Your data, your rights.

Who we are

My Impact is operated by My Impact CIC, a community interest company registered in England and Wales. We are the data controller for all personal data processed through this service.

If you have any questions about this policy or how we handle your data, please contact us at hello@myimpact.uk.

What data we collect

We collect the minimum data necessary to provide the My Impact service. This includes:

• Account information: your email address and, optionally, a display name, when you create an account.
• Profile information: details you choose to share about your situation (e.g. student, carer, armed forces) to personalise your experience. This is always optional.
• Impact data: the activities, actions, and contributions you log, along with associated hours and dates.
• Journal entries & attachments: any written reflections, photos or receipts you save against your impact records.
• Sidekick AI conversations: if you use the optional Sidekick assistant, the prompts you send (and any context you choose to include) are processed to generate replies. We don't use these conversations to train any model.
• Usage data: anonymised, aggregated analytics about how pages are used, to help us improve the service. We do not use advertising trackers.
• Organisation data: if you register an organisation, we collect your organisation's name, type, and contact email.

Some features (such as paid organisation plans) involve payments processed by Stripe, we never see or store your card details ourselves.

How we use your data

We use your data solely to provide and improve the My Impact service. Specifically:

• To calculate and display your social value impact score.
• To save your history and allow you to track progress over time.
• To personalise the wizard and suggestions to your situation.
• To generate PDF impact reports on your request.
• To send transactional emails (e.g. account confirmation, organisation registration confirmation).
• To operate the organisation dashboard with aggregated, anonymised member data.
• To diagnose bugs and improve the reliability of the service.

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described under "Third-party services" below.

Legal basis for processing

We process your personal data under the following legal bases, as defined by the UK GDPR:

• Contract: processing necessary to provide the service you have signed up for.
• Legitimate interests: improving and securing the service, where these interests are not overridden by your rights.
• Consent: for any optional data or communications where we ask for your explicit agreement.

Data storage and security

All personal data is currently hosted on US-based cloud infrastructure. We are planning a migration to UK/EEA-based hosting in a future release.

International transfers. Transferring personal data from the UK to our US-based hosting provider is covered by Standard Contractual Clauses (SCCs) with the UK addendum, as permitted under UK GDPR. The same safeguard applies to our other US-based sub-processors (Resend, Stripe, OpenAI, and Sentry) — full details are in the "Third-party services" section below.

We use industry-standard security measures including:

• Encrypted connections (HTTPS/TLS) for all data in transit.
• Encrypted storage for data at rest.
• Secure, hashed storage of passwords, we never store passwords in plain text.
• Access controls limiting who within our team can access personal data.

We retain your data for as long as your account is active, or as necessary to provide the service. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain it longer.

Cookies

My Impact uses a small number of cookies that are strictly necessary for the service to function:

• mi_session: keeps you logged in while you use the app. HTTP-only, secure, expires after 30 days or when you log out.
• mi_sso_state: set briefly during single sign-on with Google or Microsoft to protect against CSRF. Expires within minutes.

We also use your browser's localStorage on the device you're using, never sent to our servers, to remember a few preferences and drafts. The exact keys are:

• mi-theme: your light/dark theme choice.
• mi-social-sharing: whether you've opted into social-share prompts.
• mi-recap-viewed-<year>: which annual recap you've already viewed.
• mi-recap-show-money: whether your recap shows monetary impact values.
• mi-pulse-dismiss-<id>: pulse cards you've dismissed.
• wizard_draft_v1: your in-progress wizard answers, so you don't lose them on reload.
• myimpact_journal: your in-progress journal autosave draft.
• mi_local_history: guest-mode impact history (cleared once you sign in).
• mi_tracked_milestones_<userId>: which milestones you've already acknowledged.

You can clear any of these at any time via your browser's site-data controls; the app will simply rebuild them as needed.

We do not use advertising cookies, social media tracking pixels, or third-party analytics cookies that follow you across the web. Our usage analytics are anonymised and processed in-house.

Because we only use strictly necessary cookies, we do not require a cookie consent banner.

Third-party services

We use a small number of named, trusted processors to operate My Impact. Each is bound by a data processing agreement and only sees the minimum data required for their job:

• Resend (email delivery, USA), receives your email address and the body of transactional emails (magic links, account notifications, deletion confirmations) so they can be delivered. Transfer protected by the EU/UK–US Data Privacy Framework and standard contractual clauses.
• Stripe (payments, Ireland & USA), for paid organisation plans only, Stripe processes card details directly. We never see or store your card number. Transfer protected by SCCs and the UK addendum.
• OpenAI (Sidekick AI assistant, USA), when you use Sidekick, your prompt (and the recent context you've chosen to include, such as your latest activity totals) is sent to OpenAI to generate a reply. We have data-processing terms that prohibit OpenAI from training models on this content. Transfer protected by SCCs and the UK addendum.
• Sentry (error monitoring, USA), receives anonymised error reports (stack traces, browser metadata, your internal user id) so we can fix bugs. Sensitive form values are scrubbed before sending. Transfer protected by SCCs and the UK addendum.
• Managed cloud hosting provider (hosting + PostgreSQL, USA), hosts the application server and our managed PostgreSQL database. Transfer protected by SCCs and the UK addendum.
• Social Value Engine (methodology, United Kingdom), we use their accredited SROI values to calculate impact scores. No personal data is shared with them.

All third-party processors we work with are bound by data processing agreements and are required to handle your data in accordance with UK GDPR.

Your rights under UK GDPR

As a UK resident, you have the following rights regarding your personal data:

• Right to access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate or incomplete data.
• Right to erasure: you can ask us to delete your personal data ("right to be forgotten").
• Right to restriction: you can ask us to restrict how we process your data in certain circumstances.
• Right to portability: you can request your data in a structured, commonly used, machine-readable format.
• Right to object: you can object to processing based on legitimate interests.
• Rights related to automated decision-making: you have the right not to be subject to decisions made solely by automated means that have a significant effect on you.

You can exercise the most common rights yourself, immediately, from Settings: Download my data gives you a complete JSON export of everything we hold, and Delete my account permanently erases your data and sends you a confirmation email. For any other request please contact hello@myimpact.uk, we will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Changes to this policy

We may update this privacy policy from time to time. When we make significant changes, we will notify registered users by email and update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically to stay informed about how we protect your data.