Privacy Policy

Last updated: 16 October 2026

1. Introduction

Donation Engine (“we”, “us”, “our”) provides fundraising software and managed fundraising services to nonprofit and charitable organisations. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the choices and rights available to you.

We are based at 2875 14th Ave, Markham, Ontario L3R 5H8, Canada, and we handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the EU and UK General Data Protection Regulation (GDPR) and United States state privacy laws.

2. Two different roles

It is important to understand the two capacities in which we handle personal information.

As a controller. When you visit our website, contact us, book a call, subscribe to our updates, or act as a representative of a client organisation, we decide how your information is used. This Policy governs that activity.
As a service provider (processor). When our client organisations use our Platform to run their fundraising, donor and supporter information flows through our systems. In that case the client organisation decides how the information is used, and we process it on their documented instructions. If you donated to a charity that uses Donation Engine and wish to exercise your rights or ask how your data is used, please contact that charity directly as they are the responsible organisation. We will support them in responding to you.

3. Information we collect

3.1 Information you give us

Identity and contact details such as name, organisation, role, email address, phone number and postal address.
Account credentials and profile settings.
Information you provide in enquiry forms, discovery calls, proposals, onboarding questionnaires and support requests.
Billing and business details. Card numbers are collected and stored by our payment providers, not by us.
Content you upload to the Platform, including campaign copy, creative assets and imported contact lists.

3.2 Information collected automatically

Device and connection data such as IP address, browser type, operating system, language and referring page.
Usage data such as pages viewed, features used, links clicked, session duration and timestamps.
Cookies and similar technologies, described in section 6.

3.3 Information from third parties

Advertising and analytics platforms, which provide aggregated campaign performance data.
Payment processors, which confirm transaction status without disclosing full card details to us.
Publicly available business sources used to verify an organisation’s registration status.

4. Donor and supporter information

Where our clients use the Platform, we may process information about their donors and supporters, which can include name, contact details, donation history, campaign interactions, communication preferences and consent records.

We process this information only to deliver the services our client has asked for. We do not sell donor information, and we do not use it to build our own marketing lists, profile individuals for our own purposes, or share it with other clients. Retention, deletion and access decisions for donor information rest with the client organisation.

5. How and why we use information

We use personal information to:

provide, operate, secure and improve our website, Platform and services;
set up accounts, deliver onboarding and provide customer support;
respond to enquiries and prepare proposals;
process payments, issue invoices and prevent fraud;
send service and administrative messages about your account, security or changes to our terms;
send marketing communications where you have consented or where we are otherwise permitted to do so;
measure the performance of our own website and marketing;
comply with legal, accounting and regulatory obligations, and to establish or defend legal claims.

Where the GDPR applies, our legal bases are: performance of a contract; your consent; compliance with a legal obligation; and our legitimate interests in operating, securing and growing our business, balanced against your rights.

6. Cookies and tracking

We use cookies and similar technologies that are strictly necessary to operate the site, plus analytics and advertising technologies that help us understand traffic and measure campaigns. These may include tools provided by Meta and Google, which may set their own cookies and receive information about your visit.

You can control cookies through your browser settings, and you can opt out of interest-based advertising through the tools offered by the relevant advertising platforms. Blocking some cookies may affect how parts of the site function.

7. When we share information

We do not sell personal information. We share it only as follows:

Service providers. Hosting, infrastructure, email and messaging delivery, analytics, payment processing, CRM and support tools, each bound to protect the information and use it only for the services they provide to us.
Client organisations. Where information relates to a client’s donors or campaigns, it is made available to that client.
Professional advisers. Accountants, auditors, insurers and lawyers, where necessary.
Legal and safety. Where required by law, court order or a valid request from a public authority, or to protect the rights, property or safety of Donation Engine, our clients or the public.
Corporate transactions. In connection with a merger, acquisition, financing or sale of assets, subject to equivalent protections continuing to apply.

Mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties. See section 13.

8. International transfers

We are based in Canada and use service providers that may store or process information in Canada, the United States and other countries. These jurisdictions may have different data protection standards, and information may be accessible to courts and public authorities under local law. Where we transfer personal information from the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as Standard Contractual Clauses.

9. Retention

We keep personal information only as long as necessary for the purposes described in this Policy, including to meet legal, tax and accounting requirements and to resolve disputes. Website enquiry records are typically retained for up to 24 months. Client account and billing records are typically retained for seven years after the relationship ends, in line with Canadian record-keeping requirements. Donor information processed on behalf of a client is retained according to that client’s instructions, and is available for export for 30 days after their agreement ends.

10. Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, least-privilege permissions, logging and regular review of our providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach that creates a real risk of significant harm, we will notify affected parties and regulators as required by law.

11. Your rights and choices

Depending on where you live, you may have the right to:

access the personal information we hold about you and receive a copy;
correct information that is inaccurate or incomplete;
request deletion, subject to our legal retention obligations;
object to or restrict certain processing, including direct marketing;
withdraw consent at any time, without affecting processing already carried out;
request portability of information you provided to us;
lodge a complaint with a supervisory authority, including the Office of the Privacy Commissioner of Canada.

If you are a California resident, you may request disclosure of the categories and specific pieces of personal information collected, request deletion or correction, and opt out of any sale or sharing of personal information. We do not sell personal information, and we will not discriminate against you for exercising your rights.

To exercise any right, email info@donationengine.io. We may need to verify your identity, and we will respond within the timeframe required by applicable law.

12. Marketing communications

We send commercial electronic messages in line with Canada’s Anti-Spam Legislation (CASL) and equivalent rules. Every marketing email includes an unsubscribe link, every text message can be stopped by replying STOP, and we honour opt-out requests promptly. We may still send necessary service and account messages.

13. Text messages (SMS)

If you give us your mobile number and tick the text-message consent box on a form on our website, we will send text messages to that number about your enquiry, scheduled calls, and occasional updates and offers about our services. Message frequency varies. Message and data rates may apply.

Consent is optional. Agreeing to receive text messages is not a condition of any purchase or service.
Opting out. Reply STOP to any message to stop receiving texts. You will receive one message confirming your opt-out, and no further texts unless you opt in again by replying START. Reply HELP for help, or contact info@donationengine.io.
Consent records. We keep a record of your consent (the date and time, the form used and the wording you agreed to) so that we can demonstrate it, and we keep it after you opt out so that we continue to honour your choice.
No sharing of mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except with the service providers that deliver our text messages on our behalf, who may use it only to provide that service.
Mobile carriers are not liable for delayed or undelivered messages.

14. Children

Our services are directed at organisations and are not intended for children. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction). If you believe a child has provided us information, contact us and we will delete it.

15. Third-party sites

Our website and the Platform may link to third-party websites and services that we do not control. This Policy does not apply to them, and we encourage you to review their privacy notices.

16. Changes to this Policy

We may update this Policy from time to time. The “last updated” date above reflects the most recent revision. Where changes are material, we will provide additional notice by email or through the Platform.

17. How to contact us

For privacy questions, requests or complaints, contact our Privacy Officer:

Donation Engine — Privacy Officer
2875 14th Ave, Markham, Ontario L3R 5H8, Canada
Email: info@donationengine.io
Phone: 647-258-5646

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or the supervisory authority in your country of residence.