Privacy Policy

Last updated: 10 September 2026

1. Introduction

Donation Engine (“we”, “us”, “our”) provides fundraising software and managed fundraising services to nonprofit and charitable organisations. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the choices and rights available to you.

We are based at 2875 14th Ave, Markham, Ontario L3R 5H8, Canada, and we handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the EU and UK General Data Protection Regulation (GDPR) and United States state privacy laws.

2. Two different roles

It is important to understand the two capacities in which we handle personal information.

As a controller. When you visit our website, contact us, book a call, subscribe to our updates, or act as a representative of a client organisation, we decide how your information is used. This Policy governs that activity.
As a service provider (processor). When our client organisations use our Platform to run their fundraising, donor and supporter information flows through our systems. In that case the client organisation decides how the information is used, and we process it on their documented instructions. If you donated to a charity that uses Donation Engine and wish to exercise your rights or ask how your data is used, please contact that charity directly as they are the responsible organisation. We will support them in responding to you.

3. Information we collect

3.1 Information you give us

Identity and contact details such as name, organisation, role, email address, phone number and postal address.
Account credentials and profile settings.
Information you provide in enquiry forms, discovery calls, proposals, onboarding questionnaires and support requests.
Billing and business details. Card numbers are collected and stored by our payment providers, not by us.
Content you upload to the Platform, including campaign copy, creative assets and imported contact lists.

3.2 Information collected automatically

Device and connection data such as IP address, browser type, operating system, language and referring page.
Usage data such as pages viewed, features used, links clicked, session duration and timestamps.
Cookies and similar technologies, described in section 6.

3.3 Information from third parties

Advertising and analytics platforms, which provide aggregated campaign performance data.
Payment processors, which confirm transaction status without disclosing full card details to us.
Publicly available business sources used to verify an organisation’s registration status.

4. Donor and supporter information

Where our clients use the Platform, we may process information about their donors and supporters, which can include name, contact details, donation history, campaign interactions, communication preferences and consent records.

We process this information only to deliver the services our client has asked for. We do not sell donor information, and we do not use it to build our own marketing lists, profile individuals for our own purposes, or share it with other clients. Retention, deletion and access decisions for donor information rest with the client organisation.

5. How and why we use information

We use personal information to:

provide, operate, secure and improve our website, Platform and services;
set up accounts, deliver onboarding and provide customer support;
respond to enquiries and prepare proposals;
process payments, issue invoices and prevent fraud;
send service and administrative messages about your account, security or changes to our terms;
send marketing communications where you have consented or where we are otherwise permitted to do so;
measure the performance of our own website and marketing;
comply with legal, accounting and regulatory obligations, and to establish or defend legal claims.

Where the GDPR applies, our legal bases are: performance of a contract; your consent; compliance with a legal obligation; and our legitimate interests in operating, securing and growing our business, balanced against your rights.

6. Cookies and tracking

We use cookies and similar technologies that are strictly necessary to operate the site, plus analytics and advertising technologies that help us understand traffic and measure campaigns. These may include tools provided by Meta and Google, which may set their own cookies and receive information about your visit.

You can control cookies through your browser settings, and you can opt out of interest-based advertising through the tools offered by the relevant advertising platforms. Blocking some cookies may affect how parts of the site function.

7. When we share information

We do not sell personal information. We share it only as follows:

Service providers. Hosting, infrastructure, email and messaging delivery, analytics, payment processing, CRM and support tools, each bound to protect the information and use it only for the services they provide to us.
Client organisations. Where information relates to a client’s donors or campaigns, it is made available to that client.
Professional advisers. Accountants, auditors, insurers and lawyers, where necessary.
Legal and safety. Where required by law, court order or a valid request from a public authority, or to protect the rights, property or safety of Donation Engine, our clients or the public.
Corporate transactions. In connection with a merger, acquisition, financing or sale of assets, subject to equivalent protections continuing to apply.

8. International transfers

We are based in Canada and use service providers that may store or process information in Canada, the United States and other countries. These jurisdictions may have different data protection standards, and information may be accessible to courts and public authorities under local law. Where we transfer personal information from the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as Standard Contractual Clauses.

9. Retention

We keep personal information only as long as necessary for the purposes described in this Policy, including to meet legal, tax and accounting requirements and to resolve disputes. Website enquiry records are typically retained for up to 24 months. Client account and billing records are typically retained for seven years after the relationship ends, in line with Canadian record-keeping requirements. Donor information processed on behalf of a client is retained according to that client’s instructions, and is available for export for 30 days after their agreement ends.

10. Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, least-privilege permissions, logging and regular review of our providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach that creates a real risk of significant harm, we will notify affected parties and regulators as required by law.

11. Your rights and choices

Depending on where you live, you may have the right to:

access the personal information we hold about you and receive a copy;
correct information that is inaccurate or incomplete;
request deletion, subject to our legal retention obligations;
object to or restrict certain processing, including direct marketing;
withdraw consent at any time, without affecting processing already carried out;
request portability of information you provided to us;
lodge a complaint with a supervisory authority, including the Office of the Privacy Commissioner of Canada.

If you are a California resident, you may request disclosure of the categories and specific pieces of personal information collected, request deletion or correction, and opt out of any sale or sharing of personal information. We do not sell personal information, and we will not discriminate against you for exercising your rights.

To exercise any right, email info@donationengine.io. We may need to verify your identity, and we will respond within the timeframe required by applicable law.

12. Marketing communications

We send commercial electronic messages in line with Canada’s Anti-Spam Legislation (CASL) and equivalent rules. Every marketing message includes an unsubscribe link, and we honour opt-out requests promptly. We may still send necessary service and account messages.

13. Children

Our services are directed at organisations and are not intended for children. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction). If you believe a child has provided us information, contact us and we will delete it.

14. Third-party sites

Our website and the Platform may link to third-party websites and services that we do not control. This Policy does not apply to them, and we encourage you to review their privacy notices.

15. Changes to this Policy

We may update this Policy from time to time. The “last updated” date above reflects the most recent revision. Where changes are material, we will provide additional notice by email or through the Platform.

16. How to contact us

For privacy questions, requests or complaints, contact our Privacy Officer:

Donation Engine — Privacy Officer
2875 14th Ave, Markham, Ontario L3R 5H8, Canada
Email: info@donationengine.io
Phone: 647-258-5646

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or the supervisory authority in your country of residence.