Privacy notice

Last updated 23 October 2026.

Trustee Meetings is a tool that helps the trustees of a charity run their board meetings. This notice explains what personal information we handle and why.

Who is responsible for your information

Your charity is the data controller for the information about its trustees and meetings. Trustee Meetings is provided as software by Spring Incubator Limited, which acts as a data processor on your charity’s behalf and only uses the information to run the service. The terms of that processing are set out in our data-processing agreement.

What we collect

• Your name and role, taken from the public Charity Commission register (used under the Open Government Licence v3.0).
• Public information about your charity’s company and its officers, shown on your Charity Details page. This comes from the Companies House register (Crown copyright, used under the Open Government Licence v3.0) — we only display the public record and add nothing to it.
• Your email address, so we can send sign-in links and meeting reminders.
• The board’s meeting content — agendas, papers, minutes and actions.
• Basic records of activity, such as which papers you’ve opened and when. This helps your chair see that the board is prepared for a meeting. It is visible to your charity’s organisers — not to other charities, and not to us for any other purpose — and it follows the same retention as your charity’s other records.

Why we use it, and the legal basis

Your charity uses this information to run its governance: signing trustees in, sharing papers, recording decisions and sending meeting reminders. The legal basis for most of this is your charity’s legitimate interests in governing itself well, and, for the parts that are needed to give you the service you asked for — such as emailing your one-time sign-in link — that the processing is necessary to provide the service (UK GDPR Article 6(1)(b) and (f)). We don’t rely on consent for these, because you need them to use the service; where we ever do ask for your consent, you can withdraw it at any time.

Asking for feedback: if your charity has set up an account but hasn't used it much, we may email the organiser once to ask what got in the way. We do this because we have a legitimate interest in improving Trustee Meetings. It is a request for feedback, not marketing, and it never includes offers. Reply "stop" and we won't send you emails like this again.

Where it is stored

Our main database and file storage are in Ireland, in the EU. Some of our providers process data in the United States, as listed below. Vercel processes website visit counts in the United States (see 'Counting visits to this website'). We do not sell your information or use it for advertising.

Who else processes your information

We use a small number of trusted providers to run the service. Each one only handles your information to provide its part of the service, under contract. Where each one stores or processes it is shown below:

• Supabase — the secure database and file storage that holds your board’s information (EU region).
• Vercel — hosts and delivers the website, and counts visits to public pages (United States, under the UK Extension to the EU-U.S. Data Privacy Framework).
• Stripe (payments and billing). Card and billing details go to Stripe, not to us. For UK businesses Stripe contracts through Stripe Payments UK, Ltd., and Stripe group companies in Ireland and the United States also process this data, in part as independent controllers for fraud prevention and their own legal duties. Transfers to the US rely on Stripe, LLC’s certification under the UK Extension to the EU-U.S. Data Privacy Framework, with the UK International Data Transfer Addendum as a fallback. Stripe’s privacy policy is at www.stripe.com/privacy.
• Resend (Plus Five Five, Inc., United States) sends our emails. We use its EU sending region, but its main processing takes place in the United States. Transfers rely on its certification under the UK Extension to the EU-U.S. Data Privacy Framework, with the UK Addendum to the standard contractual clauses in its data processing agreement.

Our AI features (summarising a paper, drafting minute notes, suggesting actions, and reading uploaded minutes) are switched off at the moment, so nothing is sent to an AI provider. While they were on, the text of any paper or minutes a trustee used them on, including minutes uploaded with ‘Bring in your minutes’, was sent to Anthropic, a US company, to produce the result. The transfer was covered by the UK International Data Transfer Addendum. Anthropic does not use it to train its models. Under its standard terms it deletes it within 30 days, unless it is flagged under Anthropic’s usage policy, in which case it may keep it for up to 2 years. We will update this notice before we switch AI features back on.

How long we keep it

We keep your charity’s records for as long as your charity has an active account, so your board always has its history to hand. If your charity closes its workspace, we delete its content straight away. Copies stay in our daily backups for up to 8 days and are then deleted automatically. If you are removed from a board, your access ends immediately. Your name may remain in historic minutes, because they are the charity’s official record of decisions; your contact details are deleted within 90 days unless you remain on another board.

Your rights

You have the right to see the information we hold about you, to ask us to correct it, and in many cases to ask us to delete it. To exercise any of these, contact your charity’s board or email us at the address below. You also have the right to complain to the Information Commission (ICO) at ico.org.uk.

How to complain about how we handle your data

If you believe we have handled your personal information incorrectly, you can raise a complaint by emailing us at brad@trusteemeetings.co.uk. We will acknowledge your complaint within 30 days and do our best to resolve it. If you are not satisfied with our response, or would prefer to raise your concern directly with the regulator, you also have the right to complain to the Information Commission (ICO) at ico.org.uk or by calling 0303 123 1113.

The grants tool

Separately from your charity’s own account, we run a no-login tool that matches charities with grant-making funders. This section explains the extra processing that tool involves.

The charity register mirror. We hold a copy of public information from the Charity Commission for England and Wales register — charity names, numbers, purposes, classification, area of operation and latest income — as it stood when we last refreshed it on 16 July 2026, used under the Open Government Licence v3.0. We obtain this from the Commission, not from your charity directly, so under UK GDPR Article 14 we are telling you here rather than contacting every charity individually. We do not mirror trustee names or any other personal information from the register; the tool only ever shows facts about the registered organisation. Our legal basis is legitimate interests — the data is already public under a statutory publication scheme, and we use it only for the purpose the tool exists for: helping a charity find funders. If you think something the tool shows about your charity, or about a funder, is wrong, tell us using the contact route on /grants/about-the-data. We aim to reply within 5 working days.

Searching. When you search, the charity name or number you type is sent to our server to find matching funders. We don’t store your search or your IP address in our own systems. Your IP address is used only for a moment, to limit how many searches can be made, and is then discarded. Vercel, our US host, keeps its own request logs for a limited time, and these include the search web address and so what you typed. Search results may be kept in Vercel’s cache for up to an hour to make repeat searches faster. Our legal basis is legitimate interests: running the tool and protecting it from misuse.

Counting template downloads

When you download one of our policy templates, we record which template it was, the page you came from, your browser’s user-agent string, and the date and time. We do this so we know which templates are useful and how many people are really using them.

To tell one visitor from another without tracking anybody, we combine your IP address and user-agent with a secret value that changes every day, turn the result into an irreversible code, and store only that code. We never store your IP address, and we don’t set a cookie for this. Because the secret changes daily, the code cannot be used to recognise you tomorrow, or to link what you did on two different days — it only lets us avoid counting the same person twice on the same day. Our legal basis is legitimate interests (UK GDPR Article 6(1)(f)): understanding how many people use a resource we publish, with the least identifying information that can answer the question.

Template downloads

For template downloads, the controller is Spring Incubator Limited (company number 08582887, ICO registration ZA082138).

If you choose to have a template emailed to you, we ask for your email address so we can send it to you. Our lawful basis is that this is necessary to provide what you asked for. If you choose to get one short follow-up about Trustee Meetings, we'll send it about three days later. Our lawful basis for that email is your consent, which you can withdraw at any time using the unsubscribe link in it. If you tick the box to hear from us, we'll also send you occasional emails about Trustee Meetings. We'll first send you an email asking you to confirm, and we won't send you those emails until you do. Our lawful basis for those is your consent, which you can withdraw at any time using the unsubscribe link in any email. We also send your email address, the template you downloaded, your choice about follow-up emails, the time you downloaded it and, if you gave them, your name and charity name to the Trustee Meetings founder, so he can see who is using our templates. We delete these notifications after 90 days. If you only downloaded a template, we keep your email address for 90 days and then delete it. If you opted in, we keep it until you unsubscribe, or for 2 years after you confirmed, whichever is sooner. After you unsubscribe, we keep your address on a do-not-contact list so we don't email you again. We send emails using Resend and Stackmail and store data with Supabase, as our processors. If you reply to one of our emails or email us, we keep that correspondence in our email accounts (Stackmail and Google Gmail) for as long as we need it to deal with your message.

Counting visits to this website

To understand how our public pages are used, we use Vercel Web Analytics and Vercel Speed Insights, provided by Vercel Inc., which also hosts this website. For this, Spring Incubator Limited is the controller and Vercel is our processor. No cookies are set. For each page view Vercel records the page address, the referring site, your browser, operating system, device type and approximate location derived from your IP address. Pages inside a charity's account are not counted. To avoid counting the same visitor twice in a day, Vercel creates a one-way code from your request, including your IP address and browser details, which is discarded within 24 hours. Your IP address is not stored, and you are not tracked across days or other websites. Vercel may also use this usage information for its own purposes, such as running and improving its services, under its own privacy notice. Our legal basis is legitimate interests (UK GDPR Article 6(1)(f)): understanding how the service is used so we can improve it. Vercel processes this data in the United States under the UK Extension to the EU-U.S. Data Privacy Framework, and the counts are kept for 12 months. You can switch visitor counting off for your browser at any time at Turn off visitor counting. We also treat a Global Privacy Control signal from your browser as an objection. We also count clicks from our guides, grants and template pages to our sign-up, sign-in, demo, how-it-works and pricing pages, and how many times each template is downloaded. These counts don’t identify you.

If you arrive through a link that includes a referral or campaign tag, or from another website, we keep that tag, or the name of that website, in your browser for the rest of that visit (not a cookie, deleted when you close the tab) so we can count where sign-ups come from. Turning off visitor counting or sending Global Privacy Control stops this.

Organisations we contact, and referral partners

Spring Incubator Limited (company number 08582887, ICO registration ZA082138) is the controller for this information.

1. Organisations we contact. If we email you about listing or partnering with Trustee Meetings, we got your work email address from your organisation's own website. We use it, and anything you send back, only to discuss that listing or partnership. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)): telling organisations that support charities about resources that may help them. If you tell us to stop, we will, and we keep your address on a do-not-contact list so we don't email you again.
2. Referral partners. If you ask for a referral link, we use your name, firm and email address to set up your link, write to you about it and, if you ask, tell you how many charities have signed up through it, but not which ones unless the charity agrees. Our lawful basis is legitimate interests (Article 6(1)(f)). We don't send you marketing unless you ask for it. We keep a partner's details for as long as their referral link is active. If you ask us to delete them, we will do so within one month. Otherwise we review them 12 months after your last referral or contact with us, and delete them if the link is no longer in use. To ask, email us at the contact address on this page.
3. Who handles it. Emails are kept in our email accounts (Stackmail and Google Gmail), and partner records are stored with Supabase, our processors.
4. Your rights. You can object at any time, and ask to see, correct or delete your information, by emailing brad@trusteemeetings.co.uk. You can complain to the Information Commissioner at ico.org.uk or on 0303 123 1113.
5. Charities that sign up through a referral link. We record which link or code you used, so we can count how many charities each partner referred. We don't tell the partner which charity you are unless you agree.

Contact

Questions about this notice can be sent to Spring Incubator Limited at brad@trusteemeetings.co.uk.