Donation Privacy Policy

Version 2026-07-07. This policy covers the data handled when you donate. It is separate from the site's general Privacy Policy.

1. Who is responsible

The data controller for donation data is Kjern, a Norwegian sole proprietorship (enkeltpersonforetak) that runs Messages Never Seen. Contact: contact@messagesneverseen.com.

2. What we collect and why

When you donate, we handle:

• Your email address. This identifies you as a donor, so your donations add up under one identity and so your display name can only be used by you. It is stored encrypted, and lookups use a non-reversible fingerprint rather than the address itself. We never show it to anyone, and we do not use it for marketing.
• Your display name, if you set one. Shown on the supporters page only if you tick the box asking to be shown.
• The amount, currency and time of the donation, together with a Stripe payment reference.
• Your rough region (country only, from your connection) at the moment you open the donate page, used once to pick EUR or USD. It is not stored.

Card details go directly to Stripe and never reach our servers. Stripe processes them under its own privacy policy at stripe.com/privacy.

3. Cookies and local storage

If you donate, we set a cookie and a local storage entry on your browser with the email and display name you used, so the form is pre-filled next time. They exist only on your device, are not used for tracking, and you can clear them in your browser at any time.

4. Legal basis

• Processing the payment and preventing abuse: our legitimate interest in running the donation system, and performance of the agreement you enter when donating.
• Showing you on the supporters page: your consent, given by ticking the box. You can withdraw it at any time by emailing us, and you will be removed or anonymised.
• Keeping transaction records: our legal obligation under the Norwegian bookkeeping rules.

5. How long we keep it

Transaction records (amount, currency, time, payment reference) are kept for at least five years because Norwegian bookkeeping law requires it. Your listing on the supporters page stays until you ask to be removed. If you ask us to delete your data, we delete or anonymise everything that is not covered by the legal retention duty.

6. Who we share it with

Stripe, to process the payment. The Norwegian tax authorities, to the extent reporting duties require it. Nobody else. We never sell or rent donor data.

7. Your rights

Under the GDPR you can ask for access, correction, deletion, restriction, or a copy of your data, and you can withdraw consent to the supporters listing at any time. Email contact@messagesneverseen.com and we will handle it. You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet).

8. Changes

If this policy changes in a way that matters, the version date at the top changes. The version you agreed to is recorded with your donation.