Damano · Version 5 October 2026

How Damano uses your information

This notice explains what information Damano collects about you, why, who we share it with, how long we keep it, and your rights. If anything is unclear, ask us.

Who we are

Damano is run by Heather Nyoni, trading as Damano, while Damano Ltd is being registered as a company in Scotland. When it is registered, Damano Ltd becomes responsible for your information and this notice will show its company number.

Address: 37 Bridgend Road, Falkirk FK1 2NT. Email: support@damano.uk. Our registration with the Information Commissioner's Office is being completed and its number will be added here.

What this notice covers — and what it does not

It covers you if you visit damano.uk, sign up for Damano, are an account owner or billing contact for an organisation that uses Damano, or contact us.

It does not cover the information a care provider keeps in its own Damano account about its staff, job applicants or the people it supports. For that information the care provider is responsible, and Damano only holds and processes it on the provider's behalf, under a written data processing agreement. If you work for, applied to, or receive care from a provider that uses Damano, please read that provider's own privacy notice, or ask them.

What we collect, and why

• When you sign up: your name, work email address, your organisation's name and UK nation, and the plan you chose. We use these to create and run your account, because that is our contract with your organisation.
• Your password and two-step sign-in: we store your password only in a scrambled (hashed) form that cannot be turned back into the password, and the secret your authenticator app uses. These keep your account secure.
• Billing: your plan, payment history, invoices and billing contact. Card and bank details are entered on Stripe's own secure pages — we never see or store your card number or bank details. We keep billing records because the law requires it, and to run your account.
• When you email us: your message and contact details, so we can answer you. This is in our legitimate interest in supporting our customers.
• Security records: when you sign in, failed sign-in attempts, the internet connection (IP address) a request came from, and a log of the actions taken in an account. We use these to protect accounts from misuse, and so that a care provider can see who did what in its own records.
• Emails we send you: trial and billing reminders, security messages and service notices. We keep a record that each was sent. These are part of providing the service. We do not send marketing emails unless you ask us to.
• Visiting the website: our hosting provider records basic technical information about each visit — the IP address, browser type and the page requested — to keep the site running and secure.
• When a page fails: details of the error, with personal details removed where we can, so we can fix it.

We do not sell your information, use it for advertising, or make decisions about you by automated means.

Cookies

Damano uses only the cookies it needs to let you sign in. There are no analytics, tracking or advertising cookies, which is why there is no cookie banner.

• indate_session — keeps you signed in. It lasts until you sign out, or at most 7 days, and office logins are signed out after a short period of inactivity.
• indate_challenge — used for about 10 minutes while you enter a two-step sign-in code.
• indate_device — only if you tick "remember this device": it lets this browser skip the two-step code for 30 days. You can forget a remembered device at any time under Your account.

Who we share it with

We use a small number of trusted suppliers to run Damano. Each only receives what it needs, and each is bound by a written agreement to protect it.

• Vercel — runs the website and application (in London; US parent company).
• Neon (Databricks) — the database and its daily backups (in London).
• Cloudflare — stores uploaded documents and weekly backups (in the European Union).
• Stripe — takes payments and keeps payment records.
• Resend — sends Damano's emails (United States).
• Google Workspace — our own email, including support@ and accounts@.

We may also share information with professional advisers (for example our accountant or solicitor), or where the law requires it.

Information that leaves the UK

Some of our suppliers are based in, or have parent companies in, the United States, and the European Union holds our document storage. The UK recognises the European Union as giving adequate protection. Transfers to the United States are protected by the UK–US data bridge or by standard contractual clauses approved for UK use.

How long we keep it

• Your account: for as long as your organisation uses Damano. If the account is paused — because a trial ends unpaid, or a subscription ends — it is kept for 90 days so you can come back or take a copy, and then deleted. Backup copies are overwritten within a further 8 weeks.
• Billing records: six years, as the law requires.
• Emails we sent: the content after 12 months, and the record that an email was sent after 24 months.
• Sign-in and audit records: at least 13 months, and longer where they form part of a care provider's own records.
• Emails you send us: for as long as we need them to deal with your question, and no longer than two years after it is resolved.
• Deleted accounts: we keep a short register that an organisation's account was deleted — its name, the date, and how many records were removed — so that we can confirm the deletion. It contains nothing about the people in it.

Your rights

You can ask us for a copy of the information we hold about you, and ask us to correct it, delete it, limit how we use it, or give it to you in a form you can take elsewhere. You can object to us using it for our legitimate interests. Email support@damano.uk — we will reply within one month.

If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

We will update this notice when something changes. The date at the top shows the version you are reading.