Privacy Policy

Last updated: May 2026

This Privacy Policy explains how Dana House Limited ("Dana House", "we", "us") collects, uses, stores, and protects personal data in connection with the Dana House platform. We are committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our data controller contact is: contact@danahouse.co.uk

1. What data we collect

Account data

Email address
Name (if provided at registration)
Password (stored as a salted hash; we do not store plaintext passwords)
Subscription plan and billing status

Usage data

Search queries entered in Discover
Charities added to watchlists
Watchlist names and descriptions you create
Notes you attach to charity profiles
Saved searches and comparison snapshots
API key usage logs (call count, endpoint, timestamp)
Pages visited and features used (analytics)

Technical data

IP address
Browser type and version
Device type
Timestamps of account actions
Authentication session tokens

2. Why we collect it

Purpose	Lawful basis
Providing the Service (account, watchlists, scoring)	Performance of contract
Billing and subscription management	Performance of contract
Sending product update and digest emails	Legitimate interest / consent
Usage analytics to improve the product	Legitimate interest
Fraud detection and security monitoring	Legitimate interest
Legal compliance and record keeping	Legal obligation

3. How we store it

Data is stored on AWS Europe West 2 (London) Database infrastructure is provided by Neon (PostgreSQL serverless). Payment data is handled by Stripe and is not stored on our servers. Passwords are hashed using bcrypt and are never stored in plaintext.

4. Retention periods

Account data: retained for the duration of your account, plus 2 years after closure for legal compliance
Usage logs and analytics: 12 months rolling
API usage logs: 6 months rolling
Billing records: 7 years as required by UK tax law
Notes and watchlists: deleted within 30 days of account closure on request

5. Third-party processors

We share data with the following processors:

Stripe: payment processing (see stripe.com/privacy)
Resend: transactional email delivery (resend.com/legal/privacy-policy)
Neon: database hosting
Umami Analytics: privacy-friendly, cookieless usage analytics (no personal data collected)

We do not sell personal data to third parties. We do not share personal data with data brokers or advertising platforms.

6. Your rights under UK GDPR

You have the right to:

Access: request a copy of the personal data we hold about you
Rectification: ask us to correct inaccurate data
Erasure: ask us to delete your personal data (subject to legal retention obligations)
Portability: receive your data in a structured, machine-readable format
Restriction: ask us to limit how we process your data in certain circumstances
Objection: object to processing based on legitimate interest
Withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at contact@danahouse.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies

We use cookies to manage authentication sessions. Our analytics provider (Umami Analytics) is cookieless and does not set cookies. See our Cookie Policy for details.

8. Changes to this policy

We may update this Privacy Policy. Material changes will be notified by email at least 14 days before taking effect. The "last updated" date at the top of this page indicates when it was last revised.

9. Contact

Data protection enquiries: contact@danahouse.co.uk
Dana House Limited, 24 Crane Avenue, Isleworth, TW7 7JL, United Kingdom