Open Collective Privacy Policy

Last Updated: November 13th 2025

This Privacy Policy apply to your access to and use of the Open Collective Platform, accessible through opencollective.com and related domains, as well as other websites, applications, and online services (collectively, "the Platform" or "the Services"). The Platform is provided and operated by OFi Technologies LLC ("OFiTech", "we", "us", or "our"), a company 100% owned and controlled by Open Finance Consortium Inc., a Delaware 501(c)(6) nonprofit corporation ("OFi Consortium" or "OFiCo").

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of the policy and, in some cases, we may provide you with additional notice (such as adding a statement to our homepage or sending you a notification). We encourage you to review the Privacy Policy whenever you access the Services or otherwise interact with us to stay informed about our information practices and the ways you can help protect your privacy.

Data Controller

OFiTech is the data controller of your personal information. We are responsible for, and determine how your personal data is processed. If you have any questions about this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer at info@opencollective.com.

Collection of Information

Information You Provide to Us

We collect information you provide directly to us. For example, we collect information when you create an account, participate in any interactive features of the Services, fill out a form, make a payment, request customer support or otherwise communicate with us. The types of information we may collect include your name, email address, payment method information and any other information you choose to provide.

Information We Collect Automatically

When you access or use our Services, we automatically collect information about you, including:

Log Information: We collect log information about your use of the Services, including the type of browser you use, access times, pages viewed, your IP address and the page you visited before navigating to our Services.
Information Collected by Cookies and Other Tracking Technologies: We use various technologies to collect information, including cookies, local storage and web beacons. Cookies are small data files stored on your hard drive or in device memory that help us improve our Services and your experience, see which areas and features of our Services are popular and count visits. Local Storage similarly enables our Services to store data (like login tokens) securely in your browser and unlike cookies, it's not sent to the server on every request. Web beacons are electronic images that may be used in our Services or emails and help deliver cookies, count visits and understand usage and campaign effectiveness. For more information about cookies, and how to disable them, please see "Your Choices" below.

Information We Collect From Other Sources

We may also obtain information from other sources. For example, if you connect your account with an account you have with a third-party service (such as GitHub), we will have access to certain information from that service, such as your profile information, in accordance with the authorization procedures determined by that service. Additionally, we may collect information about you from third-party sources that help us to learn more about you, like for example your profile picture or social media handles.

Legal Basis for Processing

We process your personal information on the following legal bases:

Performance of Contract: Processing your information is necessary to provide the Services to you, such as creating an account, processing contributions, or handling expense reimbursements.
Legitimate Interest: We process your information for our legitimate business interests, such as improving our Services, understanding how our Services are used, preventing fraud, and marketing our Services.
Consent: In some cases, we process your information based on your consent, such as for certain types of marketing communications.
Legal Obligation: We may process your information to comply with our legal obligations, such as maintaining financial records for tax purposes.

Use of Information

We may use information about you for various purposes, including to:

Provide, maintain and improve our Services, and develop new products and services;
Provide and deliver the products and services you request;
Send you notices, updates, and support and administrative messages;
Communicate with you about products, services, offers, promotions, rewards, and events offered by OFiTech and others, and provide news and information we think will be of interest to you;
Monitor and analyze trends, usage and activities in connection with our Services;
Detect, investigate and prevent fraudulent transactions and other illegal activities and protect the rights and property of OFiTech and others;
Personalize and improve the Services and provide content or features that match user profiles or interests;
Facilitate contests, sweepstakes and promotions and process and deliver entries and rewards;
Link or combine with information we collect about you; and
Carry out any other purpose described to you at the time the information was collected.

We may share information about you as follows or as otherwise described in this Privacy Policy:

With hosts and organizers of a collective, if you are a contributor, or request reimbursement for expenses made in support, of that collective. The collective may use your information for the same purposes and under the same conditions as those outlined in this document. However, it remains solely and exclusively responsible for complying with its legal and declarative obligations in processing your personal data that it carries out by itself, with its own means, and for its own needs. We are only responsible for our use of your personal data, excluding any other uses made by the collective.
We will share your name and image with GitHub if you participate in a collective that is also working on a software project through GitHub;
With vendors, consultants and other service providers who need access to such information to carry out work on our behalf. If you submit a request to us, we will provide you with a list of the third-party service providers with which we have shared information about you for the 12 months prior to your request;
In response to a request for information if we believe disclosure is in accordance with, or required by, any applicable law, regulation or legal process;
If we believe your actions are inconsistent with our user agreements or policies, or to protect the rights, property and safety of OFiTech or others;
In connection with, or during negotiations of, any merger, sale of OFiTech assets, financing or acquisition of all or a portion of our business by another company;
With your consent or at your direction;
We may also share aggregated or de-identified information, which cannot reasonably be used to identify you.

Third-Party Service Providers

We work with third-party service providers to perform various operations related to our Services. These providers may have access to your personal information only to perform these tasks on our behalf and are obligated not to disclose or use it for other purposes. Our main third-party service providers include:

Stripe, PayPal, Wise: Payment processors that handle financial transactions. When you make a payment through our platform, your payment information is collected and processed directly by these providers according to their privacy policies.
Sentry: An error monitoring service that helps us identify and fix bugs in our applications. It may collect technical data related to errors encountered while using our Services.
Heroku: A cloud platform service where we host our applications. Your data may be stored on Heroku's servers as part of our service operations.
Cloudflare: A content delivery network and security service that helps us deliver our Services efficiently and securely. Cloudflare may process your IP address and other technical information when you access our Services.

Each of these providers maintains their own privacy policies that govern how they use, store, and process the data they receive. We encourage you to review these policies for more information about their practices.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Specifically:

Account information is retained for as long as your account remains active, plus a retention period after account closure for legal and accounting purposes
Financial transaction data is kept for at least 7 years to comply with tax and accounting requirements
Communication records may be retained for 2 years after your last interaction with us

In some circumstances we may anonymize your personal information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Depending on your location, you may have certain rights regarding your personal information. These may include:

Right to Access: You have the right to request a copy of the personal information we hold about you.
Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.
Right to Erasure (Right to be Forgotten): You have the right to request that we delete your personal information in certain circumstances.
Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal information in certain circumstances.
Right to Data Portability: You have the right to request that we transfer the personal information we hold about you to another organization, or directly to you, in certain circumstances.
Right to Object: You have the right to object to the processing of your personal information in certain circumstances.
Rights Related to Automated Decision Making and Profiling: You have rights related to how we use automated decision-making and profiling.
Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. If you are in the European Economic Area (EEA), you can find your national data protection authority on the European Data Protection Board website (https://edpb.europa.eu).

If you are unhappy with your information being processed, shared or stored in line with the content of this policy please email [email protected] and we will work to address your concerns. Note that in order to maintain our accounting, tax and legal obligations we may be required to retain some private information about you even after processing a deletion request.

To exercise any of these rights, please contact us as described in the "Contact Us" section below. Please note that we may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions.

The Services may offer social sharing features and other integrated tools, which let you share actions you take on our Services with other media, and vice versa. Your use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the entity that provides the social sharing feature. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy policies of the entities that provide these features.

Analytics Services Provided by Others

We engage other companies to provide analytics services via the Services. These companies may use cookies, web beacons, device identifiers and other technologies to collect information about your use of the Services and other websites and applications, including your IP address, web browser, mobile network information, pages viewed, time spent on pages or in apps, links clicked and conversion information. This information may be used by OFiTech and others to, among other things, analyze and track data, determine the popularity of certain content, and better understand how our services are being used.

Security

OFiTech takes reasonable measures to help protect information about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. These measures include encryption of personal data where appropriate, and regular review of our information collection, storage and processing practices.

International Data Transfers

OFiTech is based in the United States and the information we collect is governed by U.S. law. When we transfer personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States or other countries which have not been determined by the European Commission to have laws that provide an adequate level of data protection, we use legal mechanisms designed to help ensure your rights and protections, including:

Standard Contractual Clauses approved by the European Commission
Obtaining your explicit consent for certain types of processing

By accessing or using the Services or otherwise providing information to us, you understand that your information will be processed as described in this Privacy Policy.

Your Choices

Account Information

You may update the profile information you provide by logging into your online account. You may also request that we delete your account by contacting us at info@opencollective.com.

Cookies

Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject browser cookies. Please note that if you choose to remove or reject cookies, this could affect the availability and functionality of our Services.

Promotional Communications

You may opt out of receiving promotional or notification emails from OFiTech by following the instructions in those emails. If you opt out, we may still send you non-promotional emails, such as those about your account or our ongoing business relations.

Do Not Track

Some browsers offer a "Do Not Track" ("DNT") signal where you can indicate your preference regarding tracking and cross-site tracking. Although we do not currently employ technology that recognizes DNT signals, we will only process your personal data in accordance with this Privacy Policy.

Automated Decision Making

We do not use automated decision-making processes that would produce legal effects concerning you or significantly affect you. If in the future we employ such processes, we will provide you with information about the logic involved, as well as the significance and potential consequences of such processing.

Children's Privacy

Our Services are not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. If you are under 18, please do not provide any personal information to us. If you believe that a child under the age of 18 has provided us with personal information, please contact us at info@opencollective.com.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the new Privacy Policy on this page and change the date at the top. We encourage you to review the Privacy Policy whenever you access the Services to stay informed about our privacy practices and the ways you can help protect your privacy. If we make material changes to how we treat our users' personal information, we will notify you through an email.

Contact Us

If you have any questions about this Privacy Policy, or to exercise your rights regarding your personal data, please contact us at:

Email: [email protected]
Mail: OFi Technologies LLC, 440 N Barranca Ave #3489, Covina, CA 91723, USA
Data Protection Officer: Benjamin Piouffle, [email protected]