How we handle your information on BidBuilders Major
This notice adds to the BidBuilders privacy notice, which still applies. It covers what is different about Major: the documents you upload, the evidence we fetch, and the drafts we produce. Last updated 25 October 2026.
Who is responsible
All One Planet Ltd, company no. 11017373, Blackhall Mill, Newcastle upon Tyne NE17 7LH, is the data controller. We are registered with the Information Commissioner’s Office, number ZC188092. Contact: grants@bidbuilders.co.uk.
What we store
- Your account
- Email address, password (hashed), sign-in records, and your plan and credit balance. Major shares one account with the BidBuilders small-grants service.
- Your organisation
- The registration number you verify and what the public register returns for it (name, status, income, trustees, employees, volunteers), plus the profile you fill in.
- Your documents
- The files you upload (accounts, strategies, policies, surveys, letters, previous bids), the text we extract from them, page counts, and any passages our checks flag as looking like instructions rather than content.
- Your applications
- The brief, the funder shortlist and the automated fit memo, the evidence ledger (official data for your postcode, your register entry, the funder’s guidance, extracts from your documents, your brief), every draft version with its scorecard and checks, your revision notes, and the outcome you record.
- Usage
- The cost and timing of each model call, so we can keep the service within its budget. Not your content.
Why, and on what basis
To provide the service you asked for (contract). To keep it secure and solvent, including rate limits and spend caps (legitimate interests). To send you the emails the service depends on: the draft is ready, the run has started, a problem needs attention (contract). We do not use your information for advertising and we do not sell it.
Who processes it for us
- Anthropic (the model provider). Your brief, the evidence ledger and the text of your documents are sent to the Anthropic API as part of a draft run. Under our API terms Anthropic does not train models on this data.
- Stripe takes subscription payments. We never see your card number.
- postcodes.io turns your postcode into a statistical neighbourhood so we can look up deprivation data. Only the postcode is sent.
- The public registers: the Charity Commission for England and Wales and Companies House. We send only the registration number.
- Funders’ public websites, which we read to collect their guidance. Nothing of yours is sent.
- Our email provider (currently Brevo) delivers the emails the service sends.
- Our server provider (Hostinger) hosts the service and the document store.
Colin Ellis reads every draft before release and can open your documents to check a citation. Nobody else does.
How long we keep it
Documents, their extracted text, and ledger rows containing extracts from them are deleted 12 months after your last activity on the service. The drafts themselves, the brief and the account remain until you ask us to delete them or the account is closed, so you can come back to a bid later. You can delete any document yourself at any time from the Organisation page; released drafts keep their ledger so you can still see what they relied on.
Security
Files are stored outside the web folder under random names and streamed only to the owning account and to Colin. Uploads are checked by file signature, limited to 16 MB and 12 per application, and rate limited. The text of your documents and the funder pages is treated as data, never as instructions, when it is given to the model.
Your rights
You can ask for a copy of what we hold, ask us to correct or delete it, object to processing, or complain to the ICO at ico.org.uk. Email grants@bidbuilders.co.uk and we will respond within a month.
Changes
If this notice changes in a way that matters, we will email you before the change takes effect.