The gift is the sensitive part: which cause moved you can say more than the amount, and giving once invites research into what you could afford, from public records and bought-in data. Most policies name no retention period at all.
Quieter data, but it names your causes and beliefs. Worth keeping on the list.
Gift-aid and tax rules keep donation records for years; suppression lists keep your details after you ask them to stop.
Usually nothing beyond contact and payment; some run background checks for volunteer roles.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
A donor record says what you gave and what you gave it to, which is often a cause you support quietly. One attack on the sector's dominant database exposed donors across thousands of charities at once.
The gift is the sensitive part
A donation records more than money: which cause you chose, which appeal moved you, sometimes in whose memory. Give to a health, faith or bereavement cause and that record carries a health interest, a belief or a loss, yet many charity policies still say they do not usually collect sensitive information about supporters unless there is a clear reason. The gift is that information, whatever the policy calls your file.
They research what you could give
Give once, and many charities estimate how much more you could afford. They research you: past gifts, public property and company records, and detail bought from data vendors you never dealt with. Most of that profile, you never handed over. In the UK, regulators have fined charities for wealth-screening their supporters.
Leaving does not clear the file
Most charity policies name no retention period: they keep your record as long as they judge there is a reason, and any schedule stays internal. One rule is fixed by law, not by them. In the UK, ticking Gift Aid obliges the charity to hold your name and taxpayer status for at least six years, and an ongoing declaration lasts as long as you keep giving.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
The causes you fund can imply your politics.
Faith-based giving reveals affiliation.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
A minimal note kept on purpose so they do not contact you or re-add you.
Child-protection and vulnerable-adult records are kept for decades.
Tax and company law makes them keep billing and payment records.
They can keep records to defend a live or possible legal claim.
Your donor record is a product. The sector's dominant database vendor compiles giving histories from public sources and sells them to other nonprofits to find new donors. One ransomware attack on that vendor exposed the records of millions of donors across thousands of charities at once: names, donation history, financial details, and for some, health information and Social Security numbers. A settlement with attorneys general across the country followed.
Supporter lists are sometimes shared or rented within the sector.
Little training value; the data is small and sector-specific.
Anonymised is their word. A donation record carries your name, address, and giving history, which is enough, matched against public records, to pick you out (Sweeney, 2000).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“we only use information that people would expect to be publicly available”
Building a profile of your wealth and giving capacity from property sites, the electoral register, company filings and press coverage, without asking you, on the reasoning that public data is fair to use.
THE MOVE What sources they drew on, and what profile they hold, is theirs to answer. Their reply goes on your record.
“when we pass your information to charities, they also become a controller”
The platform's policy stops governing your data the moment your donation reaches the charity. From there the charity's own policy takes over, and the platform disclaims responsibility for how the charity then markets to you, profiles you, or shares your record.
THE MOVE The request has to go to the charity now, not the platform. Their reply goes on your record.
“we may exchange or share personal information with cooperatives of other charities”
In the US, pooling your name, contact details and donation history into a shared database that other charities pay to draw on when looking for new donors. UK policies now refuse this, after regulators there fined charities for swapping supporter records.
THE MOVE Whether your record sits in one of these pools, and which charities can pull it, is theirs to answer. Their reply goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →