Who else can see your data
Last updated 25 September 2026
Every company outside this agency that can see anything of yours is named on this page. For each one: what it sees, where it is, what contract binds it, and the day we last checked the row. No row says "our trusted partners". Where something is not confirmed, the row says so instead of guessing.
Everything runs on our own computers
The machine that does your work runs on our own computers. Your documents are not uploaded to a platform, and there is no product with your name sitting in a database waiting to be breached. The companies below see something only in the moment the work passes through them.
That is why this list is short. Most of what a supplier like us would normally hand to somebody else, we never hand over at all.
Three brains, and we assume they see everything
The thinking is done by large language models. Today we use three: OpenAI, Google and Anthropic. Which one does a given piece of work changes as they change, and it will change again.
So we will not draw a neat line around what each one sees, because that line would stop being true without anybody noticing. Assume all three see everything we work on for you: the research, the drafts, your notes, the documents you send us, and the names of the people a draft is written to.
If there is something you would not want a language model to read, tell us. We keep it out and do that part by hand.
The companies that can see your data, named
Under Article 28 of the UK GDPR we cannot put your data in front of anyone else without your written authorisation, and whoever we use must be held to the same duties we owe you. This is that list.
| Sees | Where | Binds | Row checked | |
|---|---|---|---|---|
| OpenAIChatGPT, one of the three brains | everything we work on for you. | United States. | OpenAI's own published terms, which it requires us to accept in order to use the service. | 19 Sep 2026. |
| GoogleGemini, one of the three brains | everything we work on for you. Gemini also sits inside our Google Workspace, so where a video meeting has automatic note taking switched on, it hears the meeting and writes the notes. That includes meetings with your team. | United States, with data centres worldwide. | Google's own published terms, which it requires us to accept in order to use the service. | 1 Oct 2026. |
| AnthropicClaude, one of the three brains | everything we work on for you. | United States, with data centres worldwide. | Anthropic's own published terms, which it requires us to accept in order to use the service. | 25 Sep 2026. |
| Google WorkspaceEmail, files, calendar and video calls | email you send us and email we send you, any file of yours we hold in order to do the work, and the details you give when you book a call. This is an ordinary business mailbox, not a product. | United States, with data centres worldwide. | Google's data processing terms for Workspace customers. | 1 Oct 2026. |
| CloudflareDelivers this website | the request your browser makes for a page here, meaning your IP address and the ordinary browser details that come with it. No account data goes through it. It carries the booking form to our calendar and keeps none of it. | United States, on a network spanning many countries. | Cloudflare's data processing addendum. | 19 Sep 2026. |
| HetznerThe servers behind Grants Finder accounts | your Grants Finder account, if you have one. The email address you registered, your organisation, and the searches you saved. | Germany and Finland. This data stays in the European Union at rest. | Hetzner's data processing agreement. | 1 Oct 2026. |
| Google AnalyticsSite statistics, only if you allow them | which pages are read and on what kind of device, only after you choose Allow analytics. | United States, with data centres worldwide. | Google's data processing terms for Google Analytics. | 25 Sep 2026. |
What none of them see
Your donor database, your CRM and your own mailbox stay yours. Where the work needs them we work inside your systems, under accounts you control and can withdraw at any time. Nothing belonging to one charity is ever visible to another, and no charity's data is used to improve what we do for anybody else.
You authorise this list, and you can object to it
Your contract with us carries a general authorisation for the companies on this page. That is not a blank cheque. If we add one, drop one, or swap one for another, we tell you before the change takes effect and you have thirty days to object. If your objection cannot be resolved, you can end the affected service without penalty.
The brains change more often than anything else here, which is exactly why this is a list you can check rather than a name buried in a contract.
To object, or to ask about any row, email marc@thestart.agency.
How this page stays true
- Every row carries its own date. Not one date for the page, one for each row, because rows go stale at different speeds.
- The rows are checked every month against each company's own published terms and its own sub-processor list. The dates move whether or not anything changed.
- A change is announced, not quietly published. You hear about it before it takes effect.
- If this page and reality disagree, this page is wrong. Tell us and we fix it that week.
Why this page exists. Of nineteen AI suppliers to UK charities we reviewed in September 2026, eleven publish nothing beyond a privacy notice: no AI policy, no named sub-processors. The duty is theirs as much as ours. We would rather you could check us.