Privacy policy

1. Introduction

CommuniTie is run by Bryn Powell during its pilot. Bryn Powell is the controller responsible for your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

This notice explains our handling of personal information; using the site is not blanket consent. We use account and donation information to provide the service, rely on legitimate interests for proportionate security and support, and comply with applicable legal obligations. Where we rely on consent, you can withdraw it.

2. Information we collect

2.1 Information you provide

When you create an account and use CommuniTie, you may provide:

• Account Information: Name, email address, password
• Profile Information: Organization name, business name, logo, description, location, contact details
• Donation Evidence: Receipts, invoices, delivery confirmations and thank-you materials you upload. Please redact unnecessary personal or payment information.
• Listings: Wishlist and surplus descriptions, images, quantities and values
• Communications: Messages sent through the Platform, proof of posting images, social media links

For wishlist gifts, we record the business reasons selected when the business commits, the commitment time and the purchase's hold and receipt status. Where postcodes are available, the record can include the business and recipient postcode and an approximate straight-line distance. We also keep dated records of recognition on CommuniTie, newsletter wording provided, and a school's or charity's statement that it shared a social post or newsletter item.

2.2 Information we collect automatically

When you use CommuniTie, we automatically collect:

• Operational Records: Sign-in sessions, request logs, relevant account actions and recorded donor-link clicks
• Device Information: IP address, browser type, operating system, device type
• Cookies and Similar Technologies: We use cookies to enhance your experience (see Section 8)

2.3 Information from third parties

We may receive information about you from:

• Authentication Providers: If you sign in through Google or other OAuth providers
• Public Sources: Publicly available information about your business or organisation

3. How we use your information

We use your information to:

• Provide the Service: Enable wishlists, surplus donations, delivery confirmation, thank-yous and messaging
• Record Donations: Maintain donation history and evidence for the organisations involved
• Connect People: Match Donors with Receivers and enable communication
• Send Notifications: Provide in-app updates, and emails where they are switched on, about donations and messages
• Display Public Profiles: Show business and organisation profiles, supporter boards, and achievement badges
• Improve the Platform: Analyze usage patterns, identify bugs, and develop new features
• Ensure Security: Detect fraud, prevent abuse, and protect user safety
• Comply with Legal Obligations: Respond to legal requests and enforce our Terms of Service
• Customer Support: Respond to your inquiries and provide assistance

4. How we share your information

We may share your information in the following circumstances:

4.1 With other users

• Profile and location visibility follow your selected privacy settings
• Donation participants receive the information needed to arrange and record their donation
• Private messages and receipts are available to the parties involved and authorised administrators. Donor preferences and flags are not public
• Community Supporters entries are public when businesses choose to appear; businesses can opt out in their privacy settings

Thank-you sharing choices

Sharing a thank-you with your donor does not automatically permit public reposting. Recipients choose separately whether the donor may share it publicly and whether CommuniTie may share it on its website and social media. Both choices start unticked for new content. Neither is required to receive donations or use the Platform. Uploaders must have the necessary permissions for the content and anyone identifiable in it.

Use “Change public sharing choices” beside a submitted thank-you to withdraw either permission. CommuniTie website access then follows the updated choice. Where permission is withdrawn, the donor or CommuniTie administrators receive an in-app notice to address copies already published under that permission; external posts are not automatically recalled. Contact us for help, including if you are pictured in content uploaded by someone else. We record the choices, the account making them, the time and the permission wording version.

Business reasons and accounting evidence remain under the business's existing access controls. A dated sharing entry records what happened on CommuniTie or what the school or charity says it shared; it does not independently verify publication elsewhere or measure an audience. Thank-you reuse follows the separate sharing permissions selected for that content.

4.2 With service providers

We share information with trusted third-party service providers who assist in operating the Platform:

• Application and File Hosting: Vercel hosts the platform and its private receipt and thank-you storage
• Optional analytics: Google Analytics receives site-usage and technical information only after you accept analytics. You can withdraw this choice using Cookie settings.
• Database: Neon hosts the PostgreSQL database. Historical uploaded files may remain with the previous Anything/Mocha infrastructure while migration is completed
• Authentication: Google receives sign-in information if you choose Google sign-in

Postcode lookups

We use postcodes.io to look up postcode locations for local donation records. The lookup sends the relevant postcode to that service; it does not send your name, business reasons, receipt or thank-you content. We save the approximate distance when available so it is not looked up each time the record is viewed. This is an estimate between postcode locations, not a journey distance.

4.3 For legal reasons

We may disclose your information if required by law or if we believe it's necessary to:

• Comply with legal obligations, court orders, or government requests
• Enforce our Terms of Service
• Protect the rights, property, or safety of CommuniTie, our users, or others
• Investigate fraud or security issues

4.4 Business transfers

If CommuniTie is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data retention

If a business holds a wish but does not buy it, we delete the business reasons, postcodes and distance saved with that hold after 6 months.

We keep personal information only while it is needed for the purpose for which it was collected. There is no blanket seven-year retention period for every account, message or photograph.

• Account details: kept while the organisation uses the service, subject to deletion requests and reviews of continued need. Expired sign-in sessions and verification records are scheduled for removal seven days after expiry.
• Core donation facts and necessary accounting evidence: normally up to seven years after the donation, to support participants’ accounting and evidence needs. This does not apply to every message, photograph or profile field. We consider earlier erasure requests and explain any specific justified exception.
• Conversations remain available for ongoing relationships after a donation completes. We review conversations after 24 months without a message, and thank-you photos and letters after two years, to remove unnecessary personal information or document a continuing need. Authority letters are reviewed for removal 90 days after the verification decision.
• Unattached managed uploads are scheduled for removal after 30 days without a new upload token. Referenced donation files are excluded. Removing a stored file requires provider verification; historical files with uncertain ownership or provider access require review.
• Deletion records: minimal account references and file-removal markers prevent erased data being reintroduced by a backup restore. We keep them until relevant retained backups and exports can no longer reintroduce that data, plus a 30-day reconciliation margin; unresolved provider-copy exceptions are reviewed monthly.

If information must be retained, we explain what remains, the reason and the next review or deletion date. Backup copies may persist until the provider replaces them. They must remain beyond routine use; a restore must reapply completed erasures before the service reopens. Provider backup expiry and historical file removal are still being verified during the pilot. Scheduled housekeeping is prepared but not yet activated; review-based retention and legacy-file exceptions remain the operator’s responsibility during the pilot.

6. Your rights and choices

You have the following rights regarding your personal information:

6.1 Access and portability

You can access most of your information through your account dashboard. You can also request a copy of your data in a portable format.

6.2 Correction

You can update your profile information at any time through your account settings.

6.3 Deletion

Use Data & Privacy in your profile to request deletion. Straightforward requests are processed automatically; cases involving linked records, uploads or uncertain account ownership enter a review queue. You can check the status and cancel a pending request. Completed deletion cannot be undone. During the pilot, this is an organisation account-deletion request. If a staff member is leaving or ownership needs to change, contact us rather than deleting the organisation’s account. You can also make a request by contacting us, without using this form. We respond without undue delay, normally within one calendar month. If an exception applies, we explain it and your right to complain to the ICO or seek a judicial remedy.

6.4 Marketing communications

You can opt out of marketing emails by clicking the unsubscribe link in any marketing email. You cannot opt out of transactional emails related to your use of the Platform.

6.5 Cookies

You can control cookies through your browser settings. However, disabling cookies may limit Platform functionality.

7. Data security

We implement appropriate technical and organisational measures to protect your information:

• Encryption of data in transit (HTTPS/TLS)
• Encrypted storage of sensitive data
• Access controls and authentication requirements
• Passwords are hashed; sign-in sessions are revoked when an account is erased

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Cookies and tracking technologies

We use cookies and similar technologies to:

• Essential Cookies: Required for Platform functionality (authentication, security)
• Cookie choice: We store your analytics choice in this browser’s local storage for 180 days. This is used to remember your privacy preference.
• Optional analytics: With your consent, Google Analytics uses cookies (including _ga and _ga_ identifiers) to understand visits and site usage. These cookies are configured to last up to 180 days. Google receives technical and usage information when analytics is enabled. Advertising storage, advertising personalisation and Google signals are disabled in our tag configuration.

Google Analytics does not load until you select “Accept basic analytics”. “No thanks” leaves the site fully available. Use “Cookie settings” at the bottom of any page to change your choice. Withdrawing consent stops further Analytics collection and removes Analytics cookies accessible to this site; it does not undo information already collected. If browser storage is unavailable, your choice applies only to the current page visit. Essential sign-in cookies remain necessary for account access.

9. Children's privacy

Accounts are for adults acting for businesses, schools and charities. Please favour photographs of donated items, activities without identifiable children, or authorised adult staff. Do not upload identifiable children or their personal information without the appropriate permission. Permission to share privately with a donor is separate from permission for public reuse. Contact us promptly about any child’s information that should be removed.

10. International data transfers

Your information may be transferred to and processed in countries outside your country of residence. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable data protection laws.

11. Changes to this privacy policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on the Platform
• Updating the "Last updated" date
• Using an appropriate direct notice where required for a significant change

An updated notice does not replace consent where consent is required.

12. Your UK/EU data protection rights

If you are located in the UK or EU, you have additional rights under the UK GDPR and EU GDPR:

• Right to access: Request a copy of your personal data
• Right to rectification: Correct inaccurate personal data
• Right to erasure: Request deletion of your personal data
• Right to restrict processing: Limit how we use your data
• Right to data portability: Receive your data in a structured format
• Right to object: Object to certain types of processing
• Right to withdraw consent: Withdraw consent for data processing at any time
• Right to lodge a complaint: Contact the UK Information Commissioner’s Office (ico.org.uk) or your applicable supervisory authority

13. Contact us

If you have questions about this Privacy Policy or our data practices, please contact us: