Privacy policy
What we hold and why
- Workspace data (people, meetings, registers, documents your charity puts in): processed to provide the service, under your charity's instructions. Your charity is the controller; we are the processor.
- Account data (name, email, sign-in events): to operate secure access.
- Assessment data (Charity Control Check answers): stored against an anonymous identifier; linked to you only if you save your results or sign up.
- Public register data: from the Charity Commission's published extract, used to pre-fill and cross-check charity records.
What we don't do
- No sale of data, ever. No advertising trackers.
- Saving assessment results is not a marketing opt-in. Service emails and marketing consent are always separate.
- AI features process only the data the asking user is permitted to see, and we don't allow our AI providers to train on your data.
Where and how long
Data is hosted in the EU (Hetzner, Finland). Each charity's data is a separate database, exported or deleted as one unit on request. Anonymous assessments are deleted after 12 months of inactivity.
Your rights
Access, rectification, erasure, portability, and the right to complain to the Information Commissioner's Office. Email dpo@charitycontrol.co.uk.