Legal
Last updated: 1 October 2026
This Privacy Policy explains how Impacturi (operated by Clickonic Ltd, trading as Impacturi) collects, uses, and protects personal data. It is written to comply with the UK General Data Protection Regulation and the Data Protection Act 2018.
The data controller for the information we hold about you as a user of this platform is Clickonic Ltd, a company registered in England & Wales. Our trading name is Impacturi. You can contact us at dermot@clickonic.co.
When you upload donor records to the platform, you are the data controller for that donor data and we are the data processor acting on your instructions. The terms of that processing relationship are set out in our Data Processing Agreement.
As a user of the platform we collect:
| Purpose | Legal basis |
|---|---|
| Provide and operate the platform | Contract (Article 6(1)(b)) |
| Take payment and manage subscriptions | Contract (Article 6(1)(b)) |
| Keep the platform secure, monitor for abuse and errors | Legitimate interests (Article 6(1)(f)) |
| Comply with tax, accounting, and anti-money-laundering law | Legal obligation (Article 6(1)(c)) |
| Send service notifications (e.g. renewal due, security alerts) | Contract and legitimate interests |
We do not sell your personal data. We share it only with the sub-processors listed in our Data Processing Agreement, which are required to provide the platform. These include Supabase (hosting, database, authentication, encrypted key vault. Ireland), Vercel (application hosting. EU and US edge), Stripe (payments. UK and EU), OpenAI (AI creation assistant. US, under appropriate transfer safeguards), Anthropic (AI monitoring and triage assistant. US, under appropriate transfer safeguards), Sentry (error monitoring. EU), and Resend (transactional and notification email delivery. US, under appropriate transfer safeguards).
Two further services measure use of this website rather than process charity or donor records: Google Analytics, which runs only if you accept the cookie notice, and Vercel Web Analytics, which sets no cookies and is described in section 8 below. Neither has access to the platform database.
Primary data storage is in the Republic of Ireland (eu-west-1). Where a sub-processor is based outside the UK or EU (for example OpenAI, for the AI writing feature), transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent safeguard.
Set out in full in our Data Retention Policy. In summary: we keep account and donor data while your subscription is active and delete within 30 days of closure. Billing records are kept for 7 years (HMRC requirement). Error logs are held on a rolling 90-day window. After deletion, data can still sit in an encrypted database backup for up to 8 days, and an uploaded file in a private weekly copy for up to about 12 weeks, before those age out.
Under UK GDPR you have the right to:
To exercise any of these rights, email dermot@clickonic.co. We will respond within 30 days.
Impacturi sets essential cookies to keep you signed in and to remember your cookie choice. These do not need your consent.
If you accept analytics cookies, we use Google Analytics to learn how people use our website and the Impacturi dashboard, so we can improve them. It records which pages are opened and which features are used, such as viewing the pricing page, starting a free trial, creating or approving an impact web page or sending it to donors.
It never records names, email addresses, charity or donor names, voucher codes or anything anyone types, and page addresses are recorded without any record number in them. Google Analytics is never used on the impact web pages that donors open, on pages reached by a link or token we send, on unsubscribe pages or in emails.
Google Analytics sets cookies whose names begin with _ga. They last up to six months. We keep advertising consent denied and Google signals switched off in our tag, so we do not ask Google to use this for advertising. When you accept analytics, Google receives your IP address, and details of your browser and device, along with this information.
For this analytics data, Impacturi decides how this data is used. Impacturi is a trading name of Clickonic Ltd. We rely on your consent for these cookies and for the analytics they make possible. Google may process this data in the United States and other countries. Transfers from the UK are made under the approved transfer mechanisms described under international transfers.
You choose whether to accept or reject analytics cookies when you first visit. You can change your choice at any time using the Cookie settings link at the foot of the page. If you withdraw your consent, analytics stops straight away and we remove the Google Analytics cookies from your browser. We ask again after six months.
If you accept analytics cookies, we use Google Analytics to learn how people use our website and the Impacturi dashboard, so we can improve them. It records which pages are opened and which features are used, such as viewing the pricing page, starting a free trial, creating or approving an impact web page or sending it to donors.
When you accept analytics, Google receives your IP address, and details of your browser and device, along with this information.
It never records names, email addresses, nonprofit or donor names, voucher codes or anything anyone types, and page addresses are recorded without any record number in them. Google Analytics is never used on the impact web pages that donors open, on pages reached by a link or token we send, on unsubscribe pages or in emails.
For this analytics data, Impacturi decides how this data is used. Impacturi is a trading name of Clickonic Ltd. We do not sell this information, and we do not share it for cross-context behavioral advertising. Google may process this data in the United States and other countries.
You choose whether to accept or reject analytics cookies when you first visit. You can change your choice at any time using the Cookie settings link at the foot of the page. If you withdraw your consent, analytics stops straight away and we remove the Google Analytics cookies from your browser. We ask again after six months.
We also use Vercel Web Analytics to count page views. It sets no cookies and stores nothing on your device, so it runs whether or not you accept the cookie notice. Counting a page view does involve processing your request, including your IP address. We do not use it to identify you, and it does not follow you across other websites.
The technical and organisational measures we take to protect your data are described in our Data Security Policy. In the event of a personal data breach affecting you, we will notify you within 24 hours of discovery, in line with our Incident Response Plan.
We may update this policy from time to time. Material changes will be notified by email to account holders at least 30 days in advance of the change taking effect. The “Last updated” date at the top of this page is authoritative.
If you are unhappy with how we have used your personal data, or with how we handled a request about it, you can complain to us directly. Email dermot@clickonic.co with “Data protection complaint” in the subject line. Tell us who you are, what happened and what you would like us to do. You do not need to use a special form.
What happens next:
If you are not happy with our response, you can complain to the Information Commissioner's Office (ICO), the UK regulator for data protection, at ico.org.uk/make-a-complaint.
Questions about this policy, or to exercise any of your rights, email dermot@clickonic.co.