Olive
Bring your website, fundraising, events, learning and everyday non-profit work into one calm workspace.
Privacy
How Port60 handles personal data.
PORT 60 LTD, trading as Port60, a company registered in England and Wales, company number 08223558, registered office 9 Bibury Road, Birmingham, England, B28 0HG ("Port60", "we"), is the platform your organisation runs on, and the data controller for the personal data this policy describes. It covers port60.com, your Port60 account and the products we provide through it, those available today and those we add in future, and it is written for the people who trust us with them: our customers and visitors. Last updated 3 August 2026.
What we collect, and why
| Data | Used for | Lawful basis |
|---|---|---|
| Name, email and organisation details you give at signup | Creating and running your account and workspace, and the service emails that go with it (activation, password reset, receipts) | Contract |
| Payment card details | Subscription billing, and confirming, through your bank's own verification, that a real person stands behind each new account. That check is what keeps automated and fraudulent signups off the platform, and it is why a card is required before a workspace goes live. Cards are handled by an accredited payment processor, card numbers never touch our systems; we keep only billing references and invoice records. | Contract, and legitimate interest (preventing abuse) |
| Support conversations | Answering you, and keeping a record of what was agreed | Legitimate interest |
| Security signals around signup and payment | Stopping automated and fraudulent use, including human-verification checks at signup and card verification with your bank | Legitimate interest |
| Information collected automatically: IP address, device and browser details, and the technical logs every request creates | Running the platform, diagnosing faults, keeping it secure, and understanding how the platform is used so we can improve it (see "Port60 AI") | Legitimate interest |
| Site usage | Understanding which pages work and where visitors give up, to improve the site | Consent only, measurement loads after you say yes in the cookie banner, never before. See cookies. |
| Marketing communications | News about the platform and products, only if you opt in, every message carries an unsubscribe that takes effect immediately | Consent |
The platform is for organisations and the adults who run them. Accounts require you to be at least 18. It is not directed at children, and we do not knowingly collect children's data.
Information we receive about you from others
Not everything arrives from you directly. When an organisation invites you to join its workspace, it gives us your name and email address so we can create your sign-in. Our payment providers send us the outcome of payments and verification checks: success, failure, disputes and fraud signals, though never your card number. We use information received this way only for the purpose it was shared.
Signing in with Port60
If you hold a Port60 sign-in, because an organisation invited you into its workspace, or because you created an account on an organisation's website that runs on the platform, we operate that sign-in service and are the controller of the details it needs: your name, email address and credentials. What an organisation does with your information inside its own site or workspace is governed by that organisation and its own privacy policy; your sign-in works across the platform and stays with you.
Automated checks
Some protections run automatically: human-verification at signup and on payment forms, and the fraud and card-verification checks our payment providers perform. An automated refusal is not the end of the road, if you believe a check has wrongly blocked you, email [email protected] and a person will review it. We do not make solely automated decisions with legal effects about you beyond these protective checks.
Port60 AI
AI is part of the platform, and it works in two directions: helping the people who run organisations do more through writing and building, and over time through suggestions and insights across the products, and helping us make the products themselves better. However a capability is delivered, the promises are the same:
- Your content serves you and only you. What you or your organisation put into an AI capability is processed solely to produce your result, kept no longer than that requires, and never used to train models.
- We improve the platform with usage, not your content. We study how the platform is used: which features earn their place, where a journey loses people, and AI helps us understand it, so that setup gets shorter and the products get sharper. That work runs on usage information, never on your organisation's content or its supporters' data.
- People stay in charge. AI output is a suggestion. A person reviews, edits and decides before anything is published or acted on. AI does not make decisions about you.
- New capabilities keep the same promises. Where a future AI capability needs your consent or a new disclosure, we will ask for it and update this policy first. Innovation never silently changes what happens to your data.
Where your organisation chooses to connect an AI account of its own, that connection is governed by that provider's terms, like any service you connect.
Your organisation's data is yours
Whatever your organisation collects through its own workspace, including supporter, donor and member data, belongs to your organisation. We process it solely to provide the service to you, on your instructions. We do not mine it, we do not sell it, and nobody gets it for their own advertising. That includes Port60 AI: content your organisation puts through its capabilities is used only to produce the result for you, never to train models.
Where it goes
Providing a platform honestly involves trusted partners, and you should know that some of your details reach them. Personal data is shared only where needed to run the services, under contract and on our instructions or under choices you make, and it is never sold. The categories of recipient are:
- Companies that help us provide the services, infrastructure, hosting and storage providers, payment providers and financial institutions, security vendors, email and communications delivery, data analytics vendors, and the technology partners behind platform capabilities;
- advertising and marketing vendors, only ever under the consent choices you make in the cookie banner or your settings, never before;
- the organisations you interact with on the platform, for example when you accept an invitation to join an organisation's workspace, or sign up as a member or supporter of an organisation that uses Port60, that organisation receives the details involved;
- partners your organisation chooses to work with on or around the platform, where you engage them;
- law enforcement, regulators and other third parties in connection with legal requests, where the law requires it, or where necessary to prevent serious harm or to protect the platform and the people who use it.
Personal data is held in the United Kingdom. Where a provider processes limited data outside the UK, it does so under the safeguards UK GDPR requires, an adequacy decision or approved standard contractual clauses.
Connected Google services
If you connect your organisation's Google account to Port60 (for example so we can set up Google Analytics for your own website), we request only the narrow Google Analytics permissions needed to create and read that configuration on your behalf. Data obtained through Google APIs is used solely to provide those features to you, is never sold or used for advertising, and is handled in line with the Google API Services User Data Policy, including its Limited Use requirements. You can disconnect at any time from your workspace settings or at myaccount.google.com/permissions.
How we protect it
Personal data is protected by technical and organisational measures appropriate to the risk, encryption in transit and at rest for sensitive values, least-privilege access, and monitoring. No system on earth can honestly promise absolute security, so we design for containment as well as prevention, and if an incident ever affects your data we will tell you as the law requires.
How long we keep it
Account data lives for the life of the account. When an account closes we delete or anonymise personal data, except records the law requires us to keep, billing and tax records are retained for six years under UK law. Technical logs are short-lived and rotate automatically. Records of consent and unsubscribe choices are kept for as long as needed to evidence that we honoured them; analytics data is retained for at most 14 months.
Your rights
UK GDPR gives you the right to access, correct, delete, restrict and port your personal data, and to object to processing based on legitimate interests. Where processing rests on your consent, analytics cookies, marketing emails, you can withdraw it at any time, via the cookie settings on this site or the unsubscribe link in any message, and withdrawal takes effect immediately. To exercise any right, email [email protected]: requests are free of charge, and we respond within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office.
Cookies
Covered on their own page, how this site uses cookies, including the one-click way to change your mind.
Changes to this policy
As the platform grows we will update this policy. Material changes are notified, on this site or by email to account holders, before they take effect, and the date at the top always tells you when it last changed. Your use of the platform is also governed by our terms of service.