Data Processing Addendum

Effective October 9, 2026 · Last updated October 9, 2026 · Previous version

This Data Processing Addendum (“DPA”) describes how MortonApps LLC processes personal data on behalf of agencies that use Volunteer Ledger at volunteerledger.com. It supplements and forms part of our Terms of Service. If this DPA and the Terms of Service conflict, section 12 of the Terms (Order of documents) decides which controls. This version applies to your agency only when the Terms of Service effective October 9, 2026 apply to it (section 11 of the Terms): from signup for a workspace created on or after that date, or when one of its admins accepts this version in Volunteer Ledger. Until then, the previous version (linked above) applies.

1. Roles of the parties

For the personal data your agency enters into and processes through Volunteer Ledger, your agency is the data controller and MortonApps LLC is the data processor. Your agency decides what personal data to enter and for what purpose; we process that data only on your documented instructions, which are the instructions set out in our Terms of Service, this DPA, and your configuration and use of the service. If we believe an instruction would violate applicable law, we may tell you and decline to follow it.

2. Categories of personal data and data subjects

The personal data we process on your behalf is limited to what your agency chooses to enter to run its volunteer program. Depending on your configuration, this includes:

• Volunteer records: name, date of birth, postal address, phone number, email address, emergency contact name and phone number, areas of service, service notes, and volunteer hours (and, if your agency enables it, mileage), including what applicants submit through your agency’s application form.
• Staff account records: the name, email address, and hashed password of each staff member you invite or sync from your Microsoft 365 directory (with its directory id and the groups used to set its role), plus an audit trail of who created, changed, or deleted each hour entry and what it said before and after the change (including for entries later deleted), and of who saved which settings (not the values).
• Requirement records: the training, screenings, licenses and agreements your agency chooses to track for each volunteer, together with the dates on which each was completed and expires, and any exemption and its reason.
• Uploaded documents: files your staff attach to a volunteer, or to a requirement as proof of it. Your agency decides what is uploaded; these commonly include signed agreements, background check results, training certificates, immunization or screening records, and copies of licenses, so they can contain criminal-record and health information about the volunteer (not patient data, which the service is designed never to hold).
• Other program records: training records, shift schedules and sign-ups, messages your agency sends volunteers, and, if your agency turns on texting, each mobile number’s texting status and a record of each text sent, custom fields your agency defines, and sign-in accounts for volunteers your agency invites.

The data subjects are your agency's volunteers and applicants, their emergency contacts, and the staff members you authorize to use the service.

Your agency controls how long uploaded documents are kept. An optional retention window can be set that begins when a volunteer is deactivated; when it elapses, that volunteer’s documents are deleted from storage rather than hidden, and the deletion is recorded in the document access log. If you set no window, documents are retained until you delete them or your account’s data is deleted.

For an agency on this version of this DPA, we may delete declined or untouched applications 12 months after their last activity; the agency can ask us to keep them longer. We keep the audit trail for 7 years after each change, then delete it. Deleting your account does not delete its audit trail: we keep it only for legal and compliance purposes, and never more than 7 years after the account ends.

Explicitly out of scope: patient data and protected health information (PHI) of any kind. Free-text fields carry a visible reminder not to enter sensitive information (for health care agencies, patient information), and our Terms of Service prohibit entering PHI.

3. Purpose and duration of processing

We process the personal data solely to provide, support, and improve the service for your agency (storing records, generating and exporting reports, sending the report and account emails you schedule or trigger, keeping your account secure, and finding and fixing problems) and, where needed, to comply with the law, enforce the Terms of Service, or bring or defend legal claims, and to keep our products from emailing or texting addresses or numbers that bounced, complained, unsubscribed, or opted out. We may also create aggregated or de-identified data that identifies no agency or person, as section 12 of the Terms of Service describes. We do not sell personal data, do not use it for advertising, and do not use it to train AI models, except as our AI provider’s terms allow for content it flags for safety review (see Section 4). Processing continues for as long as your account is active and through any wind-down period described in Section 8.

4. Subprocessors

We use a short list of providers (“subprocessors”) to run and support the service. The authoritative, current list is maintained in our Privacy Policy. As of the last-updated date above, the subprocessors are:

• Cloudflare: application hosting and data storage (data stored in the United States; requests are handled at Cloudflare locations worldwide). Our systems of record for your agency’s data are the providers listed here and our encrypted database backups. We also make working copies on our own computers to operate, support, or fix the service, and we aim to delete them within 30 days of making them. Those computers have encrypted backups that only we can decrypt, which are deleted on a schedule. If we find a copy of your agency’s data outside our systems of record, for example in our private source-code host, we work to remove it.
• Amazon Web Services (AWS): email delivery via Amazon SES (for messages the service sends, such as invitations and notifications), encrypted, off-site database backups via Amazon S3 for disaster recovery, and, if your agency turns on texting, text-message delivery via AWS End User Messaging (United States). AWS may also provide encrypted primary storage, in the United States (Amazon DynamoDB and Amazon S3), of records we class as sensitive: government ID numbers, health and screening results, background check results, sensitive notes, and uploaded documents. Backups of that store may persist for up to 35 days after deletion.
• Microsoft: our business email (Microsoft 365), which holds what you email us and our replies, and our internal alerts about your account, such as the one about each new signup, which names your agency and the person who signed up (United States).
• Anthropic, PBC: AI tools we use to operate, support, and maintain the service, including reviewing problem reports and support emails and helping us fix problems (United States and other countries). While helping us, they may process data in the service, such as volunteer records, hours, requirements, and applications, and account and usage information. We use them on Anthropic’s consumer Claude Max plan, through an account held for us by our manager, under Anthropic’s consumer terms, not a business agreement, and we have no data processing agreement with Anthropic. The setting that lets Anthropic train its models on our sessions (“Help improve Claude”) is turned off. Its consumer terms still let it use what we send for its own purposes, including improving its services, safety review, and legal compliance, and let it use content its systems flag for safety review, including for model training even when the training setting is off. For flagged content, Anthropic’s published policy is to keep inputs and outputs for up to 2 years and safety classification scores for up to 7 years. It keeps feedback we submit, together with the data attached to it, for up to 5 years. Otherwise, with training off, it states that deleted conversations are removed from its systems within 30 days. These periods are Anthropic’s and may change. We never send Anthropic feedback (such as a rating or a feedback report) on work that includes an agency’s data. For an agency still on an earlier version of this DPA, we do not use these AI tools on its data until one of its admins accepts this version.

Your agency authorizes us to use the subprocessors listed, on the terms described, including Anthropic under its consumer terms, used through an account held for us by our manager, and to add or replace subprocessors under Section 5. This is one of your documented instructions under Section 1. Our responsibility to you for subprocessors is limited as section 8 of the Terms of Service provides.

Payments are handled outside this list. Paid plans are sold and processed by Lemon Squeezy, our merchant of record. They receive none of your agency’s data (no volunteers, hours or requirements), only the billing contact's name and email and the subscription record, and they hold the card details, which we never see or store. As merchant of record, it sells in its own name and handles that information for its own tax and fraud-prevention obligations, not on our instructions, so it is a payment provider, not a subprocessor of your data. See our Privacy Policy.

5. Notice of subprocessor changes

If we add or replace a subprocessor that processes your personal data, we will update the list in our Privacy Policy and tell your agency’s admins in Volunteer Ledger or by email at least 30 days before the new subprocessor begins processing, giving you a reasonable opportunity to object. This is not a change to this DPA, and it needs no acceptance. If you reasonably object to a new subprocessor on legitimate data-protection grounds before that date, by replying to our notice or emailing [email protected] or [email protected], and we cannot accommodate the objection, you may terminate the affected service and we will assist you in retrieving your data as described in Section 8. Terminating under this section is your only remedy for the change; we refund the unused, prepaid part of the current period for that service, excluding taxes.

6. Security measures

We maintain technical and organizational measures appropriate to the risk, including:

• Encryption in transit: all traffic to the service is encrypted over HTTPS (TLS).
• Encryption at rest: your agency’s data is stored on Cloudflare's managed infrastructure with encryption at rest, and off-site backups of the database and of uploaded documents are stored encrypted in Amazon Web Services (Amazon S3); records we class as sensitive may instead be stored encrypted in our AWS secure store (Amazon DynamoDB and Amazon S3); if your agency configures custom email credentials, they are additionally encrypted at rest with AES-GCM.
• Password and session protection: passwords are hashed with PBKDF2 (we cannot see or recover them), and session tokens are stored hashed.
• Access controls: role-based access (admin, staff, read-only viewer, and volunteer) limits who within your agency can see and change what.
• Tenant isolation: each agency's data is isolated to its own workspace and queries are scoped per tenant.
• Minimized surface: the product is deliberately simple and runs no third-party tracking or advertising scripts (the only third-party script is Cal.com’s booking script, which loads only when someone opens the booking form).

We limit access to personal data to the people who build and operate the product and who are bound to confidentiality by written agreement or by law, and to the subprocessors in Section 4, and we work to remove copies we find outside our systems of record, as Section 4 describes.

7. Personal-data breach notification

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay after becoming aware of it. Our notice will describe, to the extent known, the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and the measures taken or proposed to address it. We will reasonably cooperate with you so your agency can meet its own notification obligations. Our notice of a breach is not an admission of fault. Each party bears its own costs of responding to a breach, including notices to people and regulators, and our liability for a breach is limited by section 8 of the Terms of Service. We do not notify individuals, regulators, or others for your agency unless the law requires us to.

8. Return and deletion of data on termination

You can export your records at any time during the term. The export bundle covers your areas of service, volunteer records (with their custom-field answers), the requirement types you define and every volunteer requirement and exemption recorded against them, applications, hour entries, staff accounts, the hour-entry audit trail, and the record of who saved which settings; hour entries are also available as a separate detail CSV. It does not include uploaded documents, which are downloaded individually from the volunteer record they are attached to. Records kept in our AWS secure store may be exported as a separate secure-records file, with a manifest of uploaded documents. On termination or expiry of your account, it becomes read-only, and you may continue to export your data until it is deleted, unless section 9 of the Terms of Service allows us to end access sooner. If an account bound by the Terms of Service effective October 9, 2026 or later stays read-only for 12 months, we delete it after at least 30 days’ email notice, as the Lapse paragraph in section 3 of the Terms of Service describes. If we stop offering Volunteer Ledger, the Terms of Service set a shorter export period. An admin of your agency may also request deletion of your account and data at any time by emailing [email protected]; we confirm the request with your agency’s admins and wait 7 days before deleting, and if another admin objects during that time, we do not delete until your agency’s admins agree in writing. When we delete an account for any reason the Terms of Service allow, we delete the personal data we hold for your agency within a commercially reasonable period. We keep only:

• anything the law, a legal hold, or a claim or investigation (including one we reasonably expect) requires us to keep;
• the audit trail described in Section 2, which we keep for up to 7 years after each change and never more than 7 years after the account ends;
• bug reports your staff file in the app and their details (we delete any screenshots when your account’s data is deleted), which we keep, and delete on request, as our Privacy Policy describes;
• emails your agency sends us and our replies, our internal alerts about your account, and records of messages our sending service sent for your agency (the content of each message for up to 30 days after sending), which we keep as business records;
• a record of any email address that bounced, complained, or unsubscribed, or phone number that opted out of texts (the address or number, when, and why), kept on a list shared by our products only so that none of them emails or texts it again;
• working copies on our own computers, which we aim to delete within 30 days of making them; encrypted backups of those computers that only we can decrypt, which are deleted on a schedule; and any copy we find outside our systems of record, which we work to remove;
• copies our subprocessors keep under their own terms, as Section 4 describes; and
• copies in our encrypted backups.

Backups are kept for up to 12 months, some locked against change or deletion, even by us, for 90 days (longer under a legal hold), so deleted data can remain in them until they expire. We use backups only for disaster recovery, to undo a deletion we made by mistake or without the notice the Terms of Service require (never one you confirmed), and where needed to comply with the law or a legal hold or to bring or defend legal claims. If we restore one, we re-apply every account deletion made since the backup was taken, except a deletion we are undoing, and we tell your agency if records it deleted after that date may need to be deleted again.

9. Assistance with data-subject requests

Because your agency controls its records, you can fulfill most data-subject requests (access, correction, export, deletion) directly in the app. Taking your account-management capabilities into account, we will provide reasonable assistance, at your expense for anything beyond what the service’s features and our ordinary support already provide, to help you respond to requests from volunteers or staff to exercise their rights, and to meet your obligations regarding security, breach notification, and data-protection impact assessments. Individuals who contact us directly will be routed to their agency, and we will help where appropriate.

10. Contact

Questions about this DPA, or to make any request described above: [email protected]. We reply during business hours.

See also our Privacy Policy, Terms of Service, and Security overview.