Privacy Policy
Draft — pending legal review. This document describes Donara’s actual behavior in good faith. It is not legal advice and has not been reviewed by a lawyer. Review it with qualified counsel before publishing as your binding policy.
Who this covers
This policy describes how the DonaraHQ website and the Donara plugin handle information. It does not govern how an individual nonprofit that uses Donara handles its donors’ data — that organization is the controller of its own donor information.
The DonaraHQ website
When you visit this site or apply for the closed beta, we collect the information you submit (organization name, contact name, work email, and the other application fields) to evaluate and administer beta access. We do not ask for and do not want passwords, card details, or Stripe secret keys. We use privacy-conscious, minimal analytics and do not run ad-retargeting trackers, session replay, or fingerprinting.
The Donara plugin (on your own site)
- Donor data — names, emails, and donation records — is stored in your WordPress database. It is not sent to DonaraHQ.
- Payment data is handled by Stripe. Donara does not store raw card numbers or CVC.
- No telemetry. The current plugin does not “call home” or send usage data to DonaraHQ.
- Uninstall preserves your financial data by default; erasing it is an explicit opt-in.
- Privacy tooling. Integration with WordPress’s personal-data export/erase tools for Donara’s custom tables may still be incomplete during beta; handle data-subject requests manually if needed.
What we do not claim
DonaraHQ does not claim HIPAA, SOC 2, PCI, or GDPR certification. Any such claim would require independent establishment and is not asserted here.
Contact
Questions about this policy can be directed to DonaraHQ through the contact provided with your beta invitation.