Quick start
- Export only what TruePyramids needs: one row per gift with transaction ID, constituent ID, date, amount and type. Leave out names and contact details.
- Upload it. Anything that looks like a name, email address, phone number or street address is removed as we read the file and never saved, and your original file is deleted once it's imported.
- Your organization's data is visible to your organization's team and no one else. The AI assistant only ever sees totals.
- To delete an upload or a pyramid, open Settings › Data and choose Delete beside it. The owner can delete anything, including the whole organization.
- The legal versions are our Privacy Policy and Terms of Service; this page explains the same things in plain language.
What we keep
The short version: we keep gift amounts, dates, types and constituent IDs — never your donors' names or contact details — and we never sell anything. Your organization's gift data belongs to your organization; we process it only to build your pyramids, campaigns, plans and history.
| What | What we keep |
|---|---|
| Your gift data, from uploads and CRM pulls | Transaction IDs, constituent IDs, gift dates, amounts, your gift type labels and the TruePyramids type each one matches, capacity ratings if your file has them, and other columns you keep as details (like appeal or fund). For each upload, its file name, column headings, and the rows left out of the import (row number, transaction ID and reason). |
| Asks files | Constituent ID, ask date, ask amount and outcome. |
| What you build | Pyramids with their scenarios, levels and prospect rules; campaigns; prospect plans (constituent IDs with gift officer and stage); history snapshots; leadership summaries you save; and your organization's Pyramid defaults. |
| Your account | Your name, email, whether the email is verified, the ID of each Google or Microsoft account you sign in with, the organizations you belong to and your role in each, when you last signed in, and your Email tips choice. |
| Your organization | Its name, team, portfolio sizes and invitations (the invited email address); CRM connections, with their tokens or API keys encrypted; the organization's own AI key, encrypted; AI request counts; and for Plus, the plan, its Stripe customer and subscription IDs, interval, status and when the current period ends. |
| Ratings | The stars, any feedback you write, whether you chose to share the rating, the pyramid's record count (rounded) or goal, and the state, province or country the rating came from. |
| Technical logs | Requests, errors and timings, with visitors' IP addresses masked, for 30 days. |
We don't sell personal information, share it for advertising, or use your donor data to train AI models.
What we never store
- Donor names, email addresses, phone numbers and postal addresses. Columns that look like personal information are removed when we first read your file, before anything is saved to your organization's data. See How personal information is removed.
- Your original file. It's kept only until it's processed: deleted once it's imported (or the import fails), and after 24 hours if nobody finishes reviewing it.
- Personal-information fields from your CRM. They're hidden from the list of fields you can pull and never imported.
- Passwords. You sign in with Google or Microsoft; we never see your password.
- Card numbers. Plus is paid on Stripe's pages; we never see your card.
- Your Google or Microsoft access tokens. We use the sign-in once and keep only your name, email and account ID.
- IP addresses from ratings. When you rate a pyramid, we look up your region once and keep only the region's name.
Note: CRM connections only ever read. We never change anything in your CRM, and deleting something in TruePyramids never touches your CRM.
How personal information is removed
TruePyramids works from constituent IDs, so it never needs to know who your donors are. Look people up in your own CRM by ID — exports that list people use IDs too, so you can match them back.
From uploaded files
When the file is first read on our servers, before anything is saved:
- Columns whose heading looks personal are removed — for example names of any kind (first, last, full, donor, household, company), email, phone, mobile, address, street, city, ZIP or postal code, birth date, Social Security or tax ID, salutation, spouse and “in honor of”.
- Columns whose values look like email addresses, phone numbers or street addresses are removed too, even under a harmless heading like “Notes2”, when most of the sampled values (60% or more) look that way.
- On the review step, removed columns are marked with why (for example “Looked like email addresses”), and they can't be used for anything.
Only the columns you use — the five required ones, an optional capacity rating, and details you choose to keep — are saved. Full details: personal information in uploads.
From CRM pulls
When you connect a CRM, we read gifts and the fields you choose. Fields that look like personal information are hidden from the field list, so they can't be chosen or pulled. The connection's tokens or API key are stored encrypted. See CRM connections.
Your part
Our checks look at column names and patterns, so they can't recognize everything. Please don't put personal information in columns you keep as details — a free-text “notes” column can hold names — and don't upload data you don't have the right to share with a service provider. If in doubt, leave the column out of your export.
Who can see your data
Your organization's team
Everyone in your organization — the owner and every member — sees all of its uploads, pyramids, campaigns and prospect plans, including constituent IDs in View records and exports. Roles decide who can delete and manage settings, not who can see; see Who can do what.
Nobody in any other organization can see anything of yours. Each organization's data is kept separately, and every request is checked against the person's membership. People who belong to several organizations see only the one they're in at the moment.
TruePyramids staff
Our staff support pages show account details so we can help you: organization names, team members' names, emails and roles, plan and billing status, the state of CRM connections, AI request counts, how many pyramids and uploads you have, and written feedback from ratings. They don't show donor data — no constituent IDs, gifts or file contents — and never CRM credentials or AI keys.
The AI assistant
The AI assistant only sees totals — gift counts and amounts by level, your goal, your prospect rule and tier summaries. It never sees donor records or constituent IDs. With Plus, requests go to Anthropic; with your organization's own key, to Anthropic or OpenAI on your organization's account. See what the AI can see.
Companies that help us
Microsoft Azure hosts the service, database, files, keys, logs and email delivery, in the United States (Central US). Google and Microsoft sign you in, Stripe takes Plus payments, Anthropic (and OpenAI if you choose it) runs the AI assistant with totals only, MaxMind turns an IP address into a region for shared ratings, Google Fonts delivers the site's fonts, and your CRM is read only if you connect it. The full list is in the Privacy Policy.
What's ever shown publicly
Only ratings you choose to share, without your name or organization's name — for example “User from Illinois just created a Gift Pyramid with about 2,500 records”. The Show my rating anonymously on the TruePyramids home page box is ticked when the rating card appears; untick it before you choose your stars and nothing is shown.
Deleting data
Settings › Data lists every upload and CRM pull (newest first) and every pyramid (most recently changed first). Each one you're allowed to delete has a Delete button. Nothing is deleted until you confirm, and deletes can't be undone.
Who can delete what
| What | Owner | Member |
|---|---|---|
| A pyramid | Any pyramid | Pyramids they created |
| An upload or CRM pull | Any upload | Uploads they added — but only when no teammate's pyramid is built from it |
| A CRM connection (Disconnect) | Yes | No |
| The whole organization (Delete everything) | Yes | No |
The rule for uploads protects your teammates: deleting an upload deletes every pyramid built from it, so a member can't delete an upload that someone else's pyramid depends on. Members see “You can delete the uploads and pyramids you added. The owner can delete anything.” at the top of the Uploads list, and only get Delete buttons where the rule allows.
Example: who can delete what at Riverside Food Bank
Alex is the owner; Sam is a member. Sam uploaded gifts_fy2026.csv and built a donor pyramid from it. Alex then built a gift pyramid from the same upload.
| Item | Sam can delete? | Alex can delete? |
|---|---|---|
| Sam's donor pyramid | Yes — Sam created it | Yes |
| Alex's gift pyramid | No — Alex created it | Yes |
gifts_fy2026.csv | No — Alex's gift pyramid is built from it | Yes, and both pyramids go with it |
If Alex deletes the gift pyramid first, Sam can then delete the upload, which takes Sam's donor pyramid with it.
Deleting an upload or CRM pull
- In Settings › Data › Uploads, choose Delete beside it. Each upload shows what it's used for, such as “2,418 transactions · used by 2 pyramids · Oct 26, 2026”.
- Read the question, for example “Delete this upload and the 2 pyramids built from it? This can't be undone.” For a CRM pull it adds “The connection to Bloomerang stays.”
- Choose Delete upload, Delete upload and pyramid or Delete upload and pyramids — or Cancel.
This deletes the upload's gifts, details, capacity ratings or asks, its list of left-out rows, its CRM pull history, its file if it's still in storage, and every pyramid built from it (with everything those pyramids hold — see below). Pyramids that were only waiting for this upload aren't deleted; they go back to waiting for transactions. You'll see “Upload deleted.” or “Upload deleted, with the pyramids built from it.”
While an upload is waiting for review, its review page also has Delete this upload, which deletes it straight away without asking again.
Deleting a pyramid
- In Settings › Data › Pyramids, choose Delete beside it.
- Confirm: “Delete FY2026 donors? This can't be undone.” — then Delete pyramid.
This deletes the pyramid with its scenarios or tiers, builds, placements, prospect plan and history snapshots. The upload it was built from stays, along with any other pyramids built from it. A gift pyramid that's a campaign priority leaves its campaign. You'll see “Pyramid deleted.”
Disconnecting a CRM
The owner can choose Disconnect beside a CRM in Settings › Data. That deletes the connection and its stored credentials. Pyramids built from it keep their data but can't be refreshed until someone reconnects. To delete the gifts pulled from it as well, delete the CRM pull under Uploads. See CRM connections.
Deleting everything
The owner can delete the whole organization — every upload, pyramid, campaign, plan, snapshot and rating, its CRM connections and its team — and cancel Plus, by typing its name under Delete everything. See Delete everything for exactly what goes and where you land.
How long we keep things
| What | How long |
|---|---|
| Your original uploaded file | Until it's processed: deleted once imported, or when the import fails. A file nobody finishes reviewing is deleted, with its upload, after 24 hours. |
| Gifts and everything you build | Until you delete them (or the upload or pyramid they belong to), or the owner deletes everything. |
| Pyramid history Plus | Monthly snapshots stay until you delete the pyramid or the organization. Snapshots taken after syncs are thinned to one a month after 90 days. |
| Skipped records from a CRM pull | Only the latest pull's list is kept; each new pull replaces it. |
| Database backups | Deleted data leaves our backups within 7 days. |
| Technical logs | 30 days, with IP addresses masked. |
| Billing records | Stripe keeps them as the law requires. |
| Your account | Until you ask us to delete it; see Deleting your account. |
Exporting your data
Everything you build can be exported. Exports never include names; the ones that list people use constituent IDs, so you can match them back in your CRM:
| Where | Button | You get |
|---|---|---|
| A gift pyramid | Export Excel | The scenario you're looking at, as a workbook. See Gift pyramids. |
| A campaign | Export Excel | The campaign and its priorities. See Campaigns. |
| A prospect plan | Export Excel | Every prospect by level with gift officer and stage. See Prospect plans. |
| A donor pyramid or True Pyramid | Export CSV | The tier table: each tier with its count and revenue. See Donor pyramids and True Pyramids. |
| The View records panel | Export CSV | The constituents you're viewing, by ID. See Viewing records. |
| An upload's results | Download left-out rows (CSV) | Rows left out of the import, and why. |
| A CRM pull's summary | Download skipped IDs | The CRM's IDs for records that were skipped, and why. |
There's no download of the gifts themselves: your CRM, or the file you exported from it, is the original, and we delete the uploaded file once it's imported.
Security
From our Privacy Policy: every connection uses HTTPS, and data is encrypted at rest. CRM credentials and API keys are encrypted with keys held in Azure Key Vault. Each organization's data lives in its own database schema, and every request is checked against your membership. No system is perfectly secure; if we learn of a breach that affects you, we'll tell you.
Your own part: your Google or Microsoft account is what signs you in, so keep it secure, and use Sign out everywhere if a device is lost.
Advanced: what each delete removes
| Action | Removes | Leaves |
|---|---|---|
| Delete an upload | Its gifts and kept details, capacity ratings, asks, left-out rows, CRM pull history and skipped lists, any staged rows still waiting for review, its file if still stored, and every pyramid built from it with all they hold | Pyramids only waiting for it (they wait again), the CRM connection, a campaign that used it as its file (left without a file) |
| Delete a gift pyramid | Scenarios, levels, prospect rule, counted prospects, builds, prospect plan, history snapshots, saved summary, and its place in a campaign | The upload and other pyramids built from it |
| Delete a donor pyramid or True Pyramid | Tiers, builds, placements, ready-to-move-up lists and history snapshots | The upload and other pyramids built from it |
| Disconnect a CRM | The connection and its stored credentials | Every pull from it and every pyramid built from them |
| Delete everything | The organization and everything in it | People's accounts and their other organizations |
Permission is checked when you delete
The Delete buttons only appear where you're allowed to use them, and the rule is checked again at the moment you confirm. If something changed in between — say a teammate built a pyramid from your upload while your page was open — nothing is deleted and you see “Only the person who added it, or the owner, can delete that.”
Campaigns
A campaign's priorities are gift pyramids, listed under Pyramids in Settings › Data; deleting one takes it out of its campaign. A campaign itself has no delete of its own — Delete everything removes campaigns along with everything else.
Questions
Do you store my donors' names?
No. Names, email addresses, phone numbers and street addresses are removed when we first read your file and never saved. We work from constituent IDs.
My file had a column of donor names. What happened to it?
It was removed when we read the file, and it's marked on the review step as having looked like personal information. Your original file is deleted once it's imported. Next time, leave that column out of your export.
Why can't I delete this upload?
Either someone else added it, or a teammate's pyramid is built from it. Members can only delete uploads they added that no teammate's pyramid depends on. Ask the owner, who can delete anything.
Why is there no Delete button beside a pyramid?
A teammate created it. Members can delete only the pyramids they created; the owner can delete any pyramid.
Does deleting an upload delete my pyramids?
Yes — every pyramid built from that upload, with its scenarios, plans and history. The confirmation tells you how many, and the button says so: Delete upload and pyramids.
Can I get deleted data back?
No. Deletes take effect right away and can't be undone. Export what you want to keep first.
Does deleting in TruePyramids change anything in my CRM?
No. CRM connections only read. Deleting a CRM pull, a pyramid or everything never touches your CRM.
Can TruePyramids staff see my donor data?
Our support pages don't show it: no constituent IDs, gifts or file contents. They show account details such as your organization's name, team and plan, so we can help you.
Does the AI assistant see my donors?
No. It sees totals only — counts and amounts by level, your goal, your rule and tier summaries — never records or constituent IDs.
Do you use my data to train AI models?
No. We don't use your donor data to train AI models, sell personal information, or share it for advertising.
Where is my data stored?
On Microsoft Azure in the United States (Central US).
How do I delete a campaign?
There's no delete for a campaign on its own. You can delete its priorities in Settings › Data › Pyramids, which removes them from the campaign; Delete everything removes campaigns with everything else.
How do I get a copy of my data?
Use the exports on each pyramid, campaign and prospect plan, and Export CSV in View records. See Exporting your data.
A donor asked us to remove their data. What should we do?
TruePyramids holds only their constituent ID and their gifts — no name or contact details. To remove them, delete the upload or CRM pull that holds their gifts (which also deletes the pyramids built from it, with their history), then upload a file without their rows or pull again after excluding them in your CRM. If you need help, email support@truepyramids.com.
Is my data encrypted?
Yes. Connections use HTTPS, data is encrypted at rest, and CRM credentials and API keys are encrypted with keys held in Azure Key Vault.