepage, About pages, Fundraisers, Past Winners, Reviews, the Help Center and FAQ pages, our news and blog articles, our policy pages, the Education Hub landing page and the public Grants Portal information pages. We never load advertising or analytics tools on Education Hub condition, gene, clinical-trial, specialist, guide or search pages, or on sign-in, administrative or grant-application pages. Your choice is kept for 180 days and you can change it at any time from Your Privacy Choices.
• fundraiser.araceagainstblindness.org sets Shopify's essential cookies for your cart and checkout and shows a consent banner to visitors in the United States and Canada (and wherever else the law requires one). Advertising and analytics tags load only after you choose Accept; our page-testing tool, the Trustpilot review widget and the other functional features listed in the Cookie and Tracking Notice load with the page. You can change your choice from Your Privacy Choices.
• We treat the Global Privacy Control signal, and a browser Do Not Track setting, as a request to opt out of targeted advertising and the "sale" or "sharing" of your information on the browser and device sending it. This is our response to Do Not Track signals, disclosed as the California Online Privacy Protection Act describes.

5. How we share information

We share personal information only as described here.

Service providers working for us. Companies that host our sites, process payments, send our emails and texts, run our Help Center, authenticate donor sign-ins, administer sweepstakes, provide review widgets, and manage the advertising tags on our main site. They may use your information only to provide services to us and are bound by contract to protect it. Section 16 names them.

Advertising and analytics partners. On the fundraiser store, Meta (Facebook and Instagram), Google, TikTok and Snapchat receive information about your visit through pixels and cookies, and Google and Meta may receive hashed (scrambled) email addresses from Shopify so we can measure our ads. On araceagainstblindness.org, after you choose Accept, Google (Analytics, Ads and Tag Manager) and Meta receive information about your visit to our public pages; the advertising tags there run inside a Google Tag Manager container that our advertising agency manages on our instructions. These companies may use that information for their own purposes under their own policies. Several state laws call this a "sale," "sharing" or "targeted advertising." You can opt out at Your Privacy Choices. We do not run advertising pixels on health-education pages.

Sweepstakes administration. The independent sweepstakes administrator named in each fundraiser's Official Rules receives entry records for the fundraiser being drawn. Winners' names, city and state, and likeness are published as the Official Rules describe.

Shopify and Shop. Shopify processes checkout for us and also acts independently for its Shop app and Shop Pay. If you use Shop Pay or the Shop app, Shopify's Consumer Privacy Policy governs that use, and you can manage it at Shopify's Privacy Portal.

Research partners and grant reviewers. Grant applications are shared with our scientific reviewers and board under confidentiality obligations. We publish the names, institutions and project titles of funded researchers.

Legal, safety and corporate. We disclose information when the law requires it (for example, state sweepstakes regulators or the IRS for prize reporting), to protect the rights, safety and property of RAB, donors or others, to enforce our Terms of Use, and to a successor organization if RAB merges with or transfers its programs to another nonprofit.

With your direction. When you post a review, tag us on social media, or ask us to share something.

What we do not do. We do not sell personal information for money. We do not rent, trade, exchange or give donor, subscriber or participant lists to other nonprofits or businesses. We do not share your information with third parties for their own marketing except the advertising partners described above, which you can opt out of.

6. Health-related information

Because our mission is childhood blindness, people often tell us about a diagnosis. We treat any information that identifies your or a family member's health condition as consumer health data. Our separate Consumer Health Data Privacy Policy explains how we collect, use and share it, the consent we obtain, and your rights under Washington, Nevada and similar laws. In short: we collect it only when you give it to us for a purpose you asked for, we do not share it with advertising partners, we never sell it, and we do not use your reading of our condition pages to infer anything about your health.

7. Donations, sweepstakes and the donor portal

When you donate on the fundraiser store, Shopify collects your payment and contact details and sends us the order. Our Sweepstakes Entry Manager converts qualifying orders into entries under the fundraiser's Official Rules and keeps a record of every entry, including free alternate entries and entries earned through the Education Rewards portal. The donor portal shows you entries linked to your email address; if you paid with PayPal or Apple Pay, your entries may be linked to the email on that account. We keep an audit log of changes to your records so we can resolve disputes. Winners provide an affidavit, tax identification and, where applicable, publicity information under the Official Rules; prizes are reported to tax authorities as the law requires (in the United States, prizes of $2,000 or more are reported to the IRS on Form 1099-MISC).

8. Grant applicants and researchers

If you apply for research funding, we collect the information in your Letter of Inquiry and any full proposal, your CV and publications, and reviewer evaluations. We use it to make funding decisions, to administer awards, and to report on our grantmaking. Applications are confidential and shared only with reviewers, staff and board members bound by confidentiality. Unfunded applications are retained as described in Section 11 and then deleted or de-identified.

9. Email, text messages and other communications

We send transactional messages (receipts, entry confirmations, sign-in codes, winner notices) to anyone who donates or uses the portal. We send marketing email only to people who subscribed (or, for US residents, donated) and have not unsubscribed, and marketing text messages only to people who gave express written consent as described in our SMS and Mobile Messaging Terms. Every marketing email includes an unsubscribe link, which we honor within 10 business days (usually immediately). You can stop texts by replying STOP, or by any other reasonable means. Canadian residents: we send commercial electronic messages only with your express consent, identify RAB and our mailing address in every message, and honor unsubscribe requests within 10 business days, as Canada's Anti-Spam Legislation requires.

10. Children

Our sites are for adults. You must be 18 or older (or the age of majority where you live) to donate, enter a fundraiser, or open a portal account. We do not knowingly collect personal information from children under 13. Parents and guardians sometimes share information about a child's condition with us; we treat that information as described in Section 6. If you believe a child has given us personal information, contact us and we will delete it. We do not use information about anyone we know to be under 18 for targeted advertising, sale or profiling.

11. How long we keep information

We keep personal information only as long as we need it for the purposes above, then delete or de-identify it.

12. How we protect information

We use encryption in transit (TLS) and at rest, role-based access with multi-factor authentication for staff access to our main systems, one-time sign-in links and codes rather than passwords for the donor portal, bot protection on public forms, webhook signature verification between Shopify and our systems, and audit logging. Our major service providers publish SOC 2 or equivalent security attestations. No system is perfectly secure; if a breach affects your information we will notify you and regulators as the law requires.

13. Your privacy rights and choices

We extend the following rights to every resident of the United States and Canada, whether or not your state or province requires it. Residents of Colorado, Delaware, Maryland, Minnesota, New Jersey, Oregon and other states with privacy laws have these rights by statute.

• Access: confirm whether we process your information and receive a copy.
• Correction: fix inaccurate information. You can update your email and phone yourself in the donor portal.
• Deletion: ask us to delete your information. We may keep what the law requires us to keep (for example, donation records) and will tell you if so. Deleting your information means we can no longer contact you about fundraisers you have entered, including winner notifications.
• Portability: receive your information in a usable electronic format.
• List of third parties: receive the list of third parties to which we have disclosed your personal information (Oregon and Minnesota require this; we provide it to everyone).
• Opt out of targeted advertising and "sale" or "sharing": use Your Privacy Choices, enable Global Privacy Control, or write to us. We do not profile anyone in furtherance of decisions that produce legal or similarly significant effects, so there is nothing to opt out of there.
• Limit sensitive data: we ask for consent before processing health or other sensitive information and you can withdraw it at any time; see the Consumer Health Data Privacy Policy.
• Marketing: unsubscribe from email with the link in any message; stop texts by replying STOP; or ask us.

How to submit a request. Email privacy@araceagainstblindness.org, use the request form at araceagainstblindness.org/privacy-request, call 855-439-0122, or write to A Race Against Blindness, Attn: Privacy, 3317 S Higley Rd Ste 114-110, Gilbert, AZ 85297. An authorized agent may submit a request for you with your signed permission; we will confirm the request with you directly.

Verification. We verify requests by matching the information you provide to our records and, for donor-portal data, by sending a one-time code to the email on file. We never ask for a password or full payment card number.

Timing. We respond within 45 days. If we need more time we will tell you why and may take up to 45 more days. There is no charge.

Appeals. If we decline all or part of your request, we will explain why. You may appeal within 60 days by replying to our decision or emailing privacy@araceagainstblindness.org with "Appeal" in the subject line. We decide appeals within 45 days (60 days for Maryland residents) and explain the reasons in writing. If we deny your appeal, you may contact your state attorney general; we will give you the contact details in our response.

No discrimination. We will not deny you service, charge a different price, or treat you differently for exercising your rights.

State-specific notes. Maryland residents: this policy and the Your Privacy Choices page serve as your Maryland privacy notice and opt-out link. Nevada and Washington residents: see the Consumer Health Data Privacy Policy for your health-data rights. California residents: RAB is a nonprofit and is not a "business" under the California Consumer Privacy Act, but we honor the rights above for Californians, and this policy is intended to provide the disclosures described in the California Online Privacy Protection Act, including the Do Not Track response in Section 4.

14. Canadian residents

We collect, use and disclose personal information from Canadians with your consent and for the purposes described in this policy, and we store it in the United States, where it is subject to US law. Where Quebec law applies, we obtain your express consent before collecting sensitive information, and our Privacy Officer (the person in charge of the protection of personal information) can be reached at privacy@araceagainstblindness.org. You may request access to and correction of your information using the methods in Section 13, and you may complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec. Canadian residents' entries into our fundraisers are governed by the Official Rules, which include a no-purchase-necessary entry method and any skill-testing question Canadian law requires.

15. International transfers

RAB operates from Arizona and our service providers store information in the United States. If you access our sites from outside the United States, your information will be transferred to and processed in the United States. Our fundraisers are open only to residents of the United States and Canada; we do not target residents of other countries.

16. Service providers and partners we use

17. Links to other sites

Our sites link to research institutions, ClinicalTrials.gov, YouTube, social media and other sites we do not control. Their privacy practices are their own.

18. Changes to this policy

We review this policy at least once a year and whenever our practices or the law change. The "Last updated" date at the top shows the month and year of the latest change. If we make a material change to how we use information already collected, we will email registered donors and subscribers before the change takes effect and give you a chance to withdraw consent, and we will not apply the change retroactively to sensitive information without your consent. Earlier versions are available on request.

19. Contact us

A Race Against Blindness, Attn: Privacy · 3317 S Higley Rd Ste 114-110, Gilbert, AZ 85297, USA · privacy@araceagainstblindness.org · 855-439-0122 · araceagainstblindness.org/pages/help-center

A Race Against Blindness is an Arizona nonprofit corporation exempt from federal income tax under Section 501(c)(3), EIN 92-2174042.