Privacy policy

Pledglings runs online duck races for charities, schools, clubs and other good causes. This policy explains what we collect when you organise a race or take part in one, what we do with it, and what you can ask us to do about it.

Pledglings is operated by Pledglings, [registered address] ("we", "us"). For anything in this policy, email [email protected].

Who is responsible for your data

For organiser accounts, and for running the platform itself, we are the data controller.

When you support a race, the organisation running it receives your payment and the details that go with it. They decide what to do with those details once they have them (for example, thanking you), and their own privacy policy covers that. We handle your details on the platform to take your entry and put your duck on the course.

What we collect

If you organise a race

• Your name and email address.
• A password, which we store only as a one-way hash, or, if you sign in with Google, your Google account ID and profile picture.
• The organisations you belong to, the races you set up, and what you do in the organiser dashboard, such as approving or removing messages.
• When your account was created and when you last signed in.

Your organisation's bank and identity details for receiving payouts are collected by Stripe during onboarding, not by us. We only see whether the account is ready to take payments and what Stripe still needs.

If you support a race

• The name you give, which may be shown on the race page and on screen.
• Your email address, if you give one, for your receipt.
• Your duck's name, its accessories, and any message you write. Duck names and messages are shown publicly on the race.
• For sponsors, the sponsor name, banner image and link, all of which are shown publicly.
• The amount you gave, any contribution you chose to add for Pledglings, and a reference to the payment.

Card details go straight to Stripe. They never reach our servers and we never see them.

Technical information

Like any website, our servers receive your IP address and browser details with each request, and keep them briefly in logs for security and fixing faults.

Why we use it

• To provide the service (performing our contract with you): running your account, taking entries and payments, running the race and sending receipts and account emails, such as verifying your address.
• To keep races safe for a family audience (our legitimate interest): checking duck names, messages and banner images before they appear on a public screen.
• To prevent fraud and abuse and keep the platform secure (our legitimate interest).
• To meet legal obligations, such as keeping financial records.

We do not sell your data, and we do not use it for advertising.

Who we share it with

• The race organiser sees supporters' names, email addresses, amounts and messages for their own race.
• Everyone watching the race sees duck names, supporter names as shown on the race, approved messages and sponsor banners.
• Stripe processes every payment, and onboards organisations to receive them. See Stripe's privacy policy.
• OpenAI screens duck names, messages and banner images for unsuitable content before checkout. Under OpenAI's API terms this content is not used to train their models.
• Google, if you choose to sign in with it.
• Our hosting and email providers, who store and deliver data on our behalf and may not use it for anything else.
• Authorities, where the law requires it.

Some of these providers are based outside the UK. Where your data leaves the UK, it is protected by an adequacy decision or the UK's standard contractual clauses.

How long we keep it

• Organiser accounts are kept until you ask us to delete them.
• Payment and donation records are kept for six years, because financial records must be.
• Incomplete checkouts are discarded once they expire.
• Race replays, and the duck names and messages shown in them, are kept while the race's page exists.

Cookies

We use only cookies that the site needs in order to work:

• auth_token keeps you signed in, for up to seven days.
• oauth_state protects the Google sign-in, and lasts ten minutes.

Stripe sets its own cookies on the payment form to prevent fraud. We use no analytics or advertising cookies, so there is nothing to opt in to.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct it, delete it or restrict how we use it, object to our using it, and ask for it in a portable format. Email [email protected] and we will answer within one month.

If you supported a race and want your message or name taken down, you can also ask the organiser, who can remove it straight away.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first.

Children

Organiser accounts are for adults. Races are designed to be watched by all ages, but payments should be made by an adult or with a parent's or guardian's permission.

Changes

If we change this policy, we will update the date at the top. If a change affects how we use data you have already given us, we will email organisers before it takes effect.