Privacy Policy

1. Who we are

The НПО Хелп (NGO Help) tools at app.ngohelp.bg (letters and newsletters, sign-up forms, certificates, websites at name.ngohelp.bg) are provided by:

Фондация „НПО Хелп“ (NGO Help Foundation), Bulgarian company number (ЕИК) 207434909, email: [email protected].

Below, “we” means this organisation, and “you” the organisation or person using the tools.

2. Whose data it is

• Your account with us (which Google account you sign in with, counters, server settings): we are responsible for this data.
• The data of the people on your lists (subscribers, donors, volunteers, certificate recipients): your organisation is responsible for it. When such data passes through our server or is kept by us (sign-ups from your website, the short data for checking a certificate, the content of your website), we process it only on your behalf and on your instructions, as a processor under Article 28 of the GDPR. Details are in the Terms of use (in Bulgarian).

If you are a subscriber or a certificate recipient and have a question about your data, the quickest way is to write to the organisation that wrote to you. You can also write to us: we will pass the question on and help.

3. Signing in with Google and what we see of your Google account

You sign in with a Google account. Google shows you which permissions we ask for, and nothing happens without your “Allow”. We ask only for these:

Name, email address and profile picture (openid, email, profile)

To show in the tool which account you are signed in with. Our server checks with Google that a request comes from you and from our app. Your email address is not stored on the server: we keep only its SHA-256 hash (a coded fingerprint), to link your forms, websites and certificates and the AI helper's daily limit to you. Your name and picture are shown only in your browser and are not kept.

Only the files you pick in Google Drive (drive.file)

The tools open only the Google Sheets you pick yourself (in Google's file picker) and the files they created for you: a folder „НПО Хелп“ with your organisation's profile, drafts and settings, and the subscribers Sheet. In those Sheets they write columns such as “Sent” and “Certificate code”, and new subscribers. Your other files are not visible to us.

Sending email from Gmail (gmail.send)

So that you can send a newsletter, a letter or certificates from your own Gmail. Emails are sent only when you press Send. With this permission the tools cannot read, search or delete email in your mailbox.

Most of the work happens directly between your browser and Google. The access Google gives the browser is temporary (about an hour) and is not sent to third parties.

Lasting permission for the sign-up form („Добавяйте ги веднага“ – “Add them right away”)

Only if you press „Добавяйте ги веднага“ for your website's sign-up form does Google give us a lasting permission for your account, only for the tools' own files (drive.file). Our server keeps it locked (encrypted) and uses it for one thing only: to add new subscribers to your Google Sheet at once. Our server never sends email from your Gmail. We delete the permission when you press „Изключете“ (Switch off) in the tool (we then also revoke it at Google), or when Google tells us you have revoked it.

A permission given before 25 October 2026 also includes sending email; we don't use that part. To replace it with the new, narrower permission, press „Изключете“ and then „Добавяйте ги веднага“ again.

Limited Use of data from Google

NGO Help's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This means that data from your Google account:

• is used only for the features of the tools that you see and start yourself;
• is not sold, not used for advertising and not given to anyone, except the providers in section 6 as far as these features need it, or when the law requires it;
• is not used to train artificial intelligence models;
• is not read by people, unless you ask us for help and agree, it is needed for security (for example in a case of abuse), or the law requires it.

4. What stays only with you

• In your Google Drive and Google Sheets: your contact lists, your organisation's profile (name, logo, colour, IBAN, signatures, the text at the end of letters), the drafts and settings of each tool, the subscribers Sheet and the list of people who unsubscribed.
• In your Gmail: the emails you sent, in “Sent” as usual.
• In your browser: certificates (PDF) and ZIP files are made in the browser; pictures and PDF files are made smaller in the browser. The browser remembers only how far you got in the “How it works” guide, and the demo keeps its example data there. We set no cookies (signing in with Google uses Google's cookies).

5. What our server keeps, and for how long

Our server runs on Cloudflare; the database and the websites' files are in Europe. We keep the following:

AI helper (optional)

How many times a day you used the AI helper, under the hash of your email address (the limit is 30 a day). Your notes and the finished drafts are not stored. The counters are deleted automatically after two days.

Your website's sign-up form

The form's texts that are shown publicly on your website (organisation name, title, consent text, a link to your policy, topics, colour) and a public key for locking; the hash of your email address. Where the subscribers are kept, which Sheet and which tabs to fill in, the texts of the two emails, the sender name, the reply-to address (the email you sign in with, unless you gave another), the signature and the unsubscribe link, and, if you switched on „Добавяйте ги веднага“, the locked Google permission (section 3). We keep them while your form is in use, or until you ask us to delete them.

Sign-ups from your website

The visitor sends an email address, a name (optional), the chosen topics, the consent text, the page address and the time. What happens next depends on where you chose to keep your subscribers:

• In НПО Хелп (only there, or with a copy in a Google Sheet): we keep the subscriber in your organisation's list, locked (encrypted) with our key, with the code from the confirmation email and when they confirmed. Only you see it, in „Абонати“ (Subscribers); you can download it (CSV) and delete the whole list at any time. People who don't confirm are deleted after 30 days. People who unsubscribe are deleted from the list; we keep only a hash of the address and the date, so we don't write to them again. The copy in your Google Sheet is filled in as described below.
• In a Google Sheet only: we keep, locked with our key, only what we need to send the two emails (email address, name, topics, the confirmation code), until they are sent; after that only a hash of the address remains. The sign-up itself goes into your Sheet: if you switched on „Добавяйте ги веднага“, it waits a few seconds (locked with our key) and is deleted from the server; otherwise it is locked with your organisation's key – we cannot read it – and waits until you open the tool. It is deleted as soon as the tool collects it, and if nobody collects it, after 60 days.

Emails to new subscribers

The confirmation email and the welcome email are sent by us, through Cloudflare Email Service, from [email protected], with your organisation's name as the sender; replies go to your organisation's reply-to address. The welcome email (and newsletters to a list kept in НПО Хелп) contains a personal one-click unsubscribe link. We don't track opens or clicks. We count how many emails we sent each day, to keep to the limits. If your organisation sets up its own address on its own domain, these emails go from that address through Microsoft Azure Communication Services (section 6).

Spam protection

A count of sign-ups from the same internet address per hour, kept under a hash (not the address itself), and a count of the emails to new subscribers sent that day. They delete themselves within two days.

Certificates (if checking by QR code is on)

For each certificate: the code, only the first name and the first letter of the surname of the person, what it is for, the organisation, the date, and the hash of the email address of the account that issued it. Anyone with the code can see these at verify.ngohelp.bg – which is why there is no email address, full name or anything else there. They are kept as long as the certificate needs to be checkable; we delete them if the organisation or the person asks. If you switch checking off, nothing is sent to the server.

Websites at name.ngohelp.bg

The website's content (texts, pictures, PDF files), the last 10 published versions, its address, and the hashes of the email addresses of the owner and invited editors. The files are in Cloudflare's storage (R2). Published content is public – that is the point of a website. We keep it while the website exists; you can download the whole website as a ZIP at any time and ask for it to be deleted.

6. Who else is involved

• Google – sign-in, Drive, Sheets, Gmail, the file picker and the pages' fonts. Google processes data under its own terms and policy.
• Cloudflare – hosts the pages, the server, the database and the websites' files, and sends the emails to new subscribers (Cloudflare Email Service). Like any host, it sees the technical data of each request (for example the internet address) and keeps it briefly, to run and protect the service; for the emails it sees the recipient's address and the content, as far as needed to deliver them.
• Microsoft Azure Communication Services, in an EU data centre – only if your organisation sends the emails to new subscribers from its own address on its own domain. It sees the recipient's address and the email, as far as needed to deliver it.
• Microsoft Azure OpenAI, in an EU data centre – only if you use the AI helper. We send only what you wrote in the AI helper's box (or the letter's text, when you ask for subject ideas), the organisation's name and the column headings of the list (for example “Name”). No data of the people on the list is sent. Under Microsoft's terms this data is not used to train models.
• Google Public DNS – the check “will the email reach the Inbox” asks Google's public DNS for the records of the domain you send from (not for people's addresses).

Some of these providers may process data outside the EU. The GDPR safeguards then apply (for example the EU standard contractual clauses or the EU–US Data Privacy Framework).

7. Legal basis

• To provide the tools you asked for (Article 6(1)(b) GDPR).
• Legitimate interest: security, protection against spam and abuse, daily limits (Article 6(1)(f)).
• We process the data of the people on your lists only on your instructions (Article 28). The legal basis for it (for example consent to a newsletter) is yours.

8. Security

• All connections use HTTPS.
• The lasting Google permission is encrypted (AES-GCM) with a key only our server has.
• Sign-ups waiting for your Sheet are locked with your organisation's key, and we cannot open them. The subscriber list kept in НПО Хелп is encrypted (AES-GCM) with a key only our server has, and is shown only to the account that made the form.
• Instead of email addresses we keep their hashes.
• The server accepts requests from the tools only with a valid Google sign-in issued for our app.

9. How to stop access and delete your data

• Stopping access to your Google account: open myaccount.google.com/permissions, choose „НПО Хелп“ and remove access. If you switched on „Добавяйте ги веднага“, first press „Изключете“ in the tool: that way we delete the permission at once.
• Data in your Google Drive: delete the „НПО Хелп“ folders and your Sheets like any other file. They are yours, and we cannot delete them for you.
• The subscriber list in НПО Хелп: in „Абонати“ press „Изтрийте целия списък“ (Delete the whole list). It is deleted at once.
• Data on our server (forms, websites, certificates, counters): write to us at [email protected] from the account you sign in with. We delete it within 30 days. Sign-ups nobody collected delete themselves after 60 days.

10. Your rights

You have the right to ask for access to your data, correction, deletion, restriction of processing and portability, to object to processing based on legitimate interest, and to withdraw consent. Write to us at [email protected]; we answer within one month. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg).

11. Children

The tools are for organisations and the people who work for them. They are not meant for people under 16.

12. Changes

If we change this policy, we will publish the new text here with a new date. For an important change we will tell you in the tools before it takes effect.