Privacy policy: Fundraising Toolkit

Last updated: 12 November 2026

This policy explains what data the Wix app “Fundraising Toolkit” (the app), published by Kaya Byte, org.nr 938 851 883, trading as Kayabyte, Stasjonsveien 64, 0771 Oslo, Norway (we, us), processes when it is installed on a Wix site. It adds to the privacy policy for Kayabyte apps for Wix, which also applies.

What the app does

The app works with the Wix Donations app. It shows a donor wall, a campaign progress bar and a donate form on the site, and gives the site owner a dashboard with gifts, donors, tributes, funds and reports. The donate form hands the donor over to the site’s own Wix checkout. The app never takes, holds or pays out money and never sees card details.

Roles

The site owner (the organization that raises funds) is the controller for the data about its donors. Kayabyte acts as a processor that handles the data only to provide the app to the site owner. Wix.com Ltd. hosts the site, the checkout, the orders and the app’s dashboard page. Cloudflare, Inc. hosts the app’s service and its database and is a sub-processor. Resend delivers tribute card emails and is a sub-processor.

Donors who want to see, correct or delete their data should contact the organization they gave to. We help the organization answer such requests.

Data the app reads from Wix

• The site’s donation campaigns: name, goal, amounts, frequencies, status.
• The donation orders of those campaigns: order ID and number, date, amount, currency, payment status, frequency, the donor’s name and email address, and the note the donor wrote in the Wix form.
• The site’s name, address (URL), currency, time zone, email address and the plan for the app.

Data the app stores

For each site, the app’s database holds: - Per gift: the donor’s name and email address, amount, currency, date, frequency, the Wix order ID and number, the campaign’s ID and name, the fund, the donor’s wall choice (full name, first name only or anonymous) and wall message, the tribute (in honor or in memory, the name of the person, the message), the card recipient’s name and email address, when the card was sent, and the language. - Offline gifts (entered by the site owner): the same, plus the payment method (cash, cheque, bank transfer, other) and the owner’s private note. - Gifts made in the standard Wix Donations form: also the note the donor wrote there (up to 1,000 characters). - A donation started in the app’s donate form and not paid yet: name, email address, wall choice, messages, tribute and card recipient. This is deleted when the paid order arrives, and otherwise after 30 days. A phone number typed into the form is passed to Wix for the checkout and is not stored by the app. - The site: name, address (URL), currency, time zone, the site’s email address from Wix, and the app’s settings (organization name, reply email, thank-you text, wall settings, funds). - Counters: the number of offline gifts per month, and, to limit abuse of the donate form, a keyed hash of the visitor’s network address per day, kept for 3 days.

Not tied to one site: - A hashed list of card recipients who unsubscribed. It is kept without an end date, also after a site’s data is deleted, so that the person stays unsubscribed. It holds no readable email address. - Hashed per-recipient counters for the daily card limit, kept for 2 days. - Delivery IDs of the notices Wix sends to the app, kept for 7 days.

What visitors of the site can see

The donor wall shows only what the wall settings and the donor’s own choice allow: a name as chosen (full name, first name or “Anonymous supporter”), and, if the site owner turned them on, the amount, the date and the tribute line, plus the message the donor wrote for the wall. Email addresses, private notes and card recipients are never shown on the site. Gifts made in the standard Wix form are shown as anonymous unless the site owner chooses to show first names for everyone, which the owner is responsible for.

Who else sees the data

• The site owner and collaborators: everyone with access to the app’s page in the site dashboard sees the gifts and donor data.
• Wix: when a donor uses the donate form, the app creates a cart in the owner’s Wix site with the donor’s name, email address, phone number if given, and a note describing the gift (fund, tribute, wall choice). Wix creates a contact and, after payment, an order. These stay in the owner’s Wix site under Wix’s own terms, whatever happens in the app.
• Resend: a tribute card is an email sent only when the site owner clicks Send card. The recipient’s address, the subject and the text of the card pass through Resend and are kept in Resend’s delivery log.
• Cloudflare: runs the service and the database and keeps technical request logs for a short time.

We do not sell personal data and do not use it for advertising.

Tribute cards

A card is sent once per gift, by the site owner’s click, to the person the donor named. It is sent from a Kayabyte address under the organization’s name, with replies going to the organization. It names the donor, the organization and the person the gift is for; it does not mention the amount. Every card has an unsubscribe link; a person who unsubscribes receives no further cards from any site that uses the app.

Anonymizing a donor

The site owner can anonymize a donor in the dashboard. This removes the name, email address, notes, wall messages, tributes and card recipients of all gifts of that donor from the app, and the unfinished form data with the same email address. The amount, date, campaign, fund and order ID are kept so totals stay correct. The wall can show the old entry for up to a minute. Anonymizing does not change orders or contacts in Wix, emails already delivered by Resend, or the unsubscribe list.

Retention and deletion

Data is kept while the app is installed. When the app is removed from a site, that site’s data is deleted about 30 days after the removal. The clean-up runs in batches, so deletion can happen somewhat later than day 30, not earlier. If the app is installed again within that time, the data is still there. The hashed unsubscribe list is kept, as described above. Orders and contacts in the owner’s Wix site are not ours to delete; the site owner manages them in Wix.

To have a site’s data deleted sooner, email support@kayabyte.dev from the site owner’s address.

Logs

The service writes technical log lines (the request path with IDs masked, and the outcome). Donor names and email addresses are not written to the logs by the app. A search typed into the dashboard’s gift or donor list travels in the request address and can therefore appear in Cloudflare’s request logs, which are kept for a short time.

Plans and payments

Paid plans are sold and billed by Wix. We never receive card details. Donations are paid at the site’s own Wix checkout to the site owner’s payment provider; they never pass through Kayabyte.

Cookies, tracking and third parties

The widgets set no cookies and use no analytics, advertising or tracking services. No data is shared with third parties other than Wix, Cloudflare and Resend, as described above.

Your rights

Donors: contact the organization you gave to first; it decides about your data. Site owners and anyone else: for questions about this policy, or to exercise your rights under the GDPR, contact support@kayabyte.dev. You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or your local authority.

Changes

We will update this page if the app’s data handling changes. The date at the top shows the latest version.