Legal

Privacy Policy

Last updated: 7 October 2026

This Privacy Policy explains how Impacturi (operated by Clickonic Ltd, trading as Impacturi) collects, uses, and protects personal data. It is written to comply with the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Who we are

The data controller for the information we hold about you as a user of this platform is Clickonic Ltd, a company registered in England & Wales. Our trading name is Impacturi. You can contact us at dermot@clickonic.co.

When you upload donor records to the platform, you are the data controller for that donor data and we are the data processor acting on your instructions. The terms of that processing relationship are set out in our Data Processing Agreement.

2. What data we collect about you

As a user of the platform we collect:

Account details: name, email, organisation name, account type (charity or corporate)
Authentication data: hashed password, session tokens
Billing data: handled by Stripe. We store a Stripe customer ID, subscription status, and renewal dates. We never see or store your card details.
Platform activity: pages you create, media you upload, feedback you send, error logs
Technical data: IP address, browser type, device type, and timestamps (collected by our hosting and error-monitoring providers)

3. Why we process it (and the legal basis)

Purpose	Legal basis
Provide and operate the platform	Contract (Article 6(1)(b))
Take payment and manage subscriptions	Contract (Article 6(1)(b))
Keep the platform secure, monitor for abuse and errors	Legitimate interests (Article 6(1)(f))
Comply with tax, accounting, and anti-money-laundering law	Legal obligation (Article 6(1)(c))
Send service notifications (e.g. renewal due, security alerts)	Contract and legitimate interests

4. Who we share it with

We do not sell your personal data. We share it only with the sub-processors listed in our Data Processing Agreement, which are required to provide the platform. These include Supabase (hosting, database, authentication, encrypted key vault. Ireland), Vercel (application hosting. EU and US edge), Stripe (payments. UK and EU), OpenAI (automated writing services that screen and check the text of impact pages, and write it where selected. US, under appropriate transfer safeguards), Anthropic (automated writing services that write the shared monthly story and check pages, and a monitoring and triage assistant. US, under appropriate transfer safeguards), Sentry (error monitoring. EU), and Resend (transactional and notification email delivery. US, under appropriate transfer safeguards).

Brandfetch. To show the logo of a charity, or the logo and brand colours of a company that supports it, we may send that organisation’s website domain name (for example, example.org) to Brandfetch, a brand information service. Brandfetch receives the domain name only. It never receives a person’s name, email address or anything else about donors, supporters or the people a charity helps.

Google favicon service. If we cannot find a logo on an organisation’s own website, we may ask Google’s favicon service for that website’s icon, sending only the website domain name. A link to the icon may then be saved as the organisation’s logo, and when a charity’s own screens show it, the charity’s browser loads it from Google, which then receives the details any website receives from a browser, such as its IP address. We never send Google a person’s name, email address or anything else about donors, supporters or the people a charity helps.

Clearbit logo service. If we cannot find a logo on a charity’s own website, we may ask Clearbit’s logo service for one, sending only the website domain name. If Clearbit has a logo, a link to it may be saved as the charity’s logo. Wherever that logo is shown, including on pages a charity shares with its donors, the viewer’s browser loads it from Clearbit, which then receives the details any website receives from a browser, such as its IP address. We never send Clearbit a person’s name, email address or anything else about donors, supporters or the people a charity helps.

Two further services measure use of this website rather than process charity or donor records: Google Analytics, which runs only if you accept the cookie notice, and Vercel Web Analytics, which sets no cookies and is described in section 8 below. Neither has access to the platform database.

5. International transfers

Primary data storage is in the Republic of Ireland (eu-west-1). Where a sub-processor is based outside the UK or EU (for example OpenAI and Anthropic, for the services that help write and check impact pages), transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent safeguard.

6. How long we keep it

Set out in full in our Data Retention Policy. In summary: we keep account and donor data while your subscription is active and delete within 30 days of closure. Billing records are kept for 7 years (HMRC requirement). Error logs are held on a rolling 90-day window. After deletion, data can still sit in an encrypted database backup for up to 8 days, before it ages out. We do not currently promise a separate copy of uploaded files, and set no fixed period for one: see our Data Retention Policy.

7. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you
Have inaccurate data corrected
Have data deleted (“right to be forgotten”)
Restrict or object to processing
Have your data exported in a portable format
Withdraw consent where processing is based on consent
Complain to us about how we use your data (see section 11), and to the Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, email dermot@clickonic.co. We will respond within 30 days.

8. Cookies and website analytics

Impacturi sets essential cookies to keep you signed in and to remember your cookie choice. These do not need your consent.

If you accept analytics cookies, we use Google Analytics to learn how people use our website and the Impacturi dashboard, so we can improve them. It records which pages are opened and which features are used, such as viewing the pricing page, starting a free trial, creating or approving an impact web page or sending it to donors.

It never records names, email addresses, charity or donor names, voucher codes or anything anyone types, and page addresses are recorded without any record number in them. Google Analytics is never used on the impact web pages that donors open, on pages reached by a link or token we send, on unsubscribe pages or in emails.

Google Analytics sets cookies whose names begin with _ga. They last up to six months. We keep advertising consent denied and Google signals switched off in our tag, so we do not ask Google to use this for advertising. When you accept analytics, Google receives your IP address, and details of your browser and device, along with this information.

For this analytics data, Impacturi decides how this data is used. Impacturi is a trading name of Clickonic Ltd. We rely on your consent for these cookies and for the analytics they make possible. Google may process this data in the United States and other countries. Transfers from the UK are made under the approved transfer mechanisms described under international transfers.

You choose whether to accept or reject analytics cookies when you first visit. You can change your choice at any time using the Cookie settings link at the foot of the page. If you withdraw your consent, analytics stops straight away and we remove the Google Analytics cookies from your browser. We ask again after six months.

If you use Impacturi in the United States

When you accept analytics, Google receives your IP address, and details of your browser and device, along with this information.

It never records names, email addresses, nonprofit or donor names, voucher codes or anything anyone types, and page addresses are recorded without any record number in them. Google Analytics is never used on the impact web pages that donors open, on pages reached by a link or token we send, on unsubscribe pages or in emails.

For this analytics data, Impacturi decides how this data is used. Impacturi is a trading name of Clickonic Ltd. We do not sell this information, and we do not share it for cross-context behavioral advertising. Google may process this data in the United States and other countries.

We also use Vercel Web Analytics to count page views. It sets no cookies and stores nothing on your device, so it runs whether or not you accept the cookie notice. Counting a page view does involve processing your request, including your IP address. We do not use it to identify you, and it does not follow you across other websites.

9. Security

The technical and organisational measures we take to protect your data are described in our Data Security Policy. In the event of a personal data breach affecting you, we will notify you within 24 hours of discovery, in line with our Incident Response Plan.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email to account holders at least 30 days in advance of the change taking effect. The “Last updated” date at the top of this page is authoritative.

11. How to complain about how we use your data

If you are unhappy with how we have used your personal data, or with how we handled a request about it, you can complain to us directly. Email dermot@clickonic.co with “Data protection complaint” in the subject line. Tell us who you are, what happened and what you would like us to do. You do not need to use a special form.

What happens next:

We acknowledge every complaint within 30 days of receiving it.
We investigate without undue delay. We will ask you, or anyone else involved, for any information we need, and keep you updated while we look into it.
We tell you the outcome without undue delay: what we found, and anything we are changing as a result.

If you are not happy with our response, you can complain to the Information Commissioner's Office (ICO), the UK regulator for data protection, at ico.org.uk/make-a-complaint.

12. Contact

Questions about this policy, or to exercise any of your rights, email dermot@clickonic.co.