Privacy Statement
This explains how your charity's Purpose Steward workspace handles personal data. Your charity is the data controller; Purpose Steward is the data processor acting on its instructions.
If you are a trustee
We hold the governance information your charity records about you: your name and role, contact details, term-of-office dates, eligibility and safeguarding-check dates, skills, and any biography or notes.
Much of this — your name and role as a charity trustee — is already in the public domain on the Charity Commission's public register. Contact details, check dates and notes are not public and are treated as ordinary personal data.
If you are a project or report contributor
We hold your name, organisation, email and your role on the projects you are part of, plus anything you submit (reports, updates, prayer requests). You only have access to the projects and reports you are involved in.
Why we hold it (lawful basis)
To run the charity's governance and meet its legal duties — relied on as the charity's legitimate interests and/or the performance of your role. We do not sell personal data or use it for advertising.
Sharing and AI
- Data is only visible within your charity's workspace; other charities cannot see it.
- If your charity turns on AI assistance, relevant text is sent to the AI provider it has configured (e.g. Anthropic, or a self-hosted model) solely to produce drafts/summaries.
Storage, security and retention
- Passwords are stored only as salted hashes. Workspaces are isolated per charity.
- Information is kept while you hold your role and for as long as governance records require, then removed on request or when no longer needed.
Your rights
Under UK GDPR you can ask to access, correct, or erase your personal data, or object to its processing. Contact your charity's administrator (the controller) in the first instance, or Purpose Steward as the processor.