Privacy Policy

Who we are

Restore501 is a service of RockySoftware Inc., 213 Mckean Dr, Stouffville, ON L4A 5E2, Canada. We prepare Form 1023-EZ reinstatement packets for US nonprofits. Questions about this policy or your information go to hello@restore501.com.

Our promise about your documents

Your documents are used only to prepare your reinstatement packet. We never share, sell, or reuse them for any other purpose.

That covers your articles of incorporation, bylaws, IRS letters and anything else you upload. The same goes for the details you type into the intake: we use them to check your eligibility and prepare your packet, and to contact you about it.

What we collect and why

Eligibility check answers

The questions at /start/ run entirely in your browser and are not sent to us. If you then create an account, the revocation date you entered is offered as a prefill in your intake, and it’s stored only if you save that step.

Your account

Your email address and a password. We store the password only as a salted one-way hash (PBKDF2), so we can’t see or recover it. Your account lets you save your intake and come back to it.

Intake details

The contact person’s name, title, email and phone; your organization’s legal name, EIN, date and state of formation, revocation date and tax year, and whether it’s an LLC, church, school, college or university, hospital or medical research organization, or private foundation; its mailing address; its mission, activities and main source of funding; its gross receipts for the last three years and current total assets; and the signing officer’s name and title. We need these to confirm eligibility for the streamlined path and to prepare your Form 1023-EZ packet.

Documents you upload

Your articles of incorporation and, if you choose, your bylaws and IRS revocation letter. We use them only to prepare your packet (see our promise above).

Payment

Payments are handled by Stripe on its own checkout page. We never see or store your card details. We keep the Stripe checkout reference, whether payment succeeded, and when.

Security records

A login cookie that keeps you signed in. It is used only for that, never for tracking. To block password guessing and sign-up floods, we also keep short-lived counters of failed logins and new sign-ups, keyed by IP address or email address, and delete them automatically after about a day.

We don’t use analytics, advertising or tracking cookies, and we don’t sell or rent personal information.

Who handles your information for us

• Cloudflare hosts the website and stores your account, intake details and uploaded documents (Cloudflare D1 database and R2 storage). Our document storage is private and not reachable from the public internet; files are served only to you while you’re signed in, and to us.
• Stripe processes your $350 payment.
• When you email us, your message is handled by our email provider.

We are based in Canada, and these providers may process data in the United States and other countries. For legal review: confirm the cross-border transfer wording and list the storage locations chosen for the D1 database and R2 bucket.

How long we keep it

For legal review: decide how long intake details and uploaded documents are kept after your packet is delivered, and how long account and payment records are kept (tax and accounting rules may set a minimum).

You can ask us at any time to delete your account, intake details and documents by emailing hello@restore501.com from the address on your account.

Your choices and rights

Email us to ask for a copy of the information we hold about you, to correct it, or to delete it. For legal review: confirm the rights and regulator references that apply (for example Canada’s PIPEDA and the Office of the Privacy Commissioner of Canada, and any US state laws).

How we protect it

The site is served only over HTTPS. Passwords are hashed, sessions use secure, HTTP-only cookies, and login attempts are rate-limited. Uploaded documents sit in private storage, organized by account, and every download is checked against the signed-in account. Only Restore501’s owner can see all intakes.

Changes to this policy

If we change how we handle your information, we’ll update this page and the date at the top.

Contact