Privacy notice

1. Who is the data controller?

The 1 Million Project is an independent personal crowdfunding/social-experiment project operated by an individual in the United Kingdom. For the supporter information described in this notice, The 1 Million Project determines why and how that information is used and acts as the data controller.

The organiser’s public identity is intentionally private. Stripe and other service providers may hold the organiser’s verified legal/account details as required for payment processing and compliance. You can contact the project through @the.1millionproject on Instagram. A dedicated project/privacy email should be added as the project’s public contact route before a full public launch.

2. What information do we collect or receive?

• Contribution information: Stripe checkout/session identifiers, payment status, contribution amount (£1), currency, timestamps and payment/refund identifiers.
• Contact information: the email address entered at Stripe checkout, used for contribution administration and the transactional thank-you/supporter-number message.
• Supporter information: the sequential supporter number assigned to a verified £1 checkout.
• Technical/security information: hosting and server logs may contain IP address, request time, browser/device information and diagnostic/security data.
• Messages you send us: information you choose to provide if you contact the project.

The project does not receive or store your full card number, CVC or online-banking credentials. Stripe handles payment credentials on its hosted checkout.

3. Why do we use this information?

• Administering contributions and supporter numbers: to verify a successful £1 payment, prevent duplicate processing, assign a supporter number and maintain the tracker. Our lawful basis is our legitimate interest in operating the project accurately and securely.
• Transactional confirmation: to send the supporter number and contribution confirmation. This is an administrative/service message, not a marketing subscription. Our lawful basis is legitimate interests in confirming and administering the contribution.
• Refunds, disputes, fraud and security: to respond to errors, chargebacks, unauthorised use, security incidents and abuse. Our lawful basis is legitimate interests and, where relevant, compliance with legal obligations.
• Accounting, tax and legal records: to retain records where reasonably necessary to meet legal, tax, accounting or evidential requirements. Our lawful basis is legal obligation where one applies and legitimate interests in maintaining appropriate records.

We do not currently use supporter emails for newsletters or promotional marketing. If marketing is introduced later, it should use a separate, clear opt-in where required.

4. Who processes information?

The project uses specialist providers to run the service. They process information under their own terms and/or on our behalf:

• Stripe — hosted checkout, payment processing, fraud prevention, refunds and payment records. Stripe privacy information.
• Supabase — private database used for verified contribution records and supporter numbers. Supabase privacy policy.
• Netlify — website hosting and serverless functions, including operational/security logs. Netlify privacy statement.
• Resend — intended transactional email provider for supporter-number confirmations once production email is enabled. Resend privacy policy.

We do not sell supporter personal data. Information may also be disclosed where required by law, court order, regulators, law enforcement, payment networks, or to protect the project and supporters against fraud or abuse.

5. International processing

Some service providers operate internationally and may process information outside the UK. Where UK data-protection law requires safeguards for an international transfer, the relevant provider/controller arrangements should rely on an approved transfer mechanism or other lawful safeguard. Provider locations and transfer arrangements can change, so their current privacy documentation should also be reviewed.

6. How long do we keep information?

Verified contribution and transaction records may be kept for up to six years after the relevant contribution where reasonably necessary for accounting, tax, disputes, fraud prevention and legal claims, unless a different period is required by law. We may anonymise or delete information sooner when it is no longer needed. Provider-side logs and payment records are retained under the relevant provider’s own retention rules.

7. Your data-protection rights

Depending on the circumstances and lawful basis, UK data-protection law may give you rights to ask for access to your personal data, correction, erasure, restriction, portability, or to object to certain uses.

If you ask us to erase payment/transaction information, some records may still need to be retained for legal, accounting, fraud, dispute or evidential purposes.

8. Security

Payment credentials are handled by Stripe rather than stored in this website. Backend credentials are intended to be kept in Netlify server-side environment variables, and the supporter database is protected using Supabase access controls. No internet service can promise absolute security, but the project is designed to minimise public exposure of supporter information.

9. Children

The project is not intended to collect contributions directly from children. If you are under 18, please do not contribute directly; ask a parent or legal guardian to decide whether to contribute using their own authorised payment method and email address.

10. Cookies and similar technologies

The project’s current website is designed without optional analytics or advertising cookies. Necessary hosting/security functionality may still process technical request information. The Stripe checkout is a separate service and is subject to Stripe’s own cookie/privacy practices. See our Cookie notice for more detail.

11. Changes to this notice

This notice may be updated as the project adds or changes services. Material changes should be dated and published here before they take effect where reasonably practicable.

12. Contact and complaints

For now, contact The 1 Million Project through @the.1millionproject. Before broad public launch, a dedicated project/privacy email should be published so data-rights requests can be handled more reliably.

If you have concerns about how your personal information is handled, you also have the right to complain to the UK Information Commissioner’s Office. See ico.org.uk/make-a-complaint.