Privacy Policy — Donorbook

1. Who We Are

Donorbook ("Donorbook", "we", "us") is the data controller for personal data we collect about you when you use our platform. Contact: legal@donorbook.co.uk.

Important distinction: When you upload your donors' personal data to the Service, you are the data controller for that data and we act as your data processor. This Privacy Policy covers the data we collect about you as a user of the platform.

2. Data We Collect About You

Account data

Name and email address (provided at registration)
Organisation name, web address, and contact email
Date and version of Terms and Privacy Policy acceptance
Billing information (held by our payment processor; we do not store card numbers)

Usage data

Log data: browser type, IP address, pages visited, timestamps
Feature usage patterns (aggregated, for product improvement)
API key activity (key prefix, last-used timestamp — not the key itself)

Data you process on behalf of your organisation

Donor records, donation amounts, Gift Aid declarations, and email campaign content are processed by us as your data processor under your instructions. We do not use this data for our own purposes.

3. Legal Basis for Processing

Contract: Processing your account data to provide the Service you've signed up for
Legitimate interests: Service security, fraud prevention, product improvement
Legal obligation: Retaining financial records as required by HMRC
Consent: Marketing communications (you may withdraw at any time)

4. How We Use Your Data

To provide, operate, and improve the Service
To send transactional emails (account confirmation, password reset, invoices)
To send product updates and feature announcements (opt-out available)
To detect and prevent fraud and security incidents
To comply with legal obligations

5. Data Sharing

We share your data only with:

Supabase Inc. — our database and authentication infrastructure (EU data residency)
Resend Inc. — transactional email delivery
Stripe Inc. — payment processing (PCI-DSS compliant)
Vercel / hosting provider — application hosting

We do not sell, rent, or share your personal data with third parties for marketing purposes.

6. Your Rights Under UK GDPR

You have the right to:

Access: Request a copy of the personal data we hold about you
Rectification: Ask us to correct inaccurate data
Erasure: Ask us to delete your data (subject to legal retention obligations)
Portability: Receive your data in a machine-readable format
Restriction: Ask us to limit how we process your data
Objection: Object to processing based on legitimate interests

To exercise any of these rights, email legal@donorbook.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Data Transfers

Your data is stored in the European Union (eu-west-1). Where transfers to the United States occur (e.g. for email delivery), we rely on Standard Contractual Clauses approved by the UK ICO.

8. Cookies

We use session cookies for authentication (strictly necessary) and may use analytics cookies to understand platform usage. You can disable non-essential cookies in your browser settings.

9. Changes to This Policy

We will notify you of material changes to this Privacy Policy with at least 14 days' notice via email. The current version and effective date are shown at the top of this page.