Privacy notice

Controller and contact

Ben Smith trading as MGH Consultants, 9 Dalhousie Street, Carnoustie, DD7 6EJ, is the controller for our own account administration, contracts, support and necessary security processing. Contact Ben.smith@mghconsultants.com. Each charity is the controller for its donor declarations and claim records; we process those on its documented instructions. This account-service notice does not replace the charity’s donor privacy notice or required processing agreement.

Information and purposes

We handle account names, email addresses and authentication information to create, secure and manage accounts; organisation details and settings to supply the service; support correspondence to respond to requests; and necessary sign-in, device/IP and request/error information for security and troubleshooting. Subscription identifiers, plan, status and billing dates enable account access and billing assistance. We do not collect full payment-card details in our account forms; Paddle processes checkout payments.

Contract performance applies to supplying an individual’s contracted service. Legitimate interests apply to managing organisational representatives, supporting customers and protecting the service, subject to balancing rights. Legal obligations apply where required for accounting or lawful disclosure. No marketing use is established here.

Donor records include name/address, postcode, declaration wording, dates, receipt/sale references, amounts and claim/retention information. Charity administrators must establish their own appropriate lawful bases. Optional AI review sends selected record metadata and the user’s question through Lovable AI; assembled evidence omits names/addresses/emails, but identifiers can be personal data. Questions are sent as entered, so they may contain personal information if you include it. Do not place donor names, addresses, contact details or sensitive information in questions; human oversight is required. Provider logging, input/output retention, staff access and any model-training use have not yet been verified; we do not promise that questions or answers are never stored or used for training.

Sharing and providers

Lovable Cloud supplies application hosting, authentication and database services; Lightspeed supplies connected store/sale information. Lovable AI is used for optional claim questions. Paddle receives account/checkout data for selling the product, subscriptions, payments, tax compliance and invoices. Necessary data may also be shared with hosting/support service providers, professional advisers and authorities where legally required.

Exact hosting countries, the complete subprocessor register, contractual transfer safeguards and AI/provider retention terms have not yet been verified by the supplier. Do not infer UK-only hosting, adequacy or signed transfer safeguards from this notice. The supplier must complete and communicate that provider/transfer assessment before production donor use; request the current documentation at the contact above.

Retention and security

Account/support/security information is kept while needed for service delivery, security, contractual and legal purposes, then deleted or anonymised when no longer needed. The supplier’s exact account/log/backup retention periods remain to be finalised; contact us for the current position. Gift Aid declarations are protected until six years after the most recent claimed donation. This is the service’s retention safeguard, not a statement that every record has an identical statutory deadline. Records with no confirmed claim history remain protected until the charity establishes the appropriate retention position; unknown history or unexpired deadlines prevent deletion. There is no automatic purge. Exit does not promise immediate erasure from backups, downloaded files or another provider.

We use appropriate technical and organisational safeguards, including authenticated owner-scoped access, protected integration credentials, encrypted transport and verified payment notifications. Register links deliberately permit key-scoped front-desk access without an account sign-in: keep them private and rotate them if exposed.

Cookies and browser storage

Essential session/browser storage maintains sign-in and account state. Payment/sign-in providers may use their own essential storage under their notices. No optional analytics or marketing cookie use is represented by this notice. You can clear storage through browser settings, but doing so may sign you out. The supplier must complete its storage/cookie inventory before adding optional tracking.

Your rights

Under applicable UK GDPR rights, you may request access, correction, erasure, restriction, portability or object to processing; withdraw consent where consent is the basis. Rights are subject to legal conditions, including required Gift Aid retention. We respond within one month unless a lawful extension applies. For donor requests, contact the charity controller first; we can assist on its instructions. You may complain to the UK Information Commissioner’s Office at ico.org.uk.