Donor data privacy — good practices

Donors trust you with their names, contact details, and giving history. Keeping that trust is partly Pledgix's job and partly yours — here's where the line runs, and the habits that keep you on the right side of it.

What Pledgix protects automatically

• Role-based access. Campaign Owners and Managers see the full Profile Center. Captains and Team Members see a team-fenced slice: only the profiles assigned to their team — including those profiles' notes and asks — and nothing beyond it. Importing and bulk operations require the Manager level or above. Keep this in mind when you assign profiles to a team: assignment is also a grant of visibility.
• Public anonymity is respected. Donors who choose to give anonymously are hidden on the public page and feed. Their identity is visible to you internally — you need it for receipts and records — but it must never leave your team.
• Do-not-call enforcement. Every push to the Call Center is checked against opt-out lists automatically, including a platform-wide do-not-call registry. Anyone who texts STOP to a Pledgix number lands on that platform-wide list instantly. This protection can't be bypassed from the Profile Center.
• AI with minimal data. AI call briefings never receive the contact or payment fields stored on a profile — no email address, phone number, mailing address, or payment details. Note snippets are automatically scrubbed of email addresses and phone-number-like digit sequences first, but other personal details typed into free text (a street address in a note, say) aren't caught — one more reason to keep contact details out of notes.
• Aggregated maps. The War Room's geographic view only shows areas with several donors grouped together — no individual's location is ever plottable.
• No card numbers, ever. Payment details are handled by the payment processors; full card numbers are never visible in the Profile Center or in exports.

What only your team can protect

Notes

Notes are powerful precisely because they're candid — which is why they deserve care. Write what helps the next caller; skip health details, family conflicts, or anything you wouldn't say in a team meeting. Notes are internal, but they're not private to you: every current and future manager can read them, and captains and team members can read the notes on profiles assigned to their team.

Imports

Only upload lists you have a legitimate basis to use. A community roster shared for one purpose shouldn't quietly become a solicitation list for another. When someone asks to be removed, honor it: remove them and note the request so they aren't re-imported from an old file later.

Exports

Exports are where data most often escapes. Donation spreadsheets, gap-analysis CSVs, and call sheets all contain contact details and internal notes:

• Share them only with the specific people who need them, ideally through a private channel rather than a group chat.
• Collect printed call sheets back at the end of a phone night and shred them.
• Delete downloaded files when the task is done — the live data stays in Pledgix; the stale copy on a laptop is pure risk.

Team membership

Access follows roles, so review yours each season. When a volunteer manager moves on, remove them from the campaign — offboarding is a privacy control, not just housekeeping. See "Adding and removing team members."

A simple seasonal checklist

1. Review who holds Owner and Manager roles; remove anyone who no longer needs access.
2. Delete old export files and shred leftover call sheets.
3. Skim your tags and notes for anything that shouldn't be there.
4. Honor every removal request — and record it in a note.

Tip: The best privacy rule of thumb: collect what you'd be comfortable explaining, write what you'd be comfortable reading aloud, and export only what you'd be comfortable losing track of — then don't lose track of it.