Kinshare Privacy Policy

Version 2026-10-17. Effective 17 October 2026.

Kinshare is operated by Marquette Consulting & Management, LLC (“MCM”, “we”, “us”). This Privacy Policy explains what Kinshare collects, what it never collects, why, who sees it, how long it is kept and what you can ask for. It applies to the public directory, the portal and the emails Kinshare sends. It is part of the Kinshare Terms of Service. Questions and requests go to support@kin-share.org.

Our role. For information that member organizations record about the people they serve, MCM is a service provider and data processor: the organization decides what to record and MCM handles it only to run Kinshare for that organization. For staff accounts, organization records, claim requests and the public directory, MCM decides how the information is handled, as described here.

1. Information we never collect

Entering any of the following into Kinshare is strictly forbidden under the Terms of Service:

health information of the kind protected under HIPAA: any medical, mental health, substance use, diagnosis, treatment, medication, health insurance or health care provider information;
Social Security numbers, driver’s license, passport, state ID or any other government identification number of a person (an organization’s EIN is public IRS information shown on listings; an organization claiming its listing uploads its IRS EIN letter, which is deleted once the claim is decided);
immigration documents or immigration status;
bank account, debit or credit card, or any other financial account number;
passwords or credentials of any kind.

Kinshare does not collect or retain this data. If anything that resembles it is found, it is deleted and removed; the organization’s administrator is told that a record was changed and why; no copy is kept; and the deletion is logged by record identifier only. Kinshare’s text boxes warn against this data and refuse text that contains health terms.

2. Information we collect

Public directory visitors. Nothing you type is kept. Searches are not stored or logged against you. The “Find help that fits” questionnaire uses your answers once to suggest kinds of help and the nearest places, then forgets them; they are never saved, logged or emailed.

Claim requests. If you ask to claim your organization’s listing, we keep the name, role, work email and phone you give, to check the claim and set up your account.

Staff accounts. Your name, work email, role, the organization you belong to, the authenticator app link for two-step sign-in, and the date you accepted these terms. We do not keep your password; we keep a one-way hash of it.

Organization records. Your organization’s listing (name, address, phone, hours, services, languages, who it serves), its users, settings and billing status. Public listing information also comes from Internal Revenue Service nonprofit files and from organizations’ own websites.

Client information, recorded by an organization with consent. A client’s name, preferred name, phone, email, mailing address or ZIP code, county, preferred language, household size and, if given, date of birth (stored encrypted). Answers to a short questionnaire about housing, food, transportation, utilities, personal safety and “anything else”; the kinds of help needed; the worker’s notes (stored encrypted); referrals and messages between the two organizations on a referral (stored encrypted); and the consents the client gives. Contact details are entered only with the client’s consent and only to make a referral and follow it up.

Activity and security logs. Every time a staff member opens a client record, sends or answers a referral, or changes anything, Kinshare logs who, when and which record. The log holds record identifiers, not client details, and cannot be edited or deleted. Our servers also keep technical logs of requests (such as time, page requested and network address) to run and protect the service.

Cookies and browser storage. Kinshare uses no advertising or tracking cookies. The portal keeps your sign-in token in your browser’s session storage, which is cleared when you sign out or close the tab. It may remember small display preferences, such as how many rows a list shows, in your browser.

Usage stats. If you choose “Allow” when we ask, the public site uses Google Analytics to count anonymous page visits so we can improve Kinshare: we never send your searches, and we send sensitive help pages and listing pages only as a general category; nothing is sent if you choose “Don’t allow” or your browser sends Global Privacy Control, and you can change your choice at any time with the “Cookies” link at the bottom of every page, which also leads to our page about cookies.

3. How we use information

To run Kinshare: sign-in, the directory, referrals, messages, reminders and reports.
To send referrals only where the client has consented.
To send service emails. They never contain client details; they say that something changed and ask you to sign in.
To keep Kinshare secure: access reviews, detecting misuse, investigating incidents.
To bill organizations and handle tax exemptions.
To meet legal duties.

We do not sell personal information, use it for advertising, or build profiles of anyone.

Client information is shared with another organization only on the client’s consent, recorded in Kinshare, naming each receiving organization, and only until it expires or is withdrawn. Staff and organization information is used to provide the service under the Terms of Service. Security logs and billing records are kept because the service and the law need them.

5. How information is shared

With receiving organizations, only through a referral and only under the client’s consent. The receiver sees the client’s name, phone, ZIP code, preferred language, the need category and a short note. For sensitive categories (safety from violence, legal help, immigration help and reentry after jail) it sees name and phone only. It never sees the worker’s notes, questionnaire answers or other needs. If consent is withdrawn, the receiver loses access at once.
Within an organization, by role: administrators and navigators see client records; provider staff see only referrals sent to their organization; reporters see counts only. Counts under 5 show as “<5” on screen and in exports.
With our service providers, only as needed to run Kinshare: DigitalOcean (hosting in the United States, with encrypted backups), Resend (email delivery) and Stripe (payments). Each is bound to protect the data it handles.
When the law requires it, such as a valid court order. Unless the law forbids it, we tell the organization first.
If MCM’s business is transferred, this Policy continues to apply to the information.

MCM’s administrator accounts cannot open client records. Information is never sold.

6. How long we keep it

Client records: as long as the organization keeps them. Kinshare deletes nothing automatically. The organization decides when to close a record.
When an organization leaves or asks for deletion: we hold its data for 30 days so the request can be confirmed, then delete it. Backups roll off on their normal schedule.
Access log and disclosure records: kept after deletion, because the law may require them. They hold record identifiers, not client details.
Staff accounts: until the administrator removes them.
Claim requests: as long as needed to check the claim and keep a record of the decision.
Rejected claims: the claimant’s name, email, phone and message are removed 12 months after the rejection.
Unconfirmed claims: a claim whose email is not confirmed within 7 days is deleted.
IRS EIN letters: deleted when the claim is decided, or 30 days after upload at the latest. An encrypted copy may remain in database backups until they age out, within 35 days.
Prohibited data: deleted when found, with no copy kept.

7. Security

Each organization’s data is kept separate at the database level. Notes, messages and dates of birth are encrypted. Staff sign in with a password and an authenticator app. Every access to a client record is logged. MCM’s Privacy and Security Officer reviews access every month. No system is perfectly secure, and we cannot promise that information will never be exposed.

If data is exposed, MCM tells every affected organization in writing within 72 hours of confirming it. Each organization tells its own clients within the time Texas law allows. When 250 or more Texans are affected, MCM also notifies the Texas Attorney General.

8. Your rights and choices

Clients. You may ask to see your information, correct it, have it deleted, or withdraw your permission to share it. Ask your worker at the organization that recorded you; an administrator there acts on it, and a withdrawn consent stops the referral at once. You may also email support@kin-share.org; we will pass your request to your organization and help it answer. Do not put details about yourself in the email; we will reply and arrange a safe way to answer.

Staff. Your administrator can correct or remove your account. You may also ask us to see or correct what we hold about you.

Everyone. We answer requests within 45 days. We may need to confirm who you are first.

9. Children

Kinshare is not directed to children. When an organization records a client whose date of birth shows they are under 18, a parent, guardian or another legally authorized representative must sign the consent. The public questionnaire’s optional age question only filters programs and is not saved.

10. Texas residents

Kinshare is run from Texas for organizations in Texas. We do not sell personal data, use it for targeted advertising or use it for profiling. Texas residents may use the rights in section 8. If we decline a request, you may appeal by replying to our answer; we answer appeals within 60 days and will tell you how to contact the Texas Attorney General if the appeal is denied.

11. Changes to this Policy

We may change this Policy. We will post the new version with its date and, for a material change, tell administrators before it takes effect. Staff see the new version at their next sign-in.

12. Contact

Marquette Consulting & Management, LLC. Email support@kin-share.org. Privacy and security questions reach our Privacy and Security Officer at the same address.