Privacy policy

Who is responsible

This website (cubanew.com, the New Cuba Opportunity Atlas) is published by QvaPay, Inc., 818 Leahy Cir, Des Plaines, IL 60016, United States. Gifts made through God Bless Cuba on this site are received and processed by DFXDataCorp, a Delaware corporation, 132 Barbaree Way, Tiburon, CA 94920, United States. For anything in this policy, write to godblesscuba@qvapay.com.

Information we collect

When you give through God Bless Cuba: your name, email address, country, the charity you chose, the amount, the payment method, whether you chose to show your name publicly, the four compliance statements you ticked and when, the country derived from your IP address, and the payment reference returned by the processor. If you pay by wire or bank transfer, the sender name and reference your bank attaches to the transfer.

Payment details: card numbers, bank credentials, PayPal and crypto wallet credentials go directly to the payment processor (Stripe, QvaPay, PayPal, your bank). They never reach our servers and we never see them.

When you use the contact form: your name, email address and message.

Automatically: standard web-server logs at our hosting provider (IP address, browser, pages requested, time). We use your IP address only to limit abusive request rates. We set no cookies, run no analytics and use no advertising trackers.

How we use it

• To process your gift, send your receipt, keep the ledger that tracks every dollar to its charity, and remit the money to the charity’s QvaPay account.
• To meet U.S. sanctions and anti-fraud obligations: the compliance statements, country and payment references are kept as the record that each gift was authorized under 31 CFR Part 515.
• To answer you, resolve refunds and disputes, and prevent abuse of the site.
• If you opted in, to show your name on the public donor list for the charity you supported.

Who we share it with, and how

We share personal information only as needed to run the service, and only over encrypted connections (TLS) to the recipient’s own API or dashboard:

• Payment processors: Stripe (card, Apple Pay, Google Pay, ACH; receives your email and amount), QvaPay and its PayPal merchant SkyMind LLC (PayPal, crypto, QvaPay balance, bank transfer; receives the amount and your compliance statements), and Meow (banking platform that receives wires and ACH sent to DFXDataCorp; sees what your bank sends).
• The charity you chose: receives the remitted amount. It sees your name only if you chose to show it publicly.
• Service providers: Netlify (hosting and the Postgres database, operated by Neon) and Zoho Mail (receipts and support email), each under its own privacy terms and only to provide its service.
• Regulators and law enforcement: when U.S. law requires it, including requests from the U.S. Treasury’s Office of Foreign Assets Control.

We do not sell personal information, do not share it for advertising, and do not share it with anyone else.

How we protect it

• All traffic to the site and to every processor uses TLS encryption.
• Payment credentials never touch our systems; payment pages are served by the processors.
• The donation ledger lives in an access-controlled Postgres database; the admin console requires authentication and is restricted to the small team that operates God Bless Cuba.
• API keys and secrets are stored in the hosting provider’s encrypted environment store, never in code.
• Webhooks from processors are verified by signature before anything is recorded; receipts are sent exactly once per gift.

How long we keep it

Donation records, including the compliance statements, are kept for ten years after the gift, the period U.S. sanctions recordkeeping rules require (31 CFR 501.601). Contact-form messages are kept for two years. Server logs are kept by the hosting provider for a short rolling period.

Your choices

• Email godblesscuba@qvapay.com to receive a copy of the personal information we hold about you, to correct it, or to ask for deletion. We delete what the law does not require us to keep.
• You can take your name off the public donor list at any time by email.
• You can give without showing your name; the box is unticked by default.

Children

The service is for adults. We do not knowingly collect information from anyone under 18.

Changes

We will post any change here with a new effective date. Material changes to how gifts are processed will also be noted on the God Bless Cuba page.