Privacy policy

Last updated: 2026-05-24

Loracta is a software-as-a-service platform that helps non-profit organisations (we call them "tenants") run their public sites, knowledge libraries, and donation collection. This policy explains what data we collect about you (the donor or site visitor), why, how long we keep it, and how to ask us to access or delete it.

What we collect

When you donate

• Your email address, name, and optional donor message
• The donation amount, currency, designated fund, and timestamp
• Stripe-issued payment identifiers (no card data; we never see card numbers)
• If recurring: the subscription identifier, used to manage cancellations

When you visit a tenant site

• The truncated IP address (first three octets only, e.g. 203.0.113.x) for fraud detection and rate-limit accounting
• A short hash of your User-Agent, never the full string

What we do NOT collect

• Full card numbers, CVVs, or expiry dates (handled exclusively by Stripe)
• Your behaviour on tenant sites beyond what's logged for fraud detection
• Third-party tracking cookies on the donation flow

Why we collect it

• To process your donation and issue a tax receipt where applicable
• To allow the tenant to acknowledge your gift (unless you chose to donate anonymously)
• To detect fraud and abuse (truncated IP, request fingerprinting)
• To comply with the tenant's legal obligations (financial-record retention)

How long we keep it

• Donation records — typically 6 to 10 years, governed by the tenant's local tax law
• Email verification codes — 24 hours
• Magic-link tokens — 15 minutes
• Truncated IP + User-Agent hash on audit logs — 1 year

Your rights under GDPR

If you're in the EU/EEA, GDPR gives you rights of access (Article 15) and erasure (Article 17). To exercise either:

Visit the donor-data page →

We'll email a secure link to your verified email address, after which you can choose to receive a copy of your data or to redact the personally-identifiable parts. Donation amounts and dates are retained even after deletion — they're part of the tenant's legally-required financial records — but your name, email, and any message you wrote are replaced with a deterministic surrogate.

Contact

For privacy questions, contact: privacy@veracta.app

We respond within 30 days as required by GDPR Article 12.