Last updated: September 18, 2026

Privacy Policy

GIK Marketplace ("GIK", "we", "us") respects your privacy. This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. It covers our public website at gik.org and the GIK Marketplace application at app.gik.org (together, the "Services"). If you do not agree with this policy, please do not use the Services.

1. Who We Are

GIK Marketplace is a gifts-in-kind platform based in Michigan, United States. GIK is the entity responsible for (and, where the term applies, the "controller" of) the personal information described in this policy. You can reach us any time at info@gik.org.

2. What This Policy Covers

This policy applies to both of our properties:

• gik.org — our public website, which anyone can browse without an account.
• app.gik.org — the GIK Marketplace application, where verified corporate suppliers and nonprofit organizations list surplus resources, post needs, make and accept offers, and coordinate the delivery of gifts in kind.

This policy does not cover third-party websites we link to, or the independent privacy practices of the organizations you interact with through the Marketplace. Each organization using the Marketplace is responsible for how it handles information it receives through the Services.

3. Information We Collect on gik.org

You can read our website without giving us any personal information. We collect the following:

• Newsletter signups: The email address you enter in our subscribe form. Your address is passed to MailerLite, which operates our mailing list.
• Technical and usage data: IP address, browser and device information, pages viewed, referring page, and approximate (city- or region-level) location derived from IP. Some of this is recorded in ordinary server logs by our host; the rest comes from analytics, which run only if you accept analytics cookies. See Cookies and Similar Technologies below.
• Messages you send us: Anything you include when you email us or contact a GIK representative.
• Webinar registrations: When you sign up for a webinar through Livestorm we receive the registrant lists.

4. Information We Collect on app.gik.org

The Marketplace is an account-based service used on behalf of an organization. We collect:

• Account and profile information: Your name, email address, profile photo, role or job title, optional phone number, and your organization affiliation. If you sign in with Google, we receive a limited profile from Google instead of a password — see Section 8.
• Organization information: Organization name, type, location and service area, identifiers such as an EIN or registration number, the documentation you provide during vetting and verification, your member roster and each member's role, and pending invitations.
• Marketplace content: Resource listings, posted needs, offers, orders, quantities, categories, descriptions, photographs, and the disaster or program a request relates to.
• Logistics and fulfillment details: Pickup and delivery addresses, site and warehouse contact names and phone numbers, shipping and freight arrangements, tracking and delivery confirmations, and the timestamps of each step.
• Communications: Messages you exchange with other organizations through in-app chat (processed by Stream Chat), notifications, support requests, and — where your organization has configured a forwarding inbox — email sent to that address.
• Usage and technical data: IP address, device and browser information, authentication events, and application logs and diagnostics collected through our hosting providers.

Some of the information you enter is about other people — for example, a warehouse contact's name and mobile number. You are responsible for having a lawful basis to share that information with us and with the organization on the other side of a transaction.

5. Information We Do Not Collect

We do not currently collect payment card or bank account details through the Services; gifts in kind are donated rather than purchased on the platform. We do not ask for Social Security numbers, government ID numbers, health information, or other sensitive categories of personal data, and we ask that you not upload them. We do not buy personal information from data brokers, and we do not run advertising on the Services.

6. How We Use Information

We use the information we collect to:

• Provide and operate the Services and match posted needs with available resources.
• Create and authenticate accounts, verify organizations, and manage member access and permissions.
• Coordinate the pickup, shipment, and delivery of gifts in kind between organizations.
• Send transactional messages such as invitations, offer and order status updates, and security alerts.
• Send our newsletter, if you asked for it.
• Respond to support requests and gather feedback.
• Understand how the Services are used so we can improve them, and produce aggregate or de-identified statistics about the impact of the program.
• Protect the Services against fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms of Use.

We do not use your personal information to train third-party artificial intelligence models, and we do not make decisions producing legal or similarly significant effects about you by automated means alone.

7. Cookies and Similar Technologies

We use a small number of cookies and similar browser technologies, in five groups:

• Strictly necessary: On app.gik.org, cookies and browser storage that keep you signed in, secure your session, and route your requests. These are required for the application to work and are not optional.
• Your cookie choice: When you accept or reject analytics on gik.org, we record that decision in your browser's local storage so we do not have to ask again. If you choose to load an embedded feature, such as the scheduler on our Schedule a Demo page, we record that in the same way so it is ready on your next visit. Both records last about twelve months, after which we ask you once more, and selecting "Reject All" clears them.
• Analytics (consent-based): Google Tag Manager and Google Analytics. These load only after you select "Accept All" on our cookie banner; if you reject or ignore the banner, no Google Analytics tag is loaded at all. When enabled, they collect a pseudonymous identifier, pages viewed, referral source, browser and device information, approximate location derived from IP, and session data. We use this to understand which parts of our site are useful and where visitors get stuck.
• Cookieless measurement: Vercel Web Analytics counts page views in aggregate. It sets no cookie, creates no persistent identifier, and does not track you across other websites.
• Embedded features (consent-based): Our Schedule a Demo page offers a booking calendar hosted by Calendly, which sets its own cookies and browser storage. Nothing from Calendly loads until you allow it — either by selecting "Accept All" on our cookie banner, which covers embedded features as well as analytics, or, if you declined analytics, by selecting "Load the scheduler" on the page itself. Once loaded, Calendly receives your IP address, browser and device information, and anything you enter to book a meeting, and handles it under its own privacy notice.

You can change your decision at any time using the button below, by clicking Cookie Preferences in the footer of any page on gik.org, or by clearing your browser's site data. Browsers also let you block or delete cookies directly; blocking strictly necessary cookies will prevent you from signing in to the Marketplace. We do not currently respond to "Do Not Track" browser signals, instead we offer the cookie banner. Since we do not share or sell personal information, there is nothing for a Global Privacy Control to opt out of.

Change your cookie settings

8. Third-Party Sign-In Providers

When you sign in to the Marketplace using a third-party authentication provider such as Google, the provider shares a limited set of profile information with us based on the OAuth scopes you authorize. For Google Sign-In, this is limited to your basic profile information: your name, email address, profile picture, locale, and Google account identifier.

We use this information solely to:

• Create or look up your GIK account.
• Pre-fill your profile (display name, avatar) so you can finish onboarding more quickly.
• Authenticate subsequent sign-ins and keep your session secure.

We do not request any restricted or sensitive Google API scopes, and we do not access, read, or store your Gmail messages, Google Drive files, contacts, calendar, or any other Google service data. The information GIK receives from Google Sign-In is used only as described in this Privacy Policy and is not sold or transferred to third parties for advertising or any unrelated purpose. You can revoke the Service's access to your Google account at any time from your Google Account permissions page at https://myaccount.google.com/permissions.

9. How We Share Information

• Other organizations on the Marketplace: The Marketplace works by connecting organizations. When your organization posts a need, publishes a listing, makes an offer, or takes part in an order, the relevant details — including the contact and address information needed to arrange pickup and delivery — are shared with the organization on the other side of that transaction.
• Within your own organization: Administrators of your organization can see its member roster, invitations, listings, offers, orders, and related activity.
• Service providers: Vendors that process data on our behalf under written agreements, listed in Section 10.
• Legal compliance and safety: Where required by law, court order, or government request, or where necessary to investigate abuse, enforce our Terms of Use, or protect the rights and safety of people using the Services.
• Organizational changes: If GIK is involved in a merger, acquisition, reorganization, or transfer of program assets, information may be transferred as part of that transaction. We will give notice before your information becomes subject to a materially different privacy policy.
• Aggregate and de-identified data: We publish and share statistics about the program — such as goods moved or organizations served — that do not identify any individual.
• No sale or targeted advertising: We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have not done either in the preceding twelve months.

10. Service Providers We Use

• Vercel — hosting for gik.org and its APIs, plus cookieless page-view measurement.
• Supabase — database, authentication, and file storage for the Marketplace.
• Stream Chat — in-app messaging between organizations.
• Google — Sign-In, Tag Manager and Analytics (only with your consent).
• MailerLite — newsletter list management, and delivery of our email, including invitations, notifications, and account messages.
• Livestorm - webinar management and registration.
• Calendly — meeting scheduling, loaded only when you ask for it on our Schedule a Demo page.

These providers are permitted to use personal information only to perform services for us, and are subject to the confidentiality and data-protection commitments in their terms.

11. Data Retention

We keep personal information only as long as we need it:

• Account and profile data — for as long as your account is active, and for a reasonable period afterward to handle disputes and account recovery.
• Marketplace transaction records — including offers, orders, and delivery confirmations, for as long as required for donation substantiation, audit, grant reporting, and other recordkeeping. These records may outlive your individual account, though we minimize the personal details they retain.
• Chat messages and support correspondence — for as long as needed to operate the Service and resolve issues.
• Newsletter subscription — until you unsubscribe, plus a suppression record so we do not email you again.
• Analytics data — according to the retention period configured in Google Analytics, after which it is deleted or aggregated.

When you delete your account, we remove or anonymize your personal information within a reasonable period, except where retention is required by law or for the records described above.

12. Security

We employ administrative, technical, and physical safeguards to protect personal information, including role-based access controls, row-level authorization in our database, encryption in transit, restricted administrative access, and monitoring of our hosted infrastructure. No system can guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

13. Your Privacy Rights

Everyone who uses the Services can:

• Update your profile or organization settings from within the Marketplace.
• Request access to, correction of, or deletion of your personal information by emailing info@gik.org.
• Unsubscribe from the newsletter using the link in any newsletter email, and manage notification preferences in the Marketplace.
• Change your cookie choice using the button in Cookies and Similar Technologies above, or the Cookie Preferences link in the footer of any page.
• Deactivate your account by contacting GIK support.
• Revoke a third-party sign-in provider's access from that provider's account settings.

U.S. state privacy rights. Depending on your state of residence, you may also have the right to confirm whether we process your personal information; to access, correct, or delete it; to obtain a portable copy; to opt out of sale, targeted advertising, and certain profiling (which we do not engage in); and to appeal a decision on a rights request. To exercise these rights, contact us at info@gik.org. We will verify your request using information associated with your account before responding, and we will respond within the time your state requires (typically 45 days, extendable once where permitted). If we deny a request, you may appeal by replying to our denial email with "Appeal" in the subject line. You will not receive discriminatory treatment for exercising any privacy right. An authorized agent may submit a request on your behalf with proof of authorization.

14. Children's Privacy

The Services are intended for use by adults acting on behalf of an organization. They are not directed to children under 18, and we do not knowingly collect personal information from children. If we learn that a child has provided personal data, we will delete it promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above, and we will give reasonable advance notice of material changes by email or through the Services. Continued use of the Services after the effective date constitutes acceptance of the updated policy.

16. Contact Us

For questions, requests, or complaints regarding this Privacy Policy or your personal information, email us at info@gik.org or contact your GIK representative. We will acknowledge your message and respond within the timeframes described above.

You can also write to us at:

GIK Marketplace
3755 36th St SE
Grand Rapids, MI 49512
United States