Get started

Legal

Privacypolicy.

Last updated 18 August 2026.

This privacy policy explains how Uppfy Digital (“Uppfy”, “we”, “us”) processes personal data when you use 1 NGO, including the dashboard at https://1-ngo.uppfy.com, public pages we host for organisations, the WordPress plugin, WhatsApp Updates, and the organisation API.

It covers 1 NGO as a product of Uppfy. It does not replace a nonprofit’s own privacy notice to its donors. Organisations that collect donor information should publish their own notice on their public pages.

If this policy conflicts with a data processing agreement we have signed with an organisation, that agreement controls for that organisation.

1. Who is responsible

Uppfy Digital operates 1 NGO as a managed service.

  • For workspace accounts (people who sign in to 1 NGO: owners, admins, editors), Uppfy is the controller of that account data.
  • For donor and supporter data collected on an organisation’s donate page, campaigns, events, or stories, the organisation is the controller. Uppfy processes that data on the organisation’s instructions to provide the service (hosting pages, confirming gifts, showing transactions, sending optional alerts). Paystack is a separate payment provider with its own terms and privacy policy.

Contact for privacy questions: hello@uppfy.com. If the request is about a gift you made to a nonprofit, contact that nonprofit as well — they decide how donor records are used.

2. Whose data we process

  • People who create or are invited to a 1 NGO workspace
  • People who visit this marketing site (uppfy.com/1-ngo and related pages)
  • Donors and other visitors to an organisation’s public 1 NGO pages (including pages served through the WordPress plugin)
  • The WhatsApp number an organisation owner pairs for Updates
  • Developers or agents that call the organisation API with a token

3. Data we collect

A. Workspace accounts

  • Name, email, password (stored as a hash), profile photo (avatars)
  • Organisation membership and role
  • Two-step verification status and authenticator setup
  • Invitations sent to email addresses
  • Security and audit events (sign-in, role changes, publish actions, integration changes)
  • Optional email notification preference
  • Billing details needed to subscribe to 1 NGO (processed with our billing/payment provider for the platform fee — not donor Paystack)

B. Organisation content

  • Campaigns, events, stories, donate-page copy, media, brand colours and logos
  • Publish choices (which hosts a page is live on)
  • Custom domain hostnames and DNS verification records
  • WordPress site URL and public slug map, if the plugin is connected

C. Donor and gift data (on behalf of the organisation)

  • Amount, currency, campaign or donate-page source, time, status (confirmed, failed, refunded)
  • Donor name and other fields the organisation’s checkout collects
  • Payment confirmation from Paystack (references, not full card numbers)
  • Return URLs so checkout can send the donor back to the organisation’s site or WordPress origin

We do not receive full payment card numbers. Paystack processes cards.

D. WordPress plugin

If an organisation installs the 1 NGO plugin and saves a token, the plugin sends:

  • WordPress site URL
  • Parent slugs for donate, campaigns, events, and stories
  • The organisation ID and read-only token, only to the API URL they configure
  • The site URL on API requests so we can recognise the connected origin

The plugin does not require 1 NGO DNS. Connecting it is consent to use 1 NGO as the service behind those pages. See also Terms of use and the plugin guide: https://1-ngo.uppfy.com/docs/integrations/wordpress.

E. WhatsApp Updates

If an owner pairs WhatsApp:

  • Pairing codes (hashed, short-lived)
  • WhatsApp user id and a masked display of the phone number
  • Which donate page and campaigns that chat may query
  • Whether live gift alerts are on
  • Messages the admin sends to the bot and the replies we send (commands such as summary and statement)

We do not join WhatsApp groups. One number per organisation in the current product.

F. API and webhooks

  • Token metadata (name, scopes, hashes — plaintext shown once)
  • API request logs as needed for security and rate limits
  • Optional outbound donation.received posts to URLs the organisation configures, signed so they can verify the source

G. Technical data

  • IP address, browser type, device, timestamps
  • Cookies or similar needed to sign in, keep a session, and protect the service
  • Error and performance logs

H. Marketing site

  • Pages you visit on uppfy.com/1-ngo
  • Any contact-form fields you submit on Uppfy
  • Cookies the Uppfy marketing site already uses (we do not add extra tracking pixels for 1 NGO beyond what Uppfy already does site-wide with notice)

4. Why we use data

  • To create and secure workspaces, and to invite teammates
  • To host and publish the organisation’s public pages
  • To confirm gifts, show transactions and insights, and send optional notifications
  • To connect Paystack, domains, WordPress, WhatsApp, and API tokens at the organisation’s request
  • To bill the 1 NGO subscription
  • To prevent fraud, abuse, and security incidents
  • To provide support
  • To meet legal obligations that apply to Uppfy

We do not sell personal data. We do not use donor lists for Uppfy’s own unrelated marketing.

5. Legal bases (where they apply)

Depending on the person’s location, we rely on:

  • Contract — providing the 1 NGO service the organisation signed up for
  • Legitimate interests — securing the platform, debugging, preventing abuse
  • Consent — optional email notifications; WhatsApp pairing; WordPress connection; marketing cookies if the Uppfy site uses them
  • Legal obligation — accounting, tax, or lawful requests that apply to Uppfy as a business

Organisations are responsible for their own basis for processing donor data (including any consent for their newsletters).

6. Who we share data with

We share data with processors who help us run 1 NGO, for example:

  • Hosting and application platforms (dashboard, API, and related infrastructure)
  • Database and authentication
  • Object storage for organisation media (not used for profile avatars)
  • Transactional email (invitations and optional notification mail)
  • Paystack, for donor checkout (organisation’s Paystack account)
  • Meta / WhatsApp, when an owner uses WhatsApp Updates
  • Billing provider for the 1 NGO subscription
  • Professional advisers, or authorities, when the law requires it

Each organisation may also embed or iframe 1 NGO pages on WordPress or other sites they control. Those sites have their own operators.

Paystack, WhatsApp/Meta, and WordPress.org (if the plugin is installed from there) have their own privacy policies.

7. International transfers

1 NGO is offered to organisations in Africa (Kenya-first) and may be accessed from other countries. Infrastructure and processors may be located outside the visitor’s country. We use providers’ standard protections (such as their published transfer terms) where required.

8. Retention

  • Account data: while the account and organisation exist, then a limited period for security and legal records
  • Gift and transaction records: while the organisation uses the service and as needed for the organisation’s finance trail
  • WhatsApp link: until the owner revokes it
  • WordPress site map: until the organisation disconnects or the token is revoked
  • API tokens: until revoked
  • Logs: shorter operational periods unless needed for an incident
  • Marketing contact messages: according to Uppfy’s existing practice

Uninstalling the WordPress plugin removes the saved token on that WordPress site. It does not automatically delete the organisation’s 1 NGO workspace or gift history.

9. Security

We use access control, hashed passwords, hashed API tokens, two-step verification for sensitive owner actions, signed Paystack webhooks, and signed update webhooks. No method is perfect. Organisations must keep tokens, Paystack keys, and owner accounts confidential, and use two-step verification.

10. Your rights

Depending on applicable law, you may have rights to access, correct, delete, or restrict personal data, to object, to withdraw consent, and to complain to a data protection authority.

  • Workspace users: use Profile and Security in 1 NGO, or contact us.
  • Donors: contact the nonprofit that received the gift. We will help that organisation where the request concerns data we store for them.
  • WhatsApp: the organisation owner can revoke the link in 1 NGO.

We may need to verify the request. We may refuse requests that are unlawful, abusive, or that would break another person’s rights or a financial record we must keep.

11. Children

1 NGO is a professional workspace for organisations. It is not directed at children. Organisations are responsible for not targeting donation checkout at children in a way that breaks applicable law.

12. Cookies

The dashboard uses cookies (or similar) that are required to sign in and keep you signed in. The marketing site uses whatever cookies Uppfy already documents. We do not put third-party advertising trackers on 1 NGO dashboard pages.

13. Automated decisions

We do not use donor or account data for automated decisions that produce legal effects without human involvement (for example, an automated ban on donating). Security rate limits and fraud-related declines at Paystack are operated under their systems.

14. Changes

We will update this page when the product or the law requires it. The date at the top will change. Continued use of 1 NGO after an update means the new policy applies to later use. Material changes may also be noted in the dashboard or by email to owners.

15. Related documents