Your information

Version: 2026-11-05.1

Westcountry Hosting Ltd, trading as Charity Starter, is responsible for your information. Registered office: 82A James Carter Road, Mildenhall, England, IP28 7DE. ICO registration number: ZC113293. Contact: hello@charitystarter.co.uk.

What we keep

Your email address, your order, the answers you type into the guided steps, and messages you send us.

If you turn on the free website: what you put on it, the email its contact form sends to, and reports sent through it. If you turn on emails about new features, that choice and when you made it.

Describe the organisation and its plans. Do not identify beneficiaries or include anyone's health, religious beliefs, criminal history or other private case details. Check trustee eligibility yourselves; do not send us the reasons for a disqualification.

Details for your forms

If you choose to give them: each trustee's date of birth, home address, email and date of appointment, the charity's bank account name, number and sort code, and, with the Gift Aid add-on or the HMRC recognition pack, each trustee's or official's National Insurance number. For a CIC application: each director's date of birth and home address.

The private trustee, director and bank fields are encrypted in your browser. Only our pack-building function decrypts them, in memory, to fill your documents. They are not returned to the screen or sent to Anthropic.

If you choose an own domain: the registrant details you give (charity name, contact name, postal address, email, phone, registrant type and charity number). They are stored separately and sent to Cloudflare and the registry to register your domain; the registry's public lookup hides them where it can. We delete our copy when the domain plan ends or your website is deleted.

Other trustees and directors

Before saving another trustee's or director's details, give them this privacy notice and confirm that you have done so. We record that confirmation and when you gave it. We use their names, roles and the private details above only to prepare the organisation's documents, and we do not contact them.

Why

We use account, order and application information to provide your pack, reviews, website and chosen subscriptions (contract). We use other trustees' and directors' details to prepare the organisation's documents (our legitimate interest in providing that service). We use contact details to answer enquiries and IP addresses and security records to prevent abuse (our legitimate interests in running and protecting the service). We keep legally required accounting records (legal obligation). Optional feature emails and Google Analytics use consent, which you can withdraw at any time. We use public Charity Commission and Department for Education register information to verify website eligibility and control (our legitimate interest in preventing misuse).

We need your email to sign you in and deliver the service. Required application and domain fields are marked; without them we cannot complete the relevant step. You can leave optional fields blank.

AI review

Anthropic processes your application answers and earlier findings to produce our AI review. Before sending, we replace the trustee and contact names you give us with labels such as "Person 1", replace contact details, and replace email addresses and UK phone numbers we find in your text. Other personal details you type can still reach it, so don't include private personal details. The separately encrypted fields are never sent. Anthropic does not train its models on this data under its commercial terms and normally deletes it within 30 days, with exceptions for legal obligations and enforcing its usage policy. The grade guides the submission walkthrough; it does not decide registration. Email hello@charitystarter.co.uk to challenge a result or report an access problem.

How long

Suppliers keep records under their own legal obligations; payment references can still be linked to records held by Stripe. Deleting your account here does not itself delete supplier-held records immediately.

Who else sees it

AWS hosts our application data in London (eu-west-2); its KMS manages encryption keys and Amazon SES sends service emails. Cloudflare hosts and protects websites and handles DNS and domain registration. Stripe processes payments and stores saved cards; it also acts as a separate controller for fraud prevention and legal checks. We keep payment references, not full card details. Domain registries receive registrant information. Anthropic provides the AI review. Website content is public; contact-form messages go to the website operator. Google receives analytics information only with your consent. Suppliers may use subprocessors. We may disclose information where required by law. We do not sell personal information.

Some suppliers process personal information outside the UK, including in the United States. For Anthropic we rely on the EU Standard Contractual Clauses with the UK Addendum in its data processing agreement. For Cloudflare and AWS we rely on the same clauses with the UK Addendum in their data processing terms. Stripe and Google rely on the UK Extension to the EU-U.S. Data Privacy Framework (a UK adequacy regulation), with the same contractual clauses as a fallback. Email hello@charitystarter.co.uk for the safeguard applying to a supplier and a copy.

Your rights

Subject to the legal conditions, you can ask to access, correct or erase your information, restrict its use, or receive a portable copy. You can object to processing based on legitimate interests and to direct marketing. You can withdraw consent at any time without affecting earlier lawful use. Email hello@charitystarter.co.uk to exercise a right or complain. We acknowledge data protection complaints within 30 days, investigate without undue delay, keep you informed and tell you the outcome. You can also complain to the Information Commissioner's Office (ico.org.uk (opens in new tab)).

Cookies

We use cs_sess to keep you signed in, for up to 30 days, and cc to remember your cookie choice for 180 days. Your working answers and progress are also stored in this browser until cleared; they do not automatically disappear after the server's 90-day limit. These functions support sign-in, your chosen settings and saving your work.

We count page visits on our server without cookies or identifiers (page, referring site, country, device type). IP addresses are processed separately to deliver pages and prevent abuse.

Google Analytics loads only after Accept, with advertising consent denied. It counts visits and purchases and uses _ga and _ga_* cookies for up to 2 years. Reject prevents analytics loading on a fresh visit; essential storage still works. Use Cookie choice in the footer to change your choice. Withdrawing consent stops our analytics events and removes analytics cookies on this site.