Privacy Notice

This Privacy Notice explains how CharityFront ("we", "us") handles personal information when you use our website, charity dashboards, and the public donation storefronts we host on behalf of charities (each a "CharityFront").

When a charity uses CharityFront to run its storefront, that charity is the controller of supporter and donor data it collects, and CharityFront acts as its processor. For our own website, accounts and billing, CharityFront is the controller.

Information you give us

• Account details: name, email address, password, organisation and role.
• Charity profile details: legal name, registration number, description, logos and imagery.
• Donation details: amount, currency, campaign, Gift Aid or Zakat declarations and any message you add.
• Supporter sign-ups: name, email, and anything you submit through forms on a storefront.
• Support requests and correspondence you send to us.

Information collected automatically

• Device and browser type, approximate location derived from IP, and referring source.
• Pages viewed, blocks clicked, and other product analytics events.
• Cookies and similar technologies as described below.

Information from third parties

• Payment and payout status from our payment processor.
• Email delivery events (delivered, opened, bounced) from our email provider.
• Public profile data from social or ticketing platforms a charity chooses to connect.

We do not store full card numbers. Card details are collected and processed directly by our payment processor, Stripe, under its own privacy policy. We receive only limited information such as the amount, currency, the last four digits, the outcome of the payment, and the donor's name and email where provided.

• To provide, secure and improve CharityFront and its features.
• To process donations and send receipts, thank-you emails and updates.
• To give charities analytics and reporting about their own storefront.
• To manage accounts, subscriptions, invoicing and support.
• To detect, prevent and investigate fraud, abuse and security incidents.
• To comply with legal, accounting, charity-regulatory and tax obligations.

Where UK or EU data protection law applies, we rely on: performance of a contract (providing the service and processing donations), legitimate interests (securing the platform, improving the product, and basic analytics), consent (non-essential cookies and certain marketing), and legal obligation (tax, Gift Aid and financial record keeping).

We share personal information only as needed to run the service:

• With the charity whose storefront you interacted with.
• With service providers: hosting, database, payments, email delivery and analytics.
• With integrations a charity chooses to enable, such as shops, ticketing or CRM tools.
• Where required by law, regulation or valid legal process.
• In connection with a merger, acquisition or sale of assets, subject to this notice.

We do not sell personal information.

We use essential cookies to keep you signed in and to protect the service, and limited analytics to understand how storefronts perform. Analytics events are aggregated for charity reporting and exclude known bots and crawlers. You can control cookies through your browser settings; blocking essential cookies may break parts of the service.

We keep personal information for as long as an account or storefront is active, and afterwards only as long as needed for the purposes described here, including legal, tax and accounting requirements. Donation and financial records are typically retained for at least six years. Analytics events are retained in aggregated form.

Data is encrypted in transit, access to production data is restricted to authorised staff, and charity data is isolated per organisation with row-level access controls. No system is perfectly secure, so we also maintain processes to detect and respond to incidents.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal information, to portability, and to withdraw consent.

If your request relates to data a charity collected through its storefront, contact that charity first. You can also contact us and we will help route the request. You have the right to complain to your local data protection authority, in the UK the Information Commissioner's Office.

Our providers may process data outside your country. Where that happens, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

CharityFront is not directed at children under 16. We do not knowingly collect their personal information. If you believe a child has provided data, contact us and we will delete it.

We may update this notice from time to time. Material changes will be highlighted on this page, and the "last updated" date above will change.

Questions or privacy requests can be sent to privacy@charityfront.com.