Privacy Policy
Share
This Privacy Policy explains how Curastem ("Curastem," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with curastem.org and donations processed through that site.
Curastem is a U.S. Internal Revenue Code section 501(c)(3) nonprofit organization. Employer Identification Number (EIN): 39-2326761. Mailing address: 4958 Sereno Drive, Temple City, CA 91780, United States.
By using curastem.org, you acknowledge this Policy. If you do not agree, do not use the site or donate through it. This Policy is part of our Terms of Use at curastem.org/terms-of-use.
Effective date: August 25, 2026. Last updated: August 25, 2026.
Scope of this Policy
1. What this Policy covers
This Policy covers personal information we process as a controller (or "business" under California law) when you visit curastem.org, email us, or make a donation using the Donate control on curastem.org (including Stripe Checkout pages we link to from this site).
curastem.org is an informational site about the organization, our mission, programs, and how to contact or support us. We do not create user accounts on curastem.org. There is no login, profile, job board, chat product, or paid subscription checkout on this domain.
2. What this Policy does not cover
We also operate a separate website that helps people search and apply to jobs. That website, any mobile or embedded versions of it, APIs, employer tools, and related product features have their own terms and privacy notices. Information you submit there is collected and used under those notices, not under this Policy, except where this Policy says we receive donation or contact data from this site.
This Policy also does not cover websites we do not control, including Stripe’s own pages, email providers, or any third-party site you reach from a link. Those operators have their own policies.
Personal information we collect
3. Categories of personal information
"Personal information" means information that identifies, relates to, describes, or could reasonably be linked with you. Depending on how you interact with us, we may collect:
Identifiers and contact information
Name, email address, postal address (if you provide it), phone number (if you provide it), and similar identifiers. If you email hello@curastem.org, we process whatever you include in that message.
Donation and transaction information
If you donate, Stripe, Inc. and its affiliates ("Stripe") process your payment. We may receive confirmation details such as donation amount, currency, date and time, transaction or payment intent identifiers, payment method type (for example, card or wallet), last four digits of a card, billing country, and the name and email you enter at checkout. We do not receive or store your full card number or CVC. Stripe’s processing of payment credentials is described in Stripe’s own documentation and privacy notice.
Tax receipt information
We use donation details to send a receipt (typically PDF by email) and to keep records required for nonprofit accounting, audit, and tax reporting. Receipts may include your name, email, amount, date, our EIN, and our legal name.
Internet and device information
IP address, approximate location derived from IP (city/region/country level, not precise GPS unless you separately grant it to a third party), browser type and version, device type, operating system, language, referring URL, pages viewed on curastem.org, timestamps, and diagnostic or security logs.
Information collected by our hosting and security provider (Cloudflare) as part of delivering the site, stopping abuse, and operating a content delivery network.
Communications
The content of emails, letters, or other messages you send us, and our replies. If you ask a question about privacy, we keep that correspondence as needed to respond and document the request.
Information we do not intentionally collect on this site
We do not ask curastem.org visitors for Social Security numbers, precise geolocation, biometric identifiers, account passwords, resumes, or job-application answers on this domain. Do not send sensitive government ID numbers by unencrypted email unless we specifically request a secure channel.
4. Sources of personal information
Directly from you (forms you complete on Stripe Checkout, emails, mail).
Automatically from your device when you load curastem.org.
From service providers that process donations or host the site, such as Stripe and Cloudflare, when they share records needed to complete a gift, send a receipt, prevent fraud, or keep the site online.
How we use personal information
5. Purposes
We use personal information to:
Operate, maintain, secure, and improve curastem.org.
Respond to inquiries sent to hello@curastem.org or our mailing address.
Process voluntary donations, prevent fraud and failed or abusive payments, and issue acknowledgments and tax receipts.
Keep books and records, prepare filings, and comply with nonprofit, tax, accounting, and charity-registration rules.
Detect, investigate, and prevent security incidents, spam, and misuse of the site.
Establish, exercise, or defend legal claims, and cooperate with lawful requests from authorities.
Understand aggregate traffic (for example, whether pages load) at a level that does not require a profile of you, using server logs.
We do not use curastem.org to serve interest-based advertising, to build a marketing profile for sale, or to run a login-based product on this domain.
6. Legal bases (EEA, UK, and similar laws)
Where a legal basis is required, we rely on:
Legitimate interests: running a public nonprofit website, securing it, answering mail, and understanding whether the site works, in ways that do not override your rights.
Contract or steps prior to a contract: not typical on this site because we do not sell a product here. Completing a donation you request is processed as a gift, not as a purchase of services.
Consent: where we ask for it and the law requires it. You may withdraw consent without affecting processing that occurred before withdrawal.
Legal obligation: recordkeeping, tax, charity, and responding to valid legal process.
How we disclose personal information
7. Recipients
We disclose personal information only as needed:
Stripe, to process donations and related fraud prevention. Payment card data is handled by Stripe, not stored on Curastem servers.
Cloudflare, to host, cache, and protect curastem.org. Cloudflare may process IP addresses and request metadata as a processor or similar service provider.
Email and document tools we use to send receipts or reply to you (acting on our instructions).
Professional advisers (accountants, attorneys, auditors) under confidentiality, when needed for the organization.
Regulators, courts, or law enforcement when required by law, or when we believe in good faith disclosure is necessary to protect rights, safety, or the organization.
A successor organization in a merger, asset transfer, or similar nonprofit reorganization, limited to what is needed to continue the mission, subject to this Policy or a successor notice.
8. Sale and sharing (California and similar U.S. state laws)
We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising on curastem.org. We do not use third-party advertising pixels, Google Ads tags, or Microsoft Clarity on curastem.org.
If that practice changes, we will update this Policy before we start, and California residents will have a way to opt out of sale or sharing as required by the California Consumer Privacy Act (CCPA) as amended by the CPRA.
We do not knowingly sell or share personal information of consumers under 16.
9. No third-party advertising on this site
curastem.org is not funded by display ads on this domain. Donate is a gift to the nonprofit. It is not payment for a consumer product subscription.
Cookies and similar technologies
10. What we use
The site may set strictly necessary cookies or similar storage for security, load balancing, and basic site function (including cookies set by Cloudflare). These are not used to advertise to you on other sites.
Your browser may also send a Do Not Track signal. There is no consistent industry standard for responding to DNT on informational sites. We do not use DNT to change a behavioral advertising profile because we do not run one here.
You can block cookies in your browser. Blocking all cookies may affect whether the site or Checkout loads correctly.
Retention, security, and transfers
11. How long we keep information
We keep personal information only as long as reasonably needed for the purposes above, including:
Donation and receipt records: generally at least as long as nonprofit tax and accounting rules require (often several years after the gift). We may keep them longer if there is an audit, dispute, or legal hold.
Email correspondence: for as long as needed to complete your request and for a reasonable archive period, then deletion or secure destruction according to our record schedule.
Server and security logs: typically weeks to months, unless needed longer for security investigations.
12. Security
We use reasonable administrative, technical, and organizational measures appropriate to a small nonprofit website, including HTTPS, hosting with a major provider, and limiting who can access donation reports. No method of transmission or storage is completely secure. You use the internet at your own risk.
13. International transfers
We are based in the United States. If you visit from another country, your information is processed in the United States and possibly other countries where our providers operate. Those countries may not have the same data-protection laws as your home country. Where required, we use appropriate safeguards offered by our providers.
Your rights and choices
14. Requests we honor
Subject to verification and legal exceptions, you may request to:
Know / access the personal information we hold about you from this site and donations.
Correct inaccurate personal information.
Delete personal information, except where we must keep it (for example, completed donation records required by tax law).
Obtain a portable copy of information you provided, where applicable.
Opt out of sale or sharing, if we ever engage in that activity (we do not currently).
Limit use of sensitive personal information, if we collect it (we do not seek it on this site).
Appeal a denial, by replying to our decision email.
Not be discriminated against for exercising privacy rights under the CCPA.
To submit a request, email hello@curastem.org with the subject line "Privacy request" and enough detail for us to find your information (for example, the email used at donation). We may need to verify your identity. An authorized agent may submit a request where the law allows, with proof of authorization.
EEA and UK residents may also lodge a complaint with their local data protection authority. California residents may contact the California Attorney General. We will not require you to create an account on curastem.org to make a request.
15. Children
curastem.org is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected such information, email hello@curastem.org and we will delete it as required. If you are in the EEA, UK, or Switzerland, you must meet the minimum digital-consent age in your country (often 16) to donate or submit personal information without a parent or guardian.
16. Automated decision-making
We do not use automated processing on curastem.org to make decisions that produce legal or similarly significant effects about you (for example, we do not use this site to decide eligibility for a job).
Other notices
17. Changes to this Policy
We may update this Policy. The "Last updated" date will change. Material changes will be posted on this page. Continued use of curastem.org after a posting means you accept the updated Policy, except where the law requires consent.
18. Contact
Privacy and data-protection contact for this website:
Email: hello@curastem.org
Mail: Curastem, 4958 Sereno Drive, Temple City, CA 91780, USA
Donate: Donate. Questions about a Stripe charge should start with us. Card networks may also have their own dispute process.