Last updated: 30 October 2026
United for Iran (U4I, we, us, or our) is a California-based nonprofit organization recognized under section 501(c)(3) of the Internal Revenue Code. This policy explains how we handle personal information when you visit united4iran.org, including its English and Persian pages, contact us through the website, subscribe to updates, or donate through the website.
We do not display advertisements on our website. We use Google Analytics to understand website use, subject to your consent as explained below. We do not sell or rent personal information or disclose it for cross-context behavioral advertising. We do not sell, rent, or exchange donor or subscriber lists.
Who is responsible and how to contact us
United for Iran is the controller responsible for the personal information described in this policy. Contact our privacy coordinator at [email protected].
This policy covers website visitors and related supporter interactions. Separate applications, project websites, employment processes, and confidential assistance or research activities may involve different data practices and additional notices. Contact us for information about a specific activity.
Information you provide
Depending on how you interact with us, we collect your name, email address, contact details, language preferences, and the information you include in messages or subscription forms. When you donate, we may receive your name, contact and billing details, donation amount and date, transaction reference, recurring-gift information, and receipt preferences from you or the payment provider.
Payments are handled by a third-party platform. Payment information is submitted to those providers under their own privacy notices. We do not automatically subscribe donors to promotional emails without the required permission.
Information collected when you visit
Our hosting and security services process technical information such as your IP address, browser and device details, requested pages, timestamps, referring pages, and error or security events to deliver and protect the website. These operational records are separate from optional Google Analytics.
If you allow analytics, Google Analytics processes cookie identifiers and information about your visits, such as pages viewed, referral sources, interactions, browser and device type, and approximate location. Google states that Google Analytics 4 does not log or store individual IP addresses. This does not mean that your visit is anonymous or that our hosting or security providers do not process IP addresses.
How we use information
We use personal information for the purposes below. Where the EU General Data Protection Regulation (GDPR) applies, we rely on the legal bases stated here.
Website delivery and security
We process technical records to serve pages, resolve errors, prevent fraud and abuse, and protect visitors and our systems. Our legal basis is our legitimate interest in maintaining a secure, functioning website, balanced against your rights and the risks of the processing. Optional analytics is not treated as necessary for website security.
Messages and supporter requests
We use contact details and message content to respond to inquiries and manage the interaction you requested. Our legal basis is our legitimate interest in communicating with people who contact us. Where the interaction is genuinely necessary to enter into or perform a contract with you, we rely on that contractual necessity instead.
Donations and records
We use donation details to administer gifts, provide receipts, respond to donor requests, prevent fraud, and maintain financial records. We rely on our legitimate interests in administering donations and maintaining accountable records, and on contractual necessity where applicable. We rely on a GDPR legal-obligation basis only where the obligation arises under applicable EU or Member State law. Other legal and accounting requirements may support retention under our legitimate interests, subject to applicable safeguards.
Newsletters and fundraising updates
We use your subscription details to send the updates and appeals you request, based on your consent where required. You may unsubscribe through any newsletter or contact us. Withdrawing permission for these messages does not stop essential communications about an existing donation or a privacy request.
Website analytics
We use Google Analytics only after you opt in through Cookie Settings. Our legal basis is consent. Analytics helps us understand which resources visitors use and improve the website. Rejecting analytics does not prevent you from reading our content, contacting us, or donating.
We configure analytics without Google Signals, advertising personalization, remarketing, or advertising audiences. We do not send names, email addresses, donation details, message text, or confidential case information to Google Analytics. We do not use analytics to infer visitors’ political opinions, religion, or other sensitive characteristics.
Your choice to provide information
You can read our public website without giving us your name or email address. Information needed to respond to a message, manage a subscription, or process a donation is identified when requested. If you do not provide required information, we may be unable to provide that particular service. Optional information and analytics consent are not required.
Sensitive information and automated decisions
Please do not submit confidential activist, survivor, legal-case, health, or other sensitive information through ordinary website forms or email. Contact us first to ask about an appropriate communication method. Providing sensitive information does not, by itself, authorize every use of that information. Any intentional collection requires an appropriate legal basis and safeguards, including an additional condition where GDPR special-category rules apply.
We do not use information covered by this policy to make solely automated decisions that produce legal or similarly significant effects on you.
Recipients and international processing
Service providers and other recipients
We disclose information as needed to providers that help us host and secure the website, deliver email, process donations, maintain supporter records, and provide IT, accounting, or professional services. We limit access to what is needed for the relevant service. Providers acting on our behalf are subject to appropriate confidentiality, security, and data-processing obligations. Payment providers may also act independently for their own fraud-prevention, regulatory, and payment functions.
Google provides our analytics service.
We may disclose information when required by applicable law or valid legal process, or where lawful and necessary to protect rights, safety, or security. We assess the scope and legal basis of disclosure requests. We may also disclose information at your specific direction. We do not publish a donor’s identity as recognition of a donation without permission.
Links and third party features
Links may take you to other websites, including payment and social-media services. Their privacy notices govern their own processing. If we offer optional embedded content that uses nonessential tracking, it remains blocked until you choose to enable it. The consent notice identifies the provider and purpose. An external link does not itself give that provider permission to track you on our website.
Processing outside your country
U4I is based in the United States. We and our providers may process information in the United States and other countries whose privacy laws differ from those in your country. Where GDPR transfer restrictions apply, we use an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, with additional protections where needed.
How long we keep information
We retain personal information only for as long as needed for its stated purpose, legal and accounting responsibilities, security needs, or the establishment, exercise, or defense of legal claims. We consider the sensitivity of the information, the risks of retaining it, and whether less information will meet the need.
Your privacy choices and rights
Choices available to all visitors
Use Cookie Settings to reject analytics or withdraw an earlier choice. Unsubscribe from email through the link in a message or contact us. You may also ask us to access, correct, or delete personal information we hold about you. We assess requests under applicable law and our commitments in this policy. We do not penalize you for exercising privacy rights.
European data protection rights
Where GDPR applies, you may request access to your personal data and a copy, correction of inaccurate or incomplete data, erasure, restriction of processing, and portability where the legal conditions are met. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct marketing at any time, including related profiling.
You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. Rights are subject to applicable conditions and exceptions, including lawful record retention and the rights of others.
Contact U4I to make a request. We may ask for proportionate information to verify your identity and locate the relevant records. Please do not send government identification or sensitive case details unless we explain why they are necessary and provide an appropriate method.
For GDPR requests, we respond without undue delay and ordinarily within one month of receipt. If a permitted extension is necessary because of complexity or the number of requests, we will explain the reason within that month; the extension may be up to two further months. Requests are ordinarily free. If an exception permits a fee or refusal, we will explain it and your options.
You may complain to a supervisory authority, particularly in the EU or EEA country where you habitually reside or work, or where you believe an infringement occurred. You do not have to contact us before making a complaint. A directory is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. You also retain applicable rights to a judicial remedy.
California visitors and browser signals
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, generally does not apply to nonprofit organizations such as U4I. This does not remove other applicable privacy obligations. The choices described in this policy remain available to California visitors, and any additional rights required by applicable law will be honored.
We do not sell personal information or share it for cross-context behavioral advertising. We do not authorize advertising networks to track visitors across websites through our site. Google receives information when you enable analytics, as described above. Other providers may process information when you choose their services.
Our website does not change its behavior in response to the older Do Not Track browser signal. Analytics requires an affirmative choice through Cookie Settings. Global Privacy Control is distinct from Do Not Track.
Security and children
We use reasonable technical and organizational measures appropriate to the information and risks, including access controls and safeguards for our service providers. No website or transmission method can guarantee complete security. If a breach triggers a legal notification obligation, we will provide required notices.
Our website is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13 through these website services. Contact us if you believe a child has provided information. Where consent for an online service must be given or authorized by a parent under applicable European law, we obtain that authorization or do not carry out the consent-based processing.
Changes to this policy
We post updates on this page and change the effective date. For material changes, we provide an appropriate prominent notice, and additional notice or renewed consent when required. Continued website use does not substitute for consent to optional tracking or another activity that requires consent.