Nonprofit & Charity
The gift is the sensitive part: which cause you gave to says more than the amount. Give once and many charities research what you could afford, using public records and bought-in data. Most policies name no retention period at all.
The read at a glance
The file is small, but it names the causes you give to.
A leak reveals which causes you fund, which can imply your politics or faith even when you kept them private.
Gift-aid and tax rules keep donation records for years; suppression lists keep your details after you ask them to stop.
Usually nothing beyond contact and payment; some run background checks for volunteer roles.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
A donor record says what you gave and which cause you gave it to, which is often something you kept private. One attack on the sector's biggest database exposed donors across thousands of charities at once.
What repeats in the policies
The gift is the sensitive part
A donation records more than money: which cause you chose, which appeal moved you, sometimes in whose memory. Give to a health, faith or bereavement cause and the record carries a health interest, a belief or a loss. Many charity policies still say they do not usually collect sensitive information about supporters. The gift is that information, whatever the policy calls your file.
They research what you could give
Give once and many charities work out how much more you could afford. They look at past gifts, public property and company records, and detail bought from data vendors you never dealt with. Most of that profile, you never handed over. In the UK, regulators have fined charities for wealth-screening their supporters.
Leaving does not clear the file
Most charity policies name no retention period. They keep your record as long as they judge there is a reason, and any schedule stays internal. One rule is fixed by law. In the UK, ticking Gift Aid obliges the charity to hold your name and taxpayer status for at least six years, and an ongoing declaration lasts as long as you keep giving.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Political views Possible
The causes you fund can imply your politics.
Religion and community Possible
Faith-based giving reveals affiliation.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
A do-not-contact record They set it kept indefinitely, by design
A minimal note kept on purpose so they do not contact you or re-add you.
Safeguarding records Law sets it decades
Child-protection and vulnerable-adult records are kept for decades.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Records tied to a live or potential dispute They set it the limitation period of the claim
They can keep records to defend a live or possible legal claim.
Who wants this data
Your donor record is a product. The sector's biggest database vendor compiles giving histories from public sources and sells them to other charities looking for new donors. One ransomware attack on that vendor exposed the records of millions of donors across thousands of charities at once: names, donation history, financial details, and for some, health information and Social Security numbers. A settlement with US state attorneys general followed.
Sold or shared Possible
Supporter lists are sometimes shared or rented within the sector.
AI training Low
The data is small and sector-specific, so training value is low.
Even anonymised, this can still be you
A donation record carries your name, address and giving history, which is enough to pick you out once it is matched against public records (Sweeney, 2000).
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Payment patterns Typical
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“we only use information that people would expect to be publicly available”
Building a profile of your wealth and what you could give, from property sites, the electoral register, company filings and press coverage, without asking you, on the reasoning that public data is fair to use.
The move What sources they drew on, and what profile they hold, is theirs to answer.
“when we pass your information to charities, they also become a controller”
The platform's policy stops covering your data the moment your donation reaches the charity. The charity's own policy takes over, and the platform says how the charity then markets to you, profiles you or shares your record is not its responsibility.
The move The request has to go to the charity now, not the platform.
“we may exchange or share personal information with cooperatives of other charities”
In the US, pooling your name, contact details and donation history into a shared database that other charities pay to draw on when looking for new donors. UK policies now refuse this, after regulators there fined charities for swapping supporter records.
The move Whether your record sits in one of these pools, and which charities can pull it, is theirs to answer.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.