Privacy policy

Last updated: 17 October 2026

This policy explains how Adab Solutions Ltd collects and uses personal data when you visit our website, get in touch, or use Adaab, our CRM for charities.

Who we are

Adaab is run by Adab Solutions Ltd, a company registered in England and Wales (company number 14667215). Our registered office is 128 City Road, London, EC1V 2NX.

For anything about your personal data, email adaab@adab.solutions.

Our two roles

We are the controller of the personal data in this policy: what we learn about website visitors, people who contact us, and the people who use Adaab.

Organisations that use Adaab also store data about their own supporters, donors, beneficiaries and contacts. For that data the organisation is the controller and we are its processor: we only handle it to run the service, on the organisation's instructions, under our terms of service. If you are a supporter of a charity that uses Adaab, contact that charity about your data. We will pass on any request we receive.

What we collect and why

When you visit our website

• Only if you choose "Accept all" in the cookie banner: the pages you view and links you click, the site you came from, campaign tags in the link, your IP address, the country it suggests, and your browser type. We use this to understand which pages help people and to improve the site. Our lawful basis is your consent, which you can withdraw at any time from the cookie banner.
• If you choose "Essential only", or make no choice, we record none of this.

When you contact us or book a demo

• Your name, work email, organisation, team size and anything you write in the note. We use it to reply, arrange your demo and follow up. Our lawful basis is our legitimate interest in answering enquiries and, where you are considering becoming a customer, taking steps at your request before entering a contract.

When you have an Adaab account

• Your name, email address and your password, which we store only as a one-way hash.
• Two-step sign-in settings and recovery codes, stored encrypted or hashed.
• A record of sign-ins (time, IP address and browser) and of changes made in your organisation's account.
• We use this to provide the service you or your organisation signed up for (contract), and to keep accounts secure and investigate misuse (legitimate interests).

When your organisation pays us

• Payments are taken by Stripe. We never see or store full card numbers. We keep the card brand, the last four digits, the expiry date, and your invoices, to run your subscription (contract) and to keep accounting records the law requires (legal obligation).

Emails we send you

• Service emails: confirming your address, sign-in codes, password resets, team invitations, task reminders and notices about your plan. We keep a log of which emails were sent and whether they were delivered. These emails are part of the service and we do not send marketing emails without your consent.

The live demo

• Trying the live demo needs no personal details. It creates a temporary sample organisation that is deleted after 24 hours.

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell personal data.

Who we share it with

We use these service providers, who handle personal data for us under contracts that require them to keep it secure:

• Railway (cloud hosting and database) for everything stored in Adaab.
• Resend to send our emails.
• Stripe to take payments for Adaab subscriptions.
• Cloudflare for Turnstile, which checks that forms are filled in by a person. It receives your IP address and technical details about your browser.
• Google and Microsoft, only if you choose to sign in with them. We receive your name and email address from them and keep no access to your account.

Organisations can connect their own accounts with other providers, such as email services, Meta (WhatsApp and Instagram), Bird (WhatsApp and SMS), Stripe (donations), Google Sheets or SharePoint. Data sent through those connections is handled for the organisation under its own agreement with that provider.

We may also share personal data if the law requires it, to protect our rights or the safety of others, or with a buyer if our business is sold, who would be bound by this policy.

International transfers

Some of our providers store or access data outside the UK, including in the European Economic Area and the United States. Where data leaves the UK we make sure it is protected, by relying on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or on the International Data Transfer Agreement or Addendum approved by Parliament.

How long we keep it

• Website visit records: 90 days, then deleted automatically.
• Enquiries and demo requests: until we have dealt with them and you are no longer considering Adaab, after which we delete them. You can ask us to delete them sooner.
• Account details, sign-in records and the change history: for as long as the account is open, then deleted when the organisation's account is closed, except what we must keep by law.
• Billing records and invoices: six years after the end of the financial year they relate to, as UK law requires.
• Live demo organisations: 24 hours.
• Sign-in codes and links expire within minutes to days and cannot be used after that.

Cookies

We use a small number of cookies. Essential cookies are needed for the site to work and are always on:

• crm.sid: keeps you signed in. It lasts 14 days while you are signed in, or 2 hours if you are not.
• cookie_consent: remembers your choice in the cookie banner, for one year.
• theme and sidebar: remember your light or dark setting and whether the menu is open, for one year.
• last_signin: remembers how you last signed in, so we can show that option first, for one year.

One cookie is used only if you choose "Accept all":

• av: a random identifier that lets us count visits and see which pages people find useful, for one year.

We do not use advertising cookies or third-party analytics. Cloudflare Turnstile may use technical information from your browser to tell people from bots when you send a form. You can change your choice at any time by clearing cookies for this site, which brings the banner back.

How we protect it

Passwords are stored with a one-way hash (Argon2), keys and secrets for connected services are encrypted (AES-256), and everything travels over encrypted connections. Accounts can use two-step sign-in, which organisations can make compulsory. Sign-ins and changes are logged, attempts to guess passwords or codes are limited, and only the staff who need access to support the service have it.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong or incomplete;
• delete your data;
• restrict how we use it, or object to our using it;
• give you your data in a format you can take elsewhere.

Where we rely on your consent, you can withdraw it at any time. Email adaab@adab.solutions and we will reply within one month. We may need to confirm who you are first.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Children

Adaab is for organisations and is not meant for anyone under 18. We do not knowingly collect personal data from children through our website.

Changes to this policy

When we change this policy we will update the date at the top. If a change is significant, we will also email account owners before it takes effect.