Privacy notice
What personal data the Fundraising System Audit holds, why, who processes it for us and how long we keep it.
Who we are
The Fundraising System Audit is provided by Fundraiser In The Room Limited, a company registered in England and Wales (company number 15974525), whose registered office is at 137 Heathcote Road, Leamington Spa, Warwickshire, CV31 2LX. We are the controller of the personal data described here. Our data protection lead can be reached at hello@fundraisingsystemaudit.com.
What we collect
- Account details: your name, role, email address and organisation.
- Payment details: Stripe collects your card and billing details; we receive your email, organisation, the amount and a payment reference.
- Your intake answers, which may mention colleagues and how your organisation works.
- Documents you upload, and the text we extract from them. These often contain staff names and other personal data.
- Your scores, report and any questions you ask about your report.
- Security records: sign-in records and an activity log, including IP addresses.
- Enquiries and invoice requests you send us.
- Which of our links brought you to us, if the link carried a tag (for example from one of our LinkedIn posts or emails). We keep it with your purchase, in Stripe and in our CRM, so we know which of our messages work. It names our campaign, not you.
Please do not upload supporter data: no names, contact details or giving records of individual donors. If you upload it by mistake, tell us and we will delete it.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Delivering the audit you bought: your account, scoring, the report and follow-up questions | Performance of our contract with your organisation, and our legitimate interest in delivering it to the people who use it |
| Taking payment and keeping financial records | Contract and legal obligation |
| Keeping the service secure and preventing misuse | Legitimate interests |
| Following up with you about the audit and our related services, through our CRM | Legitimate interests. You can object at any time and we will stop |
| Improving the method using anonymised, combined results | Legitimate interests |
| Counting visits to our public pages, and knowing which of our links bring buyers | Legitimate interests. You can object at any time by emailing us |
How AI is used
Your answers and the text of your documents are sent to Anthropic’s AI model to draft scores and report text. Anthropic processes them for us under zero data retention: they are not stored after processing and are not used to train models. An expert from Fundraiser In The Room reviews every report before it is released. No decision with legal or similarly significant effects on any individual is made by automated means.
Who processes data for us
We use these providers, each under a data processing agreement. They act only on our instructions.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in and document storage | London |
| Vercel | Hosts the website and app, and counts visits to our public pages without cookies | London for processing; company based in the United States |
| Anthropic | AI scoring and report drafting, under zero data retention | United States |
| Stripe | Payments and invoices | Inside and outside the UK |
| Postmark | Sends sign-in codes and service emails | United States |
| Inngest | Runs background jobs; receives reference numbers only, never your content | United States |
| HubSpot | Our CRM: your contact details, organisation, what you bought and your headline scores | Inside and outside the UK |
| Microsoft 365 | Our email | Inside and outside the UK |
Transfers outside the UK
Where a provider processes data outside the UK, we rely on safeguards recognised under UK law: UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement or Addendum approved by the Information Commissioner.
How long we keep it
Deleted data stays in our encrypted database backups for a short time until those backups are replaced. Uploaded documents are not included in backups.
| Data | Kept for |
|---|---|
| Uploaded documents and their extracted text | 30 days after your report is released |
| Your report online, and the follow-up questions | Available to you for 90 days after release; questions deleted at 90 days |
| Intake answers | 365 days after release, for internal analysis |
| Scores and report | 500 days after release |
| Activity log | Security entries 12 months, other entries 90 days; IP addresses removed after 90 days |
| Account details and CRM record | Until you ask us to delete them |
| Payment and invoice records | As long as the law requires us to keep financial records |
Cookies
We use one essential cookie to keep you signed in. We do not use analytics or advertising cookies.
We count visits to our public pages with Vercel Web Analytics, which sets no cookie, keeps nothing on your device and does not follow you to other sites. It works out a daily count from your IP address and browser type without storing either. We do not count visits to your account, your audit or your report.
Your rights
You can ask for a copy of your personal data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Email hello@fundraisingsystemaudit.com. We will reply within one month.
If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk.
Changes to this notice
If we change how we use personal data, we will update this notice and the date below.
Last updated 28 October 2026.