Privacy policy

Last updated 1 October 2026.

Who we are

Explain My Charity is provided by Digital Tactics Ltd. When this policy says "we" or "us", it means Digital Tactics Ltd.

Company: Digital Tactics Ltd., a private limited company registered in England and Wales
Company number: 07666910
Registered office: Ground Floor, 19 New Road, Brighton, East Sussex BN1 1UF, United Kingdom
ICO registration: Z2807798

What we collect

When you email us or use a form: your name, email address, anything you write, and, for an institution enquiry, your institution and the number of videos you expect.
When you sign in: your email address and name, a record of your sign-ins and sessions, and your IP address, which we use briefly to limit repeated sign-in requests.
If you turn on two-factor sign-in: the secret key your authenticator app shares with us, stored encrypted; your recovery codes, stored only in a scrambled (hashed) form that cannot be turned back into the codes, with a note of which ones you have used; and a random identifier for each browser that has completed two-factor sign-in, so we can email you when your account is signed in to from a new one. We keep these only while two-factor sign-in is on.
If you belong to a team: the team's name, its members and their roles, invitations you send or receive, and any brand assets an owner uploads.
If you save a brand: its name, colours and fonts; the logos, font files and brand guidelines you upload; the website address you ask us to read it from, and what we found there (its public colours, fonts and logo images); and when and by whom you confirmed you may use the brand in your videos.
When you order a video: your document you upload, what you tell us about it (audience, length, emphasis, voice, whether it is confidential or embargoed, whether the video may show your document and, if so, why it may be adapted), your change requests, and the scripts, video, captions and transcript we produce.
When you pay: what you bought, the amount, the date, the acknowledgements you gave at checkout, and the reference Stripe gives your payment. Card details are entered on Stripe's own checkout page and never reach this site or our servers.
If you sign up for our newsletter: your email address; when you signed up and when you confirmed; the page you signed up on; which version of the sign-up wording you saw; and the country your connection came from, which Cloudflare works out from your IP address (we do not keep the IP address itself).
About our emails: whether an email to you bounced or was reported as spam, so we can stop sending to that address.

Why we hold it, and on what basis

We use your information to provide the service you asked for: to run your account, to make, revise and deliver your videos, to take payment, and to answer your messages. The lawful basis is the contract with you, or the steps you asked us to take before one. We keep a record of each sale because UK accounting and tax law requires it. We have a legitimate interest in keeping the site secure and free of abuse. We send our newsletter only with your consent (see "Our newsletter").

We do not sell your information, share it for anyone else's marketing, or use your documents, feedback or videos to train any AI model, ours or anybody else's. We make no decisions about you by automated means alone.

The "Keep in touch" form at the foot of each page signs you up to hear from us about new features, offers and special events. We send these emails only with your consent, which is the lawful basis (UK GDPR Article 6(1)(a), and the Privacy and Electronic Communications Regulations for marketing email).

We ask twice. When you enter your address we send a confirmation email, and you are subscribed only when you click the link in it. The link works once and lasts 72 hours; if you do not click it, we delete the sign-up. We record when you confirmed, the page you signed up on, the wording you agreed to and your country (see "What we collect"), so that we can show you gave consent.

We use no third-party mailing-list provider. The list is kept in our own database, hosted by Cloudflare, and our emails are sent through Resend, which already sends our other emails (see "Who processes your information"). We never share the list or sell it.

You can withdraw your consent at any time, as easily as you gave it: use the unsubscribe link in any newsletter email, which works in one click, or email [email protected]. When you unsubscribe we delete your subscription and keep only a scrambled (hashed) copy of your email address, which cannot be read back as your address, so that we can make sure we do not email you again. If you later sign up again, we ask you to confirm afresh. Unsubscribing does not affect emails about your account or your orders.

Our role: controller and processor

For your account, your orders and payments, our emails with you and our own business records, we decide how your information is used, which makes us the controller under UK GDPR and the Data Protection Act 2018.

For the documents and other personal data that an organisation's team uploads to its team account, such as author names and affiliations in a document, we act as the organisation's processor: we use that information only on its instructions, to make its videos. The organisation is the controller, and questions about that information are best raised with it first.

Data processing agreement

We offer every organisation account a data processing agreement under Article 28 of UK GDPR, setting out how we process personal data on its behalf. You can read the template data processing agreement, and we will sign it with your organisation on request: email [email protected].

Documents and files you upload

A document you upload is used to make your video and for nothing else. It is stored privately, is never shown back on the site, and is opened only by our team and our own video-making tools. Please remove anything that could identify research participants before you upload.

If a document is unpublished, under embargo or confidential, mark it when you order. Nothing from a flagged document is published or used as a sample, and everyone on our team who handles it sees the flag. A document marked confidential or under embargo is sent to a language model only under a zero-data-retention arrangement, or to a private model on infrastructure we control (see "Who processes your information").

Brand files (logos, font files and brand guidelines) are stored privately with your account and used only to make your videos. Logos and fonts are shown back only to members of your account, in the brand preview; brand guidelines are seen only by our team. When you import a brand from a website, our servers fetch that public page and its stylesheets and logo images, and keep what they found for a day, so that importing it again does not fetch it again.

How your video is made, and who is involved

Our specialised AI agents draft the script from your document and send it to you, and you review and approve it before anything is rendered; if you choose human review, one of our editors also checks it against your document. The pictures are drawn by our own software, and the narration is produced by an openly licensed voice model running on our own machines. Your document is therefore seen by our staff, by our own rendering systems, and by the language-model provider named below.

Who processes your information

These organisations process information for us, only for the purposes above:

Cloudflare hosts this site and stores accounts, uploaded documents, orders and finished videos and our newsletter list, and protects our forms from automated abuse (see "Cloudflare Turnstile").
Stripe processes payments and issues receipts and VAT invoices. Stripe also uses payment information for its own fraud prevention and legal obligations, as a controller, under its own privacy policy.
Resend sends our sign-in, team, order and delivery emails, and our newsletter emails, including the confirmation email. Emails are sent through Resend (mail sent from the EU; Resend Inc. is US-based).
Anthropic PBC runs Claude, the language model that helps draft scripts, through its commercial API. Anthropic does not use material sent through its commercial API to train its models. For a document that is not marked confidential or under embargo, Anthropic may keep what we send it for a limited period for safety and abuse monitoring: currently up to 30 days, or up to 2 years if its automated systems flag the material as breaching its usage policy. We ask you to accept this when you submit such a document, and record that you did. Documents you mark confidential or under embargo are processed only under a zero-data-retention arrangement, so Anthropic keeps no copy after processing, or with a private model running on infrastructure we control. Until one of these is in place we cannot yet process confidential or embargoed documents: you can prepare and save such an order, but not submit it. A zero-data-retention option is coming for confidential and embargoed documents. If your organisation prefers, we can use your own Anthropic API key instead, in which case your organisation's agreement with Anthropic governs that processing.
Google (YouTube), only if you connect a channel, as described below.

Some of them are based in, or use infrastructure in, the United States and other countries outside the UK. Where your information is transferred outside the UK, it is protected by the safeguards UK law provides: the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified under it, or the International Data Transfer Agreement or Addendum approved by the Information Commissioner.

What your team can see

If you belong to a team, every member can see all of the team's videos, including their scripts, change requests and finished files, the team's credit balance, and the names and email addresses of the other members. Owners can also see billing, invitations and the team's subscription. Your personal account, and videos ordered for it, are not visible to your team.

YouTube

Connecting a YouTube channel is optional and not yet available. If you connect one, you sign in with Google and grant Explain My Charity permission to upload videos to that channel. We use that permission only to upload the videos you ask us to publish, with the title, description, captions and privacy setting you have reviewed. We store the access token Google gives us, encrypted, so we can publish when you ask; we do not read, change or delete anything else on your channel.

Explain My Charity's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use it for advertising, do not sell it, and do not use it to train AI models.

Publishing uses YouTube API Services. By connecting a channel you agree to the YouTube Terms of Service, and Google's handling of your information is governed by the Google Privacy Policy. You can disconnect your channel at any time from your account, which deletes the stored token, or revoke our access in your Google account security settings.

How long we keep it

Sign-in links: deleted 24 hours after they are issued. A link works for 15 minutes and only once.
Sessions: 30 days at most, and ended sooner after 14 days without use or when you sign out.
Two-factor sign-in: the encrypted secret key, the hashed recovery codes and the browser identifiers are kept while two-factor sign-in is on, and deleted when you turn it off, when our team removes it at your request after checking your identity, or when your account is closed. The code step after a sign-in link lasts 5 minutes.
Team invitations: they expire after 7 days.
A document uploaded to a video that is never submitted: 7 days.
A document on a draft marked confidential or under embargo that you tried to submit before we could process such documents: kept until secure processing opens, so that you do not have to upload it again. We then email you, and the normal draft rule applies: your document is deleted if the video is not submitted within 7 days of that email. If you remove the confidential flag or the embargo passes, the normal draft rule applies straight away.
Documents and working files for a submitted video: until 90 days after you accept the video, then deleted.
What we send our language-model provider for a document that is not marked confidential or under embargo: kept by Anthropic for up to 30 days (longer only if its systems flag a breach of its usage policy), as described under "Who processes your information".
Your account and finished videos: until you delete them or close your account.
Saved brands and their files: with your account until you delete the brand or close your account. A video keeps a copy of the brand it was made in for as long as the video is kept. What we read from a website when you import a brand: one day.
Newsletter: a sign-up you have not confirmed, 72 hours; your subscription, until you unsubscribe or ask us to delete it; after that, only the hashed copy of your address, kept for as long as we send a newsletter, so that we honour your unsubscribe.
Emails, messages and enquiries: twelve months after our last exchange with you.
YouTube access tokens: until you disconnect the channel or close your account.
Records of each sale (name, email, organisation, what you bought, the amount and the date): six years, as UK accounting and tax law requires, even if you close your account.

Cookies

When you sign in, we set one cookie, __Host-ep_session, which keeps you signed in. It holds a random identifier and nothing else, cannot be read by scripts, and lasts no longer than your session. It is strictly necessary. If you have two-factor sign-in on, we set two more, both for the security of your account: __Host-ep_2fa, for up to 5 minutes between opening your sign-in link and entering your code, and __Host-ep_device, which lets us recognise this browser for up to 400 days so that we can tell you about sign-ins from a browser we have not seen before. Each holds a random identifier and nothing else, and cannot be read by scripts. We set no cookies for analytics, advertising or tracking. When you pay, you do so on Stripe's checkout page, which uses cookies for fraud prevention under Stripe's cookie policy. Strictly necessary cookies do not need your consent, which is why this site does not ask for it.

Some example videos on our videos pages are hosted on YouTube. They play in YouTube's privacy-enhanced mode (youtube-nocookie.com), and nothing is loaded from YouTube until you press play. Once you do, Google receives information such as your IP address and browser details and may store data on your device, under Google's privacy policy. Our own videos are served from this site and share nothing with third parties.

Cloudflare Turnstile

Our sign-in, contact and enquiry forms use Cloudflare Turnstile to tell people from automated abuse. When one of these forms loads, Turnstile checks signals from your browser and device and passes us only a pass or fail result. It does not show advertising or track you across sites. Cloudflare handles that information under its privacy policy. We rely on our legitimate interest in keeping the site secure.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, delete it, restrict or object to how we use it, or give it to you in a portable form. Email [email protected] or write to the address below, and we will respond within one month. Deleting material we hold for an open order may mean we cannot finish it; we will tell you before acting. Where we hold information as an organisation's processor, we pass your request to that organisation and help it respond.

You can withdraw your consent to our newsletter at any time, with the unsubscribe link in any newsletter email or by emailing us.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you raised it with us first so we can put it right.

Changes to this policy

We will show the date of the latest change at the top of this page, and email account holders about any significant change.

Contact

Email [email protected], or write to us at our trading address:
Digital Tactics
5 Boundary Road
Hove
East Sussex BN3 4EH
United Kingdom