Privacy policy

Who we are

whotogiveto ("we", "us") is a guided-giving service that helps people find UK charities that match what matters to them. We're not set up as a company yet, so for now whotogiveto is simply the name we work under. Once we are, we'll add our company name, number and address here.

What information we collect

We collect as little as possible, and you don't need an account to use the site.

Browsing the site

We use Plausible Analytics, a privacy-focused analytics service, to understand overall site usage, for example which pages are visited and roughly how much traffic the site gets. Plausible doesn't use cookies or persistent identifiers and doesn't collect or store personal data; see Plausible's data policy for details. We don't use any other cookies on the site.

Using "Find my cause"

When you use the finder, we collect:

• A random session ID generated in your browser. It isn't linked to your name, email or any account, and isn't shared with anyone.
• The choices you make and the screens you see, so we can understand how the finder works and improve it.
• If you enter a postcode, we only keep the first part of it (for example "SW1A", not the full postcode). That's enough to search for nearby charities, but not enough to pinpoint an address.
• If you type an answer in your own words, we ask first whether we can save an anonymised version of it to help us improve recommendations. Before it's saved, we automatically strip out names, email addresses and phone numbers, and cut any postcode down to its first part. If you say no, it's only used to find your charities and we don't save it.

Charity information

Charity information comes from the Charity Commission's public register.

How we use AI to find your charities

To work out which charities to recommend, your answers in the finder, including anything you type in your own words, are sent to a third-party AI provider (Google's Gemini model, reached through the AI gateway of Lovable, the platform we build on). This happens every time you use the finder, to find your charities, whether or not you've said we can save an anonymised copy of what you typed.

People sometimes describe a health condition, a bereavement or a disability in their own words, so this can include sensitive personal information. Please only share what you're comfortable with. We're still confirming in writing how long Google and Lovable keep this information on their side.

Our legal basis for using your information

We rely on legitimate interests to run and improve the service and to understand overall site usage. We rely on your consent to save an anonymised copy of what you type, and for any AI processing of sensitive personal information described above.

How long we keep information

We haven't set a fixed retention period yet for session information (screens viewed, choices made, and anonymised answers you've said we can keep). We only keep it as long as it helps us improve the service, and we'll put a specific period here once we've decided it.

Who we share information with

We don't sell your data, and we don't share your answers with charities or anyone else for their own use. The service providers named in this policy (Plausible for analytics, and Google and Lovable for AI recommendations) only process information to run the service, never for their own marketing or any other purpose.

Where your information is stored

Our database (charity records, and the session information described above) is hosted on AWS in London, UK, through Lovable's managed backend. Plausible, our analytics provider, is hosted in Germany. The site's pages are served through Cloudflare's global network, but that only holds copies of the pages themselves, not your information. Anything involving your information goes back to our UK-hosted backend.

So the information described above stays in the UK and EU. The one exception is our AI provider (Google, through Lovable's gateway, see "How we use AI to find your charities"), which may process information outside the UK and EEA.

Your rights

Under UK data protection law, you have the right to:

• Ask what information we hold about you and get a copy of it
• Ask us to correct inaccurate information
• Ask us to delete information we hold about you
• Object to, or ask us to restrict, certain processing
• Withdraw your consent at any time, where we're relying on it
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk if you're unhappy with how we've handled your information

To do any of these, email us at hello@whotogiveto.co.uk.

Children

whotogiveto is meant for adults making decisions about charitable giving, and isn't aimed at children. We don't knowingly collect information from children.

Changes to this policy

We may update this policy as the service grows, for example before we add account sign-in, which isn't live yet and isn't covered here. We'll change the date below when we do.

Contact us

Any questions about this policy or how we handle your information, just email hello@whotogiveto.co.uk.