Privacy policy

Custodian is a grant management platform for charitable foundations, operated by Custodian Philanthropy Ltd, a company registered in England and Wales (company number 17320219), registered office Suite 1b1, Argyle House (Northside), Joel Street, Northwood Hills, HA6 1NW.

Foundations use Custodian to manage applications, awards, payments and reports. For the information a foundation holds in Custodian about applicants, grantees and their contacts, the foundation is the data controller and we process it on their behalf and on their instructions. If your question is about an application you made to a foundation, please contact that foundation first.

We are the data controller for information about the people who use Custodian (foundation staff and trustees), for anyone who contacts us, and for visitors to this website.

• Account information: your name, email address, role, the foundation you belong to, a profile photo if you add one, and a securely hashed password if you set one.
• Foundation data: what a foundation records or receives in Custodian, such as applications, organisation details, contact names and email addresses, budgets, bank details for grant payments, votes, comments and grant reports.
• Technical information: records of requests to our service (including IP address), kept to keep the service secure, prevent abuse and fix faults.
• Correspondence: what you send us if you email us or register interest.

• To provide Custodian to the foundations that use it, and to let you sign in.
• To send the emails the service exists to send, such as award and decline letters, sign-in codes, and notifications you can switch off in your profile.
• To keep the service secure, investigate problems and prevent misuse.
• To reply to you, and to tell foundations about Custodian if they asked us to.

Custodian uses AI to help foundations read and assess applications and reports. Before text is sent to the AI provider, email addresses, phone numbers, bank details and contact names are removed from it. The AI suggests; decisions are always made by the foundation's own people.

Our AI provider, Anthropic, processes this text under commercial terms which do not allow it to be used to train their models.

Where we act for a foundation, we process data under our contract with them and their instructions. For our own users and contacts, we rely on our legitimate interests in running a secure, working service and responding to enquiries, and on contract where we provide the service to you.

We do not sell personal data. We use these providers to run Custodian, each under a data processing agreement:

• Cloudflare: Hosting, network and security for the website and app. Location: Global network.
• Neon: Database where account and foundation data is stored. Location: London, UK.
• Resend: Sending emails from the app (letters, notifications, sign-in codes). Location: EU, Ireland.
• Anthropic: AI assessment of application and report text. Location: United States.
• Google: Sign in with Google, and turning delivery areas into map locations. Location: Global.
• Sentry: Error monitoring, with personal data collection turned off. Location: EU, Germany.

To check applicants, Custodian also looks up organisations on the public Charity Commission and Companies House registers, and postcodes on postcodes.io. Only the registration number or postcode is sent.

Some providers process data outside the UK, as listed above. Where they do, the transfer is covered by UK adequacy regulations or by appropriate safeguards such as the UK International Data Transfer Addendum.

Foundation data is kept for as long as the foundation uses Custodian and is deleted or returned when they leave, as agreed with them. When someone leaves a foundation their account is archived rather than deleted, because their votes and comments form part of the foundation's record of its decisions. Technical records are kept for a short period only.

Data is encrypted in transit and at rest. Access to each foundation's data is limited to that foundation's users, and passwords and API keys are stored only as secure hashes.

Custodian uses only the cookies it needs to keep you signed in. We do not use advertising or analytics cookies.

You have the right to ask for a copy of your personal data, and to ask us to correct it, delete it, restrict or object to how we use it, or move it elsewhere. Write to us at team@custodian.fund. Where a foundation is the controller we will pass your request to them.

You can also complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put things right first.

We will update this page when how we handle data changes, and tell foundations about any significant change.