Privacy notice

Last updated 8 November 2026. MyFundyPal is in an early pilot. Our solicitor is reviewing this notice and it may change; we will tell account owners about important changes.

Who we are

MyFundyPal is run by TechTherapist Ltd, a company registered in Scotland, number SC809163, registered office 95 South Bridge Street, Bathgate, EH48 1TJ. Contact us about privacy at support@myfundypal.com.

For account details, we decide how your data is used. For documents and other content your organisation adds, your organisation decides what goes in and we act on its instructions.

What we collect

• Account details: your name, email address, role, a protected form of your password, and your two-step sign-in settings.
• Organisation details: name, legal form, registered number, website, income, mission and activities, including details from public registers.
• Content you add: documents, profiles, funding applications, funder emails and notes. These may contain personal data about trustees, staff, volunteers or the people your organisation supports.
• Activity records: what was done in MyFundyPal, by whom and when, including approvals and consent to act as a signatory.
• Signatory checks: for anyone who approves applications, their declaration that they may sign, the result of their identity check and their legal name, any public register entry that matches them, and any document they upload to prove their authority.
• Billing details: the plan, invoices and payment status. Card and Direct Debit details are held by Stripe, not by us.
• Chat messages: questions typed into the help chat on our website. Email addresses and phone numbers are removed before the AI sees them.
• How you found us: when you sign up, the campaign tags on the link you followed (for example from an advert or a post) and the website that sent you, stored with your organisation. We do not use cookies or store anything on your device for this.
• Technical data: IP address, browser details and security logs.

Please do not upload personal data you do not need for fundraising, particularly health or other special category data about the people you support.

How we use it, and why

• Provide your account and the service: to perform our contract with you.
• Read your documents and write drafts using AI: to perform the contract, or in your organisation's legitimate interests.
• Send sign-in, invitation, security and billing emails: to perform the contract.
• Take payments: to perform the contract.
• Check that signatories are who they say and may act for their organisation: in our and our customers' legitimate interests in preventing fraud. The face match in the identity check uses biometric data, which Stripe only processes with your explicit consent, given in its own check.
• Keep the service secure and prevent misuse: legitimate interests.
• Keep activity and approval records: legitimate interests and legal obligations.
• Answer questions in the website help chat: legitimate interests.
• Meet legal duties, such as tax records: legal obligation.

AI suggests which funds fit and drafts applications. A person at your organisation decides what to do and approves anything that is submitted. We do not make decisions with legal or similarly significant effects about individuals by automated means alone.

Before your text reaches an AI provider, we replace personal details we can identify, such as names of your team, email addresses, phone numbers, postcodes and bank details, with placeholders, and restore them in the result. This reduces what the provider sees, but it cannot catch every personal detail, particularly names in free text, so the text is still treated as personal data.

Our browser helper reads the labels of a form you choose and fills it in your own browser. It sends form labels to the AI provider, not your answers. The helper has its own privacy page.

Signatory checks

Before anyone can approve an application or a reply to a funder, we check two things, to stop people signing in an organisation's name without the right to.

• Identity. Stripe asks for a photo of your passport, driving licence or ID card and a live selfie, and checks they match. We receive the result and your legal name. We never receive or store the images, which Stripe keeps under its own terms. The result lasts 3 years.
• Authority. We look your legal name up on Companies House, the Charity Commission register or the Scottish Charity Register, and re-check it every week. Or a MyFundyPal administrator reviews a document you upload, such as a board minute or signed authority letter. Or another verified signatory in your organisation confirms you. This lasts 12 months.

Documents you upload for this are kept apart from your organisation's other documents, are never read by AI, and only MyFundyPal administrators can open them. Each time one is opened, it is recorded. A rejected document is deleted at once, and every document is deleted when you leave the organisation's team. If a name does not match, a person checks it rather than a machine deciding.

Who we share it with

• Cloudflare: hosting, database and file storage. The database and files are kept in the EU.
• Anthropic (Claude), a US company: AI reading and drafting, unless your organisation chooses Mistral. It also reads public funder pages for all organisations and answers the website help chat. Processing may take place in the United States.
• Mistral AI, a French company: AI reading and drafting, only if your organisation chooses it.
• Stripe: payments, invoices, and identity checks for signatories.
• SendGrid (Twilio): account and billing emails. Processing may take place in the United States.
• Companies House, the Charity Commission and the Scottish Charity Regulator (OSCR): public register lookups. We send the organisation's number and read its public list of directors or trustees.
• Find that Charity: register lookups you start when adding an organisation. We send the search text, not your documents.

Anthropic does not use content sent through our business account to train its models. We are confirming the same for each other provider before launch.

We do not sell personal data. We may share data if the law requires it. Your organisation's team members can see its content.

Transfers outside the UK

Some providers process data outside the UK. Where they do, we rely on the safeguards UK law provides for this, such as adequacy regulations, the UK-US data bridge, or the UK International Data Transfer Agreement or Addendum, depending on the provider.

How long we keep it

• Account details: while your account is open.
• Organisation content: until your organisation deletes it or closes its account.
• Signatory checks: identity results last 3 years and authority checks 12 months. Authority documents are deleted when rejected or when the person leaves the team. Stripe keeps identity images under its own terms.
• Billing records: as long as tax and accounting law requires.
• Backups and recovery copies: for a limited period after deletion.

We are confirming the exact periods after an account closes, and for activity records, security logs and chat messages, with our solicitor, and will add them here.

How we protect it

We keep the database and files in the EU, protect passwords with salted hashes and a separate secret, and encrypt connections. Owners and signatories must use two-step sign-in. Sessions end after 2 hours without use and after 12 hours in any case. Each organisation's data is kept separate.

Your rights

You can ask to see, correct, delete, restrict or move your data, and you can object to how we use it. If you gave consent, you can withdraw it at any time. For content your organisation added, we may pass your request to that organisation.

Contact support@myfundypal.com. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we would like the chance to help first.

Cookies

We use one essential cookie to keep you signed in. We do not use advertising or analytics cookies. Stripe's own payment and identity pages, which open on Stripe's site, set their own cookies.