Privacy Policy

1. Introduction

ScreenForge Labs LLC, a Florida limited liability company doing business as VolunteerBadge ("VolunteerBadge," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use our platform, website, and related services (collectively, the "Services"). It applies to organization administrators, volunteers and applicants, and visitors.

We handle personally identifiable information ("PII") with the utmost care. Our platform processes sensitive consumer data — including background check results, dates of birth, Social Security Numbers, and other PII of both organizations and volunteer applicants. We are stewards of that data, not owners of it, and we treat it accordingly. By using the Services, you agree to the practices described here.

We do not sell your personal information. We do not rent, trade, or share it for anyone else's marketing. We disclose PII only as strictly necessary to deliver the Services you request or as required by law, as described below.

2. Information We Collect

2a. Information You Provide Directly

• Account registration: Name, email, and authentication credentials for organization administrators and team members.
• Organization profile: Organization name, type, sector, logo, address, phone, and related business information.
• Volunteer applications: Employment information, references, address history, role preferences, and other information applicants submit through an organization's forms.
• Screening information: Date of birth, Social Security Number (encrypted — see Section 5), and FCRA consent and authorization records from applicants.
• Payment information: Payment-method details collected and stored by our payment processor. We do not store full payment card numbers.
• Communications: Support tickets, emails, and messages.

2b. Information We Collect Automatically

• Usage data: Pages visited, features used, time spent, and navigation paths.
• Device and log data: IP address, browser type, operating system, referrer URL, and device identifiers.
• Cookies: Session cookies for authentication, preference cookies for settings, and limited analytics cookies. You may disable cookies in your browser, though this may affect functionality.

2c. Information We Receive from Third Parties

• Data providers: When an organization initiates a screening with proper applicant consent, we receive consumer-report data (criminal records, address-history results, related public records) from our certified data sources, governed by the FCRA.
• Payment processor: Payment status and transaction confirmations.
• Authentication provider: Authentication tokens and session-management data.

3. How We Use Your Information

We use information only to operate and improve the Services and meet our legal obligations, including to:

• Provide, operate, secure, and improve the Services;
• Process volunteer applications, screening orders, address-history verifications, and credit purchases;
• Provide AI-assisted features (record matching, screening summaries, adverse-action drafting, compliance guidance) under the strict limits described in Section 6;
• Send transactional communications (confirmations, receipts, status updates, adverse-action notices);
• Respond to support requests;
• Maintain compliance records required by the FCRA and other laws;
• Detect and prevent fraud, abuse, and unauthorized access; and
• Send product updates relevant to your account (you may opt out of marketing at any time).

We do not sell your personal information, and we do not use your personal information for targeted advertising on third-party platforms.

4. How We Share Your Information

We do not share PII with anyone except as strictly necessary to provide the Services you request or as required by law. Specifically:

• Between an organization and its applicants: An organization receives the applications its applicants submit and the screening reports it lawfully orders, with valid consent.
• With data sources, only to fulfill a screening: We transmit the minimum identifying information necessary to our certified data sources to complete an authorized screening, under FCRA-compliant agreements.
• With service providers under contract: Vetted vendors (hosting, payment processing, email delivery, security) process data solely on our behalf, under confidentiality and data-protection obligations, and may not use it for their own purposes.
• For legal reasons: When required by law, subpoena, or court order, or to protect the rights, safety, and security of users, the public, or ScreenForge Labs.
• Business transfer: In a merger, acquisition, or asset sale, data may transfer subject to this Policy and continued confidentiality protections.

We never sell PII, never share it for third-party marketing, and never disclose Social Security Numbers or full screening results beyond the organization that lawfully ordered them and the data sources required to produce them.

5. How We Protect Your Information

• Encryption of data in transit (TLS) and encryption at rest for sensitive fields, including Social Security Numbers, which are encrypted in our systems;
• Strict role-based access controls and least-privilege access, with access to sensitive data limited to authorized personnel with a legitimate need;
• Audit logging of access to screening data;
• Reasonable administrative, technical, and physical safeguards designed to protect against unauthorized access, alteration, disclosure, or destruction; and
• Data-minimization and retention practices that limit how long we keep PII (Section 7).

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security, but we take every commercially reasonable measure to safeguard the data you entrust to us.

6. Artificial Intelligence and Automated Analysis

We use automated and AI tools to help match records, classify and summarize screening data, draft compliance documents, and improve accuracy. We apply these tools in a privacy-protective way:

• Metadata, not identities. Our AI analysis operates on record metadata and screening attributes — such as offense descriptions, jurisdictions, dates, dispositions, match types, and record-level flags — and is designed to avoid processing direct PII (such as Social Security Numbers) as part of that analysis.
• No training on your PII. We do not use your PII to train third-party or public AI models, and we do not permit our AI service providers to use your data to train their models.
• Human in the loop. AI output supports — it does not replace — human review and the organization's decision. AI output is informational only and may contain errors.
• Safeguards with providers. Where an AI service provider is used, it acts under contract as a processor with confidentiality and data-protection obligations.

7. Identity Verification & Biometric Information

To confirm that a volunteer applicant is who they claim to be — and to prevent identity fraud such as the use of someone else's Social Security Number — we offer identity verification through our verification partner, Didit. When an organization enables this feature, an applicant is asked to provide a photo of a government-issued identity document (e.g., driver's license or passport) and a facial-liveness selfie.

• What we collect: the images of the identity document and selfie, the data extracted from the document (name, date of birth, document number and type, expiration, issuing authority), and biometric information (facial geometry used to confirm the selfie matches the ID).
• Consent: we collect this information only with the applicant's explicit consent, obtained at the verification step before the process begins.
• How we use it: solely to verify identity, to cross-check the verified identity against the application, and to prevent fraud. We do not use it for advertising, and we do not sell it.
• Processor: Didit processes this information on our behalf as a service provider under contractual confidentiality and data-protection obligations.
• Storage & retention: verification images and data are stored securely with restricted access and retained only as long as necessary for identity verification, fraud prevention, and legal compliance, after which they are deleted or de-identified.
• Your rights: where applicable law (such as state biometric-privacy laws) grants rights regarding biometric information, we honor them; contact us to exercise them.

8. Data Retention

We retain PII only as long as necessary to provide the Services, comply with the FCRA and other legal obligations, resolve disputes, and enforce our agreements. Screening records and compliance documentation are retained for the periods required by applicable law. When data is no longer needed, we delete or de-identify it using reasonable measures.

9. Your FCRA Rights

Because ScreenForge Labs acts as a consumer reporting agency, individuals who are the subject of a consumer report have rights under the FCRA, including the right to access the information in their file, to dispute inaccurate or incomplete information and have it reinvestigated and corrected or deleted, and to receive the "Summary of Your Rights Under the Fair Credit Reporting Act." To exercise these rights or dispute a report, contact disputes@screenforgelabs.com.

10. Your Privacy Choices and Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict the use of your personal information, and to opt out of marketing communications. We do not sell personal information or share it for cross-context behavioral advertising. To make a request, contact privacy@screenforgelabs.com. We will verify and respond as required by applicable law. Note that certain consumer-report rights are governed specifically by the FCRA (Section 8).

11. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. Where an organization screens volunteers who are minors, it must obtain all legally required parental or guardian consent. If you believe a child has provided us information, contact us and we will delete it.

12. International Users

The Services are operated in the United States and intended for U.S. users. If you access them from outside the United States, you consent to processing your information in the United States under U.S. law.

13. SMS / Text Messaging

With consent, we use SMS text messages — delivered through our telecommunications provider, Twilio — to send transactional messages related to volunteer applications and background screening, such as an invitation to complete a volunteer application and background check, and reminders about a pending application.

• Consent: We send text messages only to individuals who have provided their mobile number and consented to be contacted — typically when a nonprofit organization adds them as a volunteer during its intake process. We do not text the general public and we do not purchase or use rented phone-number lists.
• Message frequency: Frequency varies with your interaction with an organization (for example, an initial invitation and occasional reminders). Message and data rates may apply.
• Opt-out: You can opt out at any time by replying STOP to any message; you will receive a confirmation and no further texts. Reply START to opt back in.
• Help: Reply HELP for assistance, or visit volunteerbadge.com/support.

We do not share or sell mobile phone numbers or SMS opt-in/consent information with third parties or affiliates for their own marketing or promotional purposes. Mobile information is used solely to deliver the messages described above and is shared only with our messaging provider as needed to transmit them.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated Policy and revise the effective date, and material changes may be communicated through the Services. Your continued use after the effective date constitutes acceptance.

15. Contact Us