Legal
Last updated: 13 August 2026
This Privacy Policy explains how Impacturi (operated by Clickonic Ltd, trading as Impacturi) collects, uses, and protects personal data. It is written to comply with the UK General Data Protection Regulation and the Data Protection Act 2018.
The data controller for the information we hold about you as a user of this platform is Clickonic Ltd, a company registered in England & Wales. Our trading name is Impacturi. You can contact us at data@impacturi.com.
When you upload donor records to the platform, you are the data controller for that donor data and we are the data processor acting on your instructions. The terms of that processing relationship are set out in our Data Processing Agreement.
As a user of the platform we collect:
| Purpose | Legal basis |
|---|---|
| Provide and operate the platform | Contract (Article 6(1)(b)) |
| Take payment and manage subscriptions | Contract (Article 6(1)(b)) |
| Keep the platform secure, monitor for abuse and errors | Legitimate interests (Article 6(1)(f)) |
| Comply with tax, accounting, and anti-money-laundering law | Legal obligation (Article 6(1)(c)) |
| Send service notifications (e.g. renewal due, security alerts) | Contract and legitimate interests |
We do not sell your personal data. We share it only with the sub-processors listed in our Data Processing Agreement, which are required to provide the platform. These include Supabase (hosting, database, authentication, encrypted key vault. Ireland), Vercel (application hosting. EU and US edge), Stripe (payments. UK and EU), OpenAI (AI writing assistant. US, under appropriate transfer safeguards), Anthropic (AI monitoring and triage assistant. US, under appropriate transfer safeguards), Sentry (error monitoring. EU), and Resend (transactional and notification email delivery. US, under appropriate transfer safeguards).
Two further services measure use of this website rather than process charity or donor records: Google Analytics, which runs only if you accept the cookie notice, and Vercel Web Analytics, which sets no cookies and is described in section 8 below. Neither has access to the platform database.
Primary data storage is in the Republic of Ireland (eu-west-1). Where a sub-processor is based outside the UK or EU (for example OpenAI, for the AI writing feature), transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent safeguard.
Set out in full in our Data Retention Policy. In summary: we keep account and donor data while your subscription is active and delete within 30 days of closure. Billing records are kept for 7 years (HMRC requirement). Error logs are held on a rolling 90-day window. After deletion, data can still sit in an encrypted database backup for up to 8 days, and an uploaded file in a private weekly copy for up to about 12 weeks, before those age out.
Under UK GDPR you have the right to:
To exercise any of these rights, email data@impacturi.com. We will respond within 30 days.
We use a minimal set of cookies. A session cookie set by Supabase keeps you signed in (strictly necessary). A small browser-storage flag records the choice you made on our cookie notice. We use Google Analytics to count visits, and its cookies are only set if you choose OK on that notice: choose Reject, or ignore it, and no analytics cookie is created and no request is made to Google. We do not use advertising cookies or cross-site tracking.
We also use Vercel Web Analytics to count page views. It sets no cookies and stores nothing on your device, so it runs whether or not you accept the cookie notice. Counting a page view does involve processing your request, including your IP address. We do not use it to identify you, and it does not follow you across other websites.
The technical and organisational measures we take to protect your data are described in our Data Security Policy. In the event of a personal data breach affecting you, we will notify you within 24 hours of discovery, in line with our Incident Response Plan.
We may update this policy from time to time. Material changes will be notified by email to account holders at least 30 days in advance of the change taking effect. The “Last updated” date at the top of this page is authoritative.
Questions about this policy, or to exercise any of your rights, email data@impacturi.com.