How we protect your data.

All personal data is currently hosted on US-based cloud infrastructure. Transfers from the UK are covered by appropriate safeguards under UK GDPR. We are planning a migration to UK/EEA-based hosting in a future release.

Yes. All connections use HTTPS/TLS, and stored data, including database contents and file attachments, is encrypted at rest using industry-standard ciphers.

We hold the minimum needed to run the service: account details (email, optional display name), the activities and contributions members log, optional journal entries and attachments, and your organisation's name, type and contact email.

For a full list, see our Privacy Policy.

We use passwordless one-time magic links sent to your verified email, optionally combined with single sign-on through Google or Microsoft. We never store passwords.

Access to production systems is restricted to a small number of named engineers on a least-privilege basis. Access is logged, reviewed periodically, and revoked promptly when no longer needed.

Yes. Organisation accounts distinguish between admins (who can manage settings, members and exports) and members (who can only see their own data). Admins choose who has elevated rights.

No. Every record is scoped to its owning organisation and member. Database queries enforce these scopes at the application layer, and admins of one organisation cannot see records belonging to another.

Members control what they share. Aggregated, anonymised totals are visible to admins by default; identifiable individual records are only visible where the member has explicitly opted in (for example, by submitting an entry to a shared challenge).

We may publish anonymised, aggregated statistics about overall service usage. We do not name or identify customers in benchmarks without written permission.

We use a small set of named, trusted processors, each bound by a data processing agreement:

• Managed cloud hosting (USA): application hosting and managed PostgreSQL database.
• Resend: transactional email delivery (magic links, notifications).
• Stripe: payment processing for paid plans (we never see card details).
• OpenAI: powers the optional Sidekick AI assistant via enterprise endpoints.
• Sentry: anonymised error monitoring with sensitive values scrubbed before sending.

The full list with locations and safeguards is on our Privacy Policy.

Yes. We maintain a current list of sub-processors and notify organisation admins by email before adding new ones, giving you a reasonable window to object.

No. We do not sell personal data, and we do not share it with advertising networks or data brokers.

The production database is backed up at least daily, with point-in-time recovery available for recent windows. Backups are encrypted and stored in the same region as the primary database.

We target a recovery point objective (RPO) of under 24 hours and a recovery time objective (RTO) of under 24 hours for full service restoration. Most disruptions resolve far faster.

Yes. We maintain a documented continuity plan covering hosting failure, key-personnel loss, and supplier outage, and we review it at least annually.

We follow a documented incident-response runbook: contain, investigate, remediate, and learn. Affected systems are isolated immediately, the root cause is identified, and changes are made to prevent recurrence.

Where a breach is likely to affect your organisation or its members, we will notify the relevant admin contact without undue delay and in any event within 72 hours of becoming aware, in line with UK GDPR.

Yes. We run automated dependency scanning and static analysis on every change, and review our security posture regularly. Penetration test summaries are available under NDA on request.

Yes. My Impact CIC is the data controller for personal data you and your members submit, and we operate in line with the UK GDPR and Data Protection Act 2018.

Yes. We have a standard DPA covering controller-to-processor obligations where applicable. Contact us at hello@myimpact.uk for a copy.

Yes. We're happy to complete reasonable due-diligence questionnaires (SIG-lite, supplier security reviews, etc.). Email us with the document and your timeline.

Members can download a complete export of their own data, and can permanently delete their account, directly from Settings. We respond to any other UK GDPR request within 30 days.

We keep personal data for as long as the related account is active. When an account is deleted, personal data is erased within 30 days, except where we are required to retain limited records for legal or accounting reasons.

You can export your organisation's data on request before closing the account. Once closed, all personal data is deleted in line with the retention policy above.

No. Sidekick uses enterprise endpoints with zero data retention agreements in place. Inputs and outputs are not used to train the underlying model, and the provider does not retain prompt content beyond what is needed to return a response.

Yes. Organisation admins can switch Sidekick off across the account, and individual members can choose not to use it. With AI features disabled, no prompts or context are ever sent to the AI provider.

Sidekick responses are generated from the prompt and the limited context the user explicitly chooses to include (such as their own recent activity totals). It cannot read other members' records, your private settings, or anything outside the user's own scope. We treat AI replies as best-effort guidance, not as authoritative or specialist advice.