Roundela — Privacy Policy

Effective date: 29 August 2026 · Version: 1.0

The short version

Roundela is software used by organisations to run the things they do and to keep records of the people involved — events and registrations, volunteers, programmes and services, memberships, fundraising and donations, communications, and whatever else we add over time.

The organisations using it vary. Many are small nonprofits, charities, and community groups, but Roundela is also used by clubs and associations, schools and education providers, sports and recreation bodies, faith and cultural organisations, social enterprises, and businesses. The examples in this policy are illustrative, never exhaustive — and this policy applies in the same way to any module or feature added after you first read it.

That means we handle personal information in two very different ways. Which one applies to you changes who you should talk to — and you may well fall into both.

Your details are in an organisation's account if you registered for an event, bought a ticket, volunteered or applied to, signed a waiver or consent, donated, joined a mailing list, were named as an emergency contact, or had your details entered by someone else — a parent, a guardian, or whoever made a booking on your behalf.

In all of those cases, the organisation decides what happens to your information, not us. We hold it for them, on their instructions. Section 2.

You deal with us directly if you visit our website, enquire about Roundela, or your organisation subscribes and you have a login. Sections 3 onward.

Many people are both. A volunteer coordinator who also brings her own child to a programme. A board member who donates. If that's you, both parts apply — to different information about you. Section 2 explains how to tell which is which.

We don't sell personal information. We don't use it to train AI models. We don't market to the people in our customers' databases.

1. Who we are

Roundela is operated by LiftBound — Danielle Ann Butler, a sole trader registered in New Zealand, NZBN 9429051824150.

Contact: support@roundela.com

Danielle Butler is our Privacy Officer for the purposes of the New Zealand Privacy Act 2020.

When this policy applies

This policy covers what we do with personal information when you visit roundela.com, contact or enquire with us, subscribe to Roundela, use Roundela as an Authorised User of a subscribing organisation, or receive communications from us.

It does not cover information an organisation holds in its own Roundela account about its participants, volunteers, donors, or members. We handle that on the organisation's instructions, not our own — see section 2. Their privacy policy governs it, not this one.

It also doesn't cover other companies' websites or services you reach through links from ours, or a Connected Service your organisation chooses to link to Roundela. Those are governed by their own policies, and we'd encourage reading them.

If you give us someone else's details

If you provide personal information about another person — a colleague you're adding as an Authorised User, a billing contact, a referee — you confirm that you're entitled to do so, and that you've told them, or obtained their consent where that's required. We'll handle their information in line with this policy.

2. If your details are in an organisation's Roundela account

This is the most common situation, and it's worth being clear about.

When an organisation uses Roundela to run what it does, that organisation is the one responsible for the information it holds about you. They decide what to collect, why, who can see it, and how long to keep it. In legal terms they are the *controller*. We are their *processor* — we hold and handle the information on their behalf and on their instructions.

What that means for you:

• To see, correct, or delete your information, contact the organisation directly. They hold the relationship with you and they can act on it. We can't make those decisions for them.
• If you contact us instead, we'll pass your request to them and let you know we've done so. We won't action it ourselves without their instruction.
• The organisation's own privacy policy governs what they do with your information. This policy doesn't replace it.

What we do on their behalf. We store the information securely, process it only to make Roundela work, and don't use it for anything of our own. Our full commitments are in section 6 and in our Data Processing Annex.

A note for parents and guardians. Where an organisation records information about a child — a date of birth, a medical note, a signed consent — that information is held under the organisation's control, subject to their obligations. We apply the same protections to it as to any other information in the platform, and we treat health information and information about children as higher-sensitivity categories.

If you're both

Plenty of people are. A volunteer coordinator who also enrols her own child. A board member who buys a ticket. A staff member who donates.

The simple way to tell which part of this policy applies: it depends on the information, not on you.

• Information *about your involvement with the organisation* — your volunteer hours, your donation, your child's registration, a waiver you signed — belongs to the organisation. Section 2 applies. Ask them.
• Information *about your Roundela login* — your account, your password, when you signed in — is ours. Sections 3 onward apply. Ask us.

If you're not sure which one you're asking about, contact either of us and we'll help you work it out.

If you're involved with more than one organisation

Each organisation that uses Roundela has its own separate account, and each one controls only its own records. If you volunteer for one and donate to another, they hold two entirely separate sets of information about you. We do not link, match, or combine records across organisations, and one organisation cannot see another's.

That means a request to see or delete your information has to go to each organisation separately. They're not connected, and we won't join them up on request.

3. What we collect when you deal with us directly

If you visit our website

Basic technical information generated by any web request: IP address, browser type, pages visited, and the time of the visit. We use this to keep the site working and secure.

We run no analytics. No Google Analytics, no tracking pixels, no session recording, no behavioural profiling, no advertising technology of any kind. We don't measure you across the internet and we don't sell what we'd learn if we did.

Fonts are served from our own systems rather than fetched from a third party, so visiting Roundela doesn't quietly tell anyone else that you did.

If you enquire about Roundela

Your name, email address, organisation, and whatever you tell us in your message. We use it to reply and, if it goes somewhere, to follow up.

If your organisation subscribes

• Account information: organisation name, address, contact details, and the details of the people you give access to — names, email addresses, and authentication information.
• Billing information: what you're subscribed to, invoices, payment records. Where you pay by card, the card details are handled by our payment processor and we never see or store the full card number. Where you pay in bitcoin, we record the transaction and its value at the time we received it. Subscriptions are billed in United States dollars.
• Usage information: how the platform is used — features accessed, actions taken, error logs. We use this to operate, support, and improve Roundela.
• Support correspondence: what you send us, and our replies.

Cookies and browser storage

We use only strictly necessary cookies. There are no analytics, advertising, or preference-tracking cookies, which is why you won't see a cookie consent banner — there's nothing to consent to.

The cookies we set do three jobs: keeping you signed in, confirming that a device has passed a check-in PIN so staff aren't asked repeatedly, and recognising a trusted device for volunteer clock-in. Authentication cookies are set by our authentication provider. None of them contain personal information, and all are restricted to the pages that need them.

Roundela also stores small preferences in your browser — which view you last used, whether the sidebar is collapsed, that sort of thing. No personal information, credentials, or identifiers are stored there. Clearing your browser data removes them.

4. Why we use it, and on what basis

We use the information above to: provide and operate Roundela; authenticate people and keep accounts secure; send service messages, invoices, and notices; provide support; understand how the platform is used so we can improve it; meet our legal and tax obligations; and detect or prevent misuse.

Under New Zealand law we collect personal information for these purposes because it's necessary to provide a service you've asked for. Where the GDPR or similar law applies to you, our bases are performance of a contract, our legitimate interests in operating and securing the service, and compliance with legal obligations.

We do not use your information for advertising, and we do not sell it.

5. Who we share it with

We share personal information only with:

Our sub-processors — the service providers that make Roundela work: hosting, database, authentication, email delivery, payments, and AI. Each is bound by a written data protection agreement. The current list is published at roundela.com/sub-processors, along with what each one does and where it operates.

Professional advisers — our accountant or lawyer, where necessary and under confidentiality.

Where the law requires it — see section 9.

A successor — if the business is sold or transferred, subject to the same protections.

Your organisation, if you're an Authorised User. This one is worth stating plainly. If an organisation gave you your login, they can see how you use Roundela under their account — when you signed in, what you did, records you created or changed, and hours you logged. That's normal for workplace and volunteer software, but people are often surprised by it. It's their account, and that activity is their record.

We do not share personal information with anyone else. We do not sell it, rent it, or trade it — including information about children, and including with your consent. There is no version of Roundela where that changes.

6. Artificial intelligence

Some Roundela features use AI to help draft or process content. When they're used, the relevant information is sent to an AI provider to generate a result, and returned. We currently use Anthropic.

What is actually sent depends on the feature, and it's worth being specific:

• Volunteer application summaries send real applicant details — name, general location, age range, skills, experience, support needs, and contact preferences.
• Email and content drafting sends organisation and event details with placeholder tokens instead of real names.
• Website review sends no participant information at all.

AI features are optional and off unless an organisation turns them on. Where they aren't configured, nothing is sent to any AI provider at all.

We do not use customer or participant information to train, fine-tune, or improve any AI model. We require the same of any AI provider we use: no training on the data we send, retention only as long as needed to return a response, and a written data protection agreement.

AI output in Roundela is a draft, not a decision. Organisations are required to have a person review anything it produces before acting on it.

No automated decision-making. Roundela does not make decisions about people by automated means alone. It does not score, rank, profile, or assess anyone, and it does not decide who may attend, volunteer, or participate. Where an AI feature helps draft or summarise something, a person in the organisation decides what to do with it. If that ever changes, we will say so here before it does.

We do not collect personal information from third-party data brokers, advertising networks, or public sources to enrich or build profiles. What we hold, we were given.

7. Where your information is held

Roundela is hosted in the United States.

• Database: Amazon Web Services, US West (Oregon)
• Application hosting: US West (Oregon)
• Email delivery: Amazon Web Services, US East (Northern Virginia)
• File storage (signed waivers, scans, receipts, tickets): United States
• Authentication: United States

Authentication holds staff and volunteer logins only. Participants don't have Roundela accounts — they use links we send them, and their records live in the database, not the authentication system.

Support and operational functions provided by our sub-processors may be carried out from other countries. Our sub-processor list identifies where each one operates.

If you are outside the United States, this means your information is transferred to and stored there. We rely on the contractual protections in our agreements with each provider to keep it protected to a standard consistent with New Zealand law.

8. How long we keep it

A note on deletion. When information is deleted, it is removed from the live system immediately. Copies persist in encrypted backups for a short period before being purged — currently up to 30 days — after which they are gone. We do not use backups to reinstate individual records that have been deleted.

9. When the law requires disclosure

We may have to disclose information if compelled by law, or by a court, regulator, or other body with authority to require it.

Where that happens:

• we disclose only the minimum the law actually requires;
• we tell the affected organisation first and give them a reasonable chance to challenge it, unless we're legally prohibited from telling them or there's a genuine emergency involving risk to life or safety; and
• if we couldn't tell them first, we tell them as soon as we're permitted to.

We do not treat an informal request as a legal requirement.

10. Security

We protect information with measures appropriate to how sensitive it is:

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
• Access controls, with each organisation's data isolated from every other organisation's
• Authentication managed by a specialist provider; passwords are never stored in readable form
• Access to production systems restricted, time-limited, approved, and logged
• Regular backups, encrypted
• Providers chosen for their own security posture, with certifications and audit reports where available

Your part. Keep your password to yourself, don't share logins, sign out on shared devices, and tell us straight away if you think an account has been compromised. Most breaches start with a credential, not a firewall.

No system is perfectly secure. If a breach occurs that is likely to cause serious harm, we will notify the affected organisation and, where required, the Office of the Privacy Commissioner, in accordance with the Privacy Act 2020.

Our security measures are described in more detail in our Documentation. We don't hold a SOC 2 report of our own; where our sub-processors hold certifications or audit reports, we can share what they permit us to share on request. We'd rather say that plainly than imply otherwise.

11. Your rights

If your details are in an organisation's account, contact that organisation — see section 2.

For information we hold as controller, you may ask us to: confirm what we hold; give you a copy; correct anything inaccurate; delete it, where we're not required to keep it; or restrict or object to how we use it.

Ask at support@roundela.com.

How long we take. Within 20 working days if you're in New Zealand, as the Privacy Act 2020 requires. Within 45 days if you're in California or another US state with a similar law. We'll tell you if we need longer and why. We don't charge for this unless a request is excessive or repetitive, and we'll tell you before we do.

We may need to verify who you are before we act, and we'll only use what you give us for that purpose.

Marketing communications

If we send you marketing — a newsletter, or information about Roundela — you can stop it at any time using the unsubscribe link in any of those emails, or by emailing us.

Unsubscribing from marketing won't stop service messages relating to your subscription: invoices, security notices, changes to these terms, or anything else we're required to tell you.

If we say no

If we decline a request, we'll explain why. You can ask us to reconsider by replying to our response — we'll have a second look and give you a written answer. You can also complain to your regulator at any point; you don't have to come back to us first.

Someone acting on your behalf

You can authorise someone else — a lawyer, a family member, an advocate — to make a request for you. We'll ask for evidence that you've authorised them, and we may need to confirm your identity before we act.

Browser signals

We honour Global Privacy Control and similar browser opt-out signals where applicable law requires it.

If you're in New Zealand and you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner: privacy.org.nz.

If you're in California, you have rights under the CCPA to know what personal information is collected, to request deletion, to correct it, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA, and we do not discriminate against anyone who exercises these rights.

If the GDPR or UK GDPR applies to you, you also have rights to data portability and to complain to your supervisory authority.

Other US states. If you're in Nevada, you can tell us not to sell your personal information — though we don't sell it to anyone, so there's nothing to opt out of. Under California Civil Code §1798.83, California residents can ask us not to disclose personal information to third parties for their own direct marketing. We don't do that either. Both requests go to support@roundela.com and we'll confirm in writing.

Education records. Where the organisation using Roundela is a school or education provider, some of what it holds may be an education record under the US Family Educational Rights and Privacy Act (FERPA) or its equivalent elsewhere. Those records remain under the institution's control, and rights over them are exercised through the institution — see section 2.

12. Children

Roundela is not intended for use by children directly. Where a child's information is recorded in Roundela, it is entered by an organisation or by a parent or guardian, under that organisation's control and responsibility.

We treat information about children as a higher-sensitivity category and apply the same protections to it as to health information.

13. Changes to this policy

We may update this policy. Where a change materially affects how we handle personal information, we'll notify affected organisations by email at least 30 days beforehand.

Every version is dated, and previous versions stay published at roundela.com/privacy/archive. You should be able to see what this said when you agreed to it, not just what it says now.

14. Contact

support@roundela.com

LiftBound NZBN 9429051824150 New Zealand

Privacy Officer: Danielle Butler