Privacy notice

Who we are

This website is run by Servants of Vulnerable People International (SVPI), which is being established as a non-profit organisation in the United States. SVPI is responsible for the personal information collected through this site. Privacy contact: info@svp-int.org.

We handle personal information in line with the laws of the United States that apply to us, and with recognised international data protection principles. We collect only what we need, keep it secure and delete it when it is no longer needed.

When you visit this website

We use no analytics, advertising, tracking pixels or social-media embeds. Our own scripts set no cookies and use no local storage. Fonts and images come from our own site.

We have not switched on visitor logging for this website. Our host, Cloudflare, still processes technical data needed to deliver and secure the site, such as your IP address and browser information.

When you email us or use the partner form

Our partner form opens your own email app with a pre-filled message. Nothing is sent to the website. We receive the information you email us: your name, email address, optional organisation, area of interest and message.

Emails sent to us are held by Google (Google Workspace), our email provider. See Google’s privacy policy.

We do not accept online donations.

When you use the grievance response mechanism (GRM)

We offer forms for feedback or a problem with aid and to report misconduct, in English and Myanmar language.

What we ask for

• A topic from a fixed list, a message of 10–3000 characters in any language, and a confirmation box are required.
• You may give a time band and a general area, at state or region level only. You can choose “Prefer not to say”, or “Other” for the area. We never ask for a village, township or exact location.
• You may give an email address or phone contact for a reply, a name or nickname and a preferred reply language.
• The misconduct form has an optional box to indicate that the report concerns our leadership. There are no file uploads.

You can report anonymously. The form is set to “No, stay anonymous” unless you choose otherwise, and you do not need to give a name or contact details. Details in your message could still identify you or someone else, so please avoid naming people unless it is needed.

What we store and protect

We store a case reference shown to you, report type, topic, time band, area, reply preference, leadership box, form language, date received (day only) and case status.

We encrypt your message, contact details, name and preferred reply language before storing them. The decryption key is held separately from the database.

We do not store your IP address, browser information or the exact time of your report. To prevent repeated attempts (more than five a minute), our system briefly turns your IP address into a one-way code, using a secret value that changes every day. Neither your address nor that code is saved with your report or in our database.

Bot check

Cloudflare Turnstile runs in your browser on both report pages. A report cannot be sent without passing this check; our server sends the resulting token to Cloudflare for confirmation.

Cloudflare processes signals including your IP address, browser details and technical connection signals to distinguish people from bots. Cloudflare says Turnstile does not access, store or transmit form entries. It checks for bots on our behalf and also uses data to improve Turnstile for its own purposes. See Cloudflare’s Turnstile privacy addendum.

Who can see reports

Reports can be read only by a small designated team, on a need-to-know basis. The encrypted details can be read only with a decryption key held by that team. The other details listed above are stored without encryption.

As the confirmation box on the form explains, only the small team that handles complaints will see your report. If it involves a serious risk to someone’s safety, it may be shared with people who can protect them; we will tell you first if it is safe to do so.

If an internal alert is sent, it contains only the case reference and report type, never the report content.

Service providers

Cloudflare hosts our website. See Cloudflare’s privacy policy for its handling of technical data.

Reports are stored in a database provided by Cloudflare.

How long we keep information

We keep emails only for as long as we need them for the purpose they were sent. There is no fixed period.

We keep GRM reports for one year from the date we receive them. They are then deleted automatically, including the encrypted details.

Your choices and rights

Wherever you are, you can ask us to access, correct or delete information you have given us, or object to how we use it, by emailing info@svp-int.org. If you are in the European Economic Area (EEA) or the UK, you may also have rights under the GDPR or UK GDPR, including the right to complain to your local data protection authority.

We cannot link an anonymous report back to you unless you give us its case reference.

Contact and changes

For privacy questions, email info@svp-int.org.

Last updated 18 October 2026