Privacy policy

Who we are

OpenBibs is operated by Quixta Ventures LLP, a limited liability partnership registered in India, which is responsible for your personal data. We are based in Bengaluru, Karnataka, India. Email support@openbibs.com with any privacy question or request.

What we collect

When you sign up for alerts (runners). Your email address, the races you picked, your maximum fundraising amount, and when you signed up, confirmed or unsubscribed.

When a charity signs in. The email address you sign in with. Sign-in uses a one-time link, so we don't store a password.

Charity profile and listings. Your charity's name, website, registration number, description and logo, which are public. A contact email, which we never show publicly. Your listings (race, spots, fundraising minimum, deadline, apply link, requirements and perks), which are public once approved, and our review notes, which aren't.

Payments (charities). Stripe handles card details; we never see or store your card number. We keep a record of what you bought, the amount, the date and the Stripe payment reference.

Apply clicks. When you click Apply, we log which listing was clicked, when, and where on OpenBibs it came from, so charities can see how many runners we send them. If you accepted cookies, the log also includes a random session id and the campaign tags (such as utm_source) from the link that brought you here.

Usage events on our servers. Whatever you choose in the cookie banner, our servers record a few events without cookies so we can run and improve OpenBibs: an apply click (listing, race and the page it came from), an alert confirmation (which races), and, for charities, sign-up, listing submission and approval. These go to PostHog, our analytics provider. They don't include your email address, and for runners they aren't linked to you unless you accepted cookies.

Analytics and ads, only if you accept cookies. Pages viewed and product events in PostHog (session recordings mask everything you type), and conversion events to Google Ads, Meta and TikTok, such as an apply click or an alert sign-up. See the cookie policy.

Spam protection and rate limits. When you submit a form, Cloudflare Turnstile checks you're not a bot, and we count requests by IP address and email address for up to an hour to stop abuse.

Emails you send us. If you email support@openbibs.com, we keep the conversation.

We don't collect phone numbers. We don't collect sensitive personal information as US state laws define it (such as government ID numbers, account logins, precise location, health, biometric or financial details), so we don't use any for other purposes.

Why we use it, and the legal basis

• Alert emails: because you asked for them and confirmed by email (consent). You can withdraw any time by unsubscribing.
• Charity accounts, listings and payments: to provide the service you signed up for (contract), and to keep tax and accounting records (legal obligation).
• Apply-click counts and server usage events: to show charities the board works, keep OpenBibs running and improve it (our legitimate interests). They carry no cookies and as little detail as we need.
• Analytics cookies and ad measurement: only with your consent.
• Spam protection and rate limits: to keep OpenBibs safe (legitimate interests).

The legal bases matter mainly if you're in the UK or the European Union.

Who we share it with

• The public: charity profiles and approved listings. Never a charity's contact email, and never anything about runners.
• Charities: counts of views and apply clicks for their own listings. Never your email address or anything that identifies you. When you apply, you give your details to the charity on its own website, under its own privacy policy.
• Service providers who process data for us, under contracts that limit what they can do with it:

• The law: if we must, to comply with the law or protect people's safety or our rights.
• A buyer: if OpenBibs is sold or reorganised, the new owner takes over this policy.

Selling and sharing

We never sell your data for money. If you accept cookies, ad networks such as Google, Meta and TikTok receive information about your visit. Some US state laws call that "selling" or "sharing" personal data for targeted advertising. You can say no in the cookie banner, and we treat a Global Privacy Control signal from your browser as a no.

Your privacy choices

• Cookies: click "Cookie settings" in the footer at any time to accept or refuse analytics and ad cookies. Refusing after you accepted stops analytics and ads straight away and removes our own campaign and session cookies.
• Global Privacy Control: if your browser sends it, we treat it as "No thanks". No ad or analytics cookies are set, and no ad network receives your visit.
• Alerts: every alert email has a one-click unsubscribe link.
• Your data: email support@openbibs.com to ask what we hold about you, or to correct or delete it.

Your rights

Everyone, wherever you live in the US. Some US states (such as California, Colorado, Connecticut, Virginia, Oregon and Texas) give residents privacy rights. We give them to everyone: you can ask to know and get a copy of the personal data we hold about you, correct it, delete it, and opt out of targeted advertising and of any "sale" or "sharing". We won't treat you differently for asking. Email support@openbibs.com from the address the request is about, so we can check it's you. We reply within 45 days, and if we need more time (up to 45 more days where the law allows), we tell you why. You can also ask for your data in a common, machine-readable format.

If we say no, we tell you why, and you can appeal by replying to our answer. We respond within 45 days of your appeal. If we still say no, you can contact the Attorney General of your state.

You can use an authorised agent. We may ask the agent for your signed permission and ask you to confirm your identity directly with us. We won't charge you more, give you a worse service or otherwise treat you differently for using these rights.

California categories. In the last 12 months we collected identifiers (email address, hashed or raw IP address for rate limits, a random session id with consent), commercial information (charities' purchases), internet activity (apply clicks and, with consent, pages viewed) and the profile and listing details charities enter. We disclosed them to the service providers above for business purposes and, only if you accepted cookies, visit information to ad networks. We don't knowingly sell or share the personal information of anyone under 16.

UK and European Union. You also have the right to object to processing based on legitimate interests, to restrict processing, to data portability, and to complain to your data protection authority.

How long we keep it

Where your data is

Quixta Ventures LLP is based in India, and our team accesses OpenBibs data from India. Our service providers store data mainly in the United States. By using OpenBibs, your data is transferred to and handled in those countries, which may have different data protection laws from yours. We use providers that commit to protecting it, and where the law requires it, we rely on contract terms such as the EU Standard Contractual Clauses.

Security and breaches

We use encrypted connections, access controls on our database, and limited access for our team. No system is perfectly secure. If a breach affects your personal data, we'll tell you, and the authorities, as the law requires.

Children

OpenBibs is for people aged 18 and over. We don't knowingly collect data from anyone under 16. If you think a child has given us their data, email us and we'll delete it.

Changes to this policy

We'll change the "Last updated" date at the top when we update this policy. If a change is significant, we'll tell alert subscribers and charities by email before it takes effect.

Contact

Quixta Ventures LLP, Bengaluru, Karnataka, India. Email support@openbibs.com.