What we hold, why, and what we will never do with it

• Donor contact details, household structure, recognition preferences and consent state.
• Gift, pledge, recurring plan, receipt, allocation and fulfillment records.
• Financial reconciliation records: transactions, fees, payouts, deposits and exceptions.
• Audit records of who changed what and when.

• Account email, name and authentication identifiers.
• Role and organization membership.
• Operational logs needed to run and secure the service.

• We do not sell donor data, and we do not share it between organizations.
• We do not use tenant or donor data to train AI models by default.
• We do not enrich donor records with purchased third-party data.
• We do not use donor personal data for our own marketing.

Access, correction, suppression and deletion requests are handled by the organization that holds the relationship. Beneora provides the tools to action them and records that the action was taken.

Where a receipt or financial record must be retained for legal reasons, deletion of the surrounding personal data is possible while the financial record and its audit history remain.

An organization can export its donors, gifts, pledges, funds and reconciliation records in full. Data retention is not our business model, and export is a Release 1 requirement rather than a paid feature.

On account closure, data is deleted after a defined window that will be stated in the agreement before any organization commits.

We use managed cloud hosting and a managed database provider to run the service, and a model provider for the AI features that are enabled. A named subprocessor list will be published alongside the DPA rather than described vaguely here.