Privacy

Booking a tour, applying to volunteer, or filling in a surrender form sends what you type on that form to the sanctuary you are dealing with. We store it so they can act on it. We do not sell it, and we do not share it with other sanctuaries.

Some sanctuaries add their own Facebook or Google advertising tags to those pages, so they can see which adverts brought people to them. When that is switched on:

• In the EU, the EEA, the UK, Brazil, Japan, South Korea and Canada you are asked first, and nothing loads unless you agree. Everywhere else the tags load when the page opens and you get a line at the top saying so, with a one-tap way to turn them off. We go by your browser's time zone, and if we cannot tell where you are, we ask.
• If your browser sends a “do not share” signal, or you have turned this off before, we do not count you.
• We tell Facebook and Google that a page was opened, which tour was chosen, and that a booking or an application happened — with the amount, for a paid booking. We never send your name, email address, phone number or postal address.

We record which pages get opened and how people get on with them: page views, clicks, how far through a form somebody got, and the sequence of actions leading into an error. It is used to find the parts of the software that are confusing or broken.

The text on your screen is never recorded. Controls are identified by the labels the developers wrote into the code, not by their contents — so an animal's medical notes, an employee's name or a donor's details cannot end up in the analytics. There is no session recording and no screen capture.

Behaviour records are deleted after 30 days. Page views are kept for 180 days, because they answer “is anyone still using this page”, and after 90 days they stop being linked to a person. This data is not sent to anybody outside the toolkit.

Animal, volunteer, visitor, employee and donor records belong to the sanctuary that entered them. Each sanctuary sees only its own; nothing is shared between sanctuaries except a Knowledge Base page a sanctuary deliberately shares, and posts it chooses to make in Sanctuary Connect.

Sweet Farm staff who run the service can see the data in order to support it and fix problems. We do not use it for anything else, and we do not sell it.

Card details are handled entirely by Stripe and never reach the toolkit. We store the amount and Stripe's own reference for the payment, so a booking or an invoice can be matched up and refunded. Money for a sanctuary's tours, produce or donations goes to that sanctuary's own Stripe account.

Emails the toolkit sends — confirmations, reminders, invitations, notifications — are sent through Google Workspace. We keep a record that they were sent, and for volunteer messages a copy of what was sent, so a sanctuary has the history of its own correspondence.

If a sanctuary holds records about you, ask the sanctuary — they control them and can correct or remove them. If you would rather come to us, or you are asking about the analytics above, write to anna@sweetfarm.org and we will help.