Nonprofits give Cotara their supporters' information. This page sets out the rules we follow to look after it. It forms part of our commitment to customers and works with our Privacy Policy, our Terms and Conditions and, where signed, our data processing agreement. Words such as Customer, Customer Data and Supporter have the meanings given in our Terms.
1. Principles
- Your data is yours. Each organization owns its supporter, gift and campaign data.
- Purpose first. We use Customer Data only to run Cotara for the organization that supplied it.
- Least access. People and systems see only what their job needs.
- People decide. Suggestions come from Cotara. A person on your team approves every personal message before it reaches a supporter.
- Be clear about what we know. Cotara shows what happened after a follow-up. It does not claim that a follow-up caused a result unless a fair test, such as a holdout group, shows it.
- No selling. We do not sell supporter data or use it for advertising.
2. Who is responsible
- The Customer decides what it collects, why it collects it, and who on its team may see it. It is the controller of Customer Data.
- Cotara processes Customer Data only on the Customer's documented instructions, which are these Terms, the settings the Customer chooses, and any signed data processing agreement. We tell the Customer if we think an instruction breaks the law.
- Our people. Everyone at Cotara who can access Customer Data is bound by a duty of confidentiality.
- Contact. Questions about this page, data processing agreements and Customer Data requests: data@usecotara.com. Privacy questions from individuals: privacy@usecotara.com.
3. Data we hold, by sensitivity
| Level | Examples | Handling |
|---|---|---|
| Restricted | Sign-in secrets, payment tokens, connected-account tokens, private notes about care or wellbeing | Only for the people and systems that need it to run or secure the Service. Card numbers are held by Stripe, not by Cotara. |
| Confidential | Supporter names, contact details, gift history, communication history | Visible only to the people the Customer invites, and to Cotara staff for the reasons in section 4. |
| Internal | Aggregated and de-identified service measures | Used to measure and improve the Service. Cannot identify a person or a Customer. |
| Public | Donation pages, published reports | Published only by the Customer. |
4. Access
- Only the people a Customer invites can see its data. The Customer's administrator invites and removes team members.
- Cotara staff access Customer Data only to give support the Customer asks for, to keep the Service secure, to investigate abuse, or when the law requires it.
5. Security
In place today:
- Encrypted (HTTPS) connections between your browser and Cotara.
- Card numbers held by Stripe, not by Cotara.
- Access to each Customer's data limited to the people that Customer invites.
Being put in place: we are adding further safeguards, including multi-factor sign-in for all Cotara staff, logs of access to sensitive records, regular access reviews, tested backups and documented incident response. We will move each item to the list above only when we can show evidence that it is in place. Ask us at data@usecotara.com for the current status.
6. Connected accounts
When a Customer connects Gmail, Google Sheets, Outlook or Microsoft Excel, we access only the data the connection needs for the feature the Customer turned on. Cotara's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use connected-account data for advertising or to train general AI models. The Customer can disconnect at any time.
7. Responsible use of suggestions
- Cotara Relationship Director shows each suggestion with the reason for it. A person approves every personal message before it is sent.
- Write notes about supporters as things the team could say to the supporter. Do not record guesses about a person's character, health or beliefs.
- A Customer can review, correct or delete any note about a supporter.
- Where an AI provider processes Customer Data for us, it does so under contract, only to return the result to us, and not to train its own models.
8. Using data to improve Cotara
We may use aggregated, de-identified information to measure how the Service performs and to improve it. It cannot reasonably identify a person or a Customer. We do not use one Customer's identifiable supporter data to serve another Customer, and we do not train a shared model on identifiable supporter data.
9. Where data is processed
Customer Data is processed in the United States and in other countries where our service providers operate. For transfers from the UK or the EEA, we use a lawful safeguard, as our Privacy Policy describes.
10. Service providers (subprocessors)
- Every provider that processes Customer Data for us works under a written contract that requires confidentiality, security measures that suit the risk, and use of the data only on our instructions.
- We review providers before we use them and when their service changes.
- A full list is available on request at data@usecotara.com. We will give Customers at least 30 days' notice by email before a new provider starts to process Customer Data. A Customer may object on reasonable data protection grounds. If we cannot address the objection, the Customer may end its plan and receive a refund of prepaid fees for the unused period.
11. Retention and deletion
- Customer Data stays while the account is active.
- After the account ends, the Customer has 30 days to export its data.
- We then delete Customer Data within 60 days, unless the law requires us to keep it. Where a backup holds Customer Data, that copy is deleted when the backup expires.
- A Customer may ask us to delete a single supporter's data at any time. We act within 30 days.
12. Supporter rights
We help each Customer answer requests from its supporters to access, correct, delete or move their data. Supporters should contact the organization they gave to. If a request reaches us, we pass it to that organization without undue delay and do not answer it ourselves, unless the law requires us to.
13. Incidents
- We contain and investigate the incident.
- If personal information in Customer Data is affected, we tell the affected Customer without undue delay after we confirm it, so the Customer can meet any deadline that applies to it, such as the 72-hour deadline for notifying regulators under the UK GDPR. We share what we know, what we are doing and what the Customer may need to do, and we update the Customer as we learn more.
- We help the Customer meet its duty to notify supporters and regulators.
- We review the cause, fix it and record what we learned.
14. Legal requests
If an authority asks us for Customer Data, we refer it to the Customer and tell the Customer, where the law allows. We share only what we are legally bound to share, and we challenge requests that are unlawful or too broad.
15. Data processing agreement
We will sign a data processing agreement that meets the requirements of the UK GDPR, Canadian privacy law or US state privacy laws, where they apply to a Customer. Ask us at data@usecotara.com.
16. Review
We review this page at least once a year and when our practice changes. We will tell Customers by email about a material change. Questions: data@usecotara.com.
