GROW Mentoring runs GROW Insights (growmentoringadmin.com), the site its team uses to run the charity's work, and the staff expenses portal at /expenses. This notice is for the people who sign in to them: GROW's staff and volunteers. It explains what the site keeps about you, how your use of it is recorded, who can see that, and what you can ask us to do.
Mentees with a GROW member account have a privacy notice of their own, at /portal/privacy, which is the one to point a mentee to.
GROW Mentoring is responsible for this information. Questions, requests and concerns go to david.growmentoring@gmail.com. GROW Mentoring is registered with the Information Commissioner's Office, registration number ZC284018.
Last updated 27 October 2026.
Your use of this site is recorded
Every time you change something on GROW Insights, the site records who you are, when you did it and what you changed. This record is GROW's audit trail. It holds:
- every change you make: anything you add, edit, tick, pair or unpair, open or close, mark as paid, note or delete, and every bank line you reconcile in Accounting;
- when you sign in and sign out, on the site and on the staff expenses portal;
- the first and the last time you used the site on each day;
- each time you look at someone's bank details, and each time you download a full backup.
It also records changes others make about you (your expenses, gifts recorded to you, your availability, your profile and your access).
Setting up two-step sign-in, adding or removing a passkey, and making new recovery codes are recorded as changes, never with the name you gave a device; an owner resetting your two-step sign-in is recorded as theirs. Confirming a sign-in with your passkey or a recovery code is not recorded: your sign-in with Google before it already is.
It does not record which pages you look at, what you click, how long you spend on any page, or your location or device. (The only counts of pages are of views of the GROW Member Portal preview, and of the tabs of the GROW member portal: views of each page or tab each day, and moves from one to another, with no one's name, kept for 400 days.) When a change is about a member of the public (a mentee, say), the record names them, but never holds the words of a note, a reason you give, bank details, or a full bank account number.
What David can see: the Owner Dashboard
The record is shown only on the Owner Dashboard's Activity tab, and only to David FitzGerald, as the owner of GROW Insights named to see it. Nobody else on the site can see the record, not even other owners: other owners see the Owner Dashboard's Team list and Staff Access, never the record. It shows the record a week at a time:
- each change made that week and who made it (who paired whom, who deleted an invoice, and so on), so that a mistake can be traced to where it happened and put right. The changes are listed person by person, then by the part of the site and the kind of change, not in the order they were made: only one person's changes of one kind in one part of the site keep their order, with no time to them;
- how many changes each person made that week, and of what kinds, as an overview of the work done;
- who made no changes that week, and whether each person has ever signed in at all (so an account that has never been used stands out).
What it never shows: the time or day of anything anyone did, only the week it was in; anyone's sign-ins or sign-outs; and when, or for how long, anyone is on the site. So David cannot use it to track your movements on the site. This week's changes appear as they are made, so looking again later shows what has been done since, but never when. The site still keeps the times in the record, as part of GROW's audit and security trail, but the Owner Dashboard never shows them, to David or anyone else.
Dates in what it shows: where a change involves a date that is the day someone did something, or a set time after it, the dashboard gives only the week that date falls in: the date of a gift, of a chase-log note, of an invoice, when it is due and when it was paid, the date a pair was made, and when a link, a sign-up form or an access code closes or runs out. A date that belongs to the thing itself is shown in full, such as an event's date, a contract's start and end, a milestone's or a cohort's date on the Partnership Tracker, a firm's planned start or a bank line's date. Such a date can be the day the change was made (an event added for today, say), but the dashboard never says when the change was made.
Some facts are also kept with GROW's other records, where others can see them: every owner can see on Staff Access the date you last signed in, and on Staff Expenses the date you last opened the staff expenses portal, so they can manage who has access (the date only, never the time); owners, and the people given Reimbursements, can see a log of who revealed a claimant's bank details on the Reimbursements tab, and when; and records such as notes, claims and statement imports show who added or made them, and often when, to everyone who can see the record, as they always have.
The full record, times included, is also in the daily backups, which are held privately and encrypted so that only David can open them (see Who else handles your information), in Fly.io's daily snapshots of the database, and in a full backup David downloads himself. Separately, the server's own logs at Fly.io, kept to run the site and fix faults, note many changes with the email address of the person who made them.
Who sees which part of the site: Allow permissions
Each part of the site that holds personal data or money (Partnerships, Invoices, Pairing, Events, Reimbursements, the GROW Member Portal, Finance, Staff Expenses and CSO) is shown only to the owners and to the people David gives it on the Owner Dashboard's Allow permissions, which only he can see or change. Someone new starts with none of them: they see Home, the team and their own profile until David switches more on. Within Events, the money on an event (its price, costs and what they add up to) is shown only to people with Finance, and each person's own answers on an event sign-up or feedback form to questions ticked Diversity question or Sensitive, and the details they give after them, only to people given Sensitive answers. Everyone else with Events sees the totals of those answers (on Statistics, Analytics, the figures across events and the event report) rounded to the nearest 5 with groups of fewer than 5 hidden, so that no total beside a list of names can be traced to anyone. Dietary and access needs, which the day and the caterer need, are for everyone with Events. In Accounting, a travel claim (an attendee's claim suggested for a bank line, matched to the line that paid it, or named on it) is shown only to people with both Finance and Reimbursements; with Finance alone, a line that paid one reads as any other line. Staff expenses matched to their bank payment, and whose staff expenses an event's page lists, are shown only to people with both Finance and Staff Expenses; the owners have both. The GROW Member Portal shows each member's tier and whether their profile and mentee details are complete, never an answer of either, and only the people given it make someone a GROW mentee or end it by hand (the site's daily check also makes a GROW mentee of a member with no tier yet whose mentee sign-up has been accepted, or marked paired outside the site, on Pairing, or paired there once the pair's cohort has started, or at once for a pairing recorded with no cohort, as some older ones are); Sensitive answers never opens a GROW mentee's details, which nobody on staff, owners included, is shown.
The site keeps, for each email address, which parts it has been given, who gave each and when, and every change is a line of the record above. What an email address was given goes with it: it is deleted when that email is changed on a profile, moved to another person, or can no longer sign in, and the next address starts with nothing. It is deleted too when the address is made an owner, who sees everything, or stops being one, who then starts again with nothing.
David can preview what a member of staff's permissions on Allow permissions show, to check what they can and cannot see. It is his own sign-in, read only (nothing can be changed during it), for 30 minutes at most; he never signs in as the person, and their sign-ins, account and passkeys are never touched. Each start of a preview is recorded on the Owner Dashboard, naming whose view it was, and so is each end by Exit preview or by signing out; a preview that ends any other way, such as when its 30 minutes are up, has its start recorded but not its end. What he looks at during it is not recorded, as anywhere else on the site, and the preview shows nothing his own access does not.
Who may use the GROW member portal is David's alone to decide as well, on the Owner Dashboard's Portal access, which nobody else can see or change. He approves members by their email address; nobody else can sign in to the portal, and an access code made on the GROW Member Portal's Access codes links a sign-up and gives its tier but does not open the portal on its own. Portal access lists the requests of people refused when they signed in, or signed out on their next visit because they were not approved (their email address, their name and the date), each deleted once he decides it or 30 days after it was made, the addresses approved and the accounts not yet approved. When someone the portal is not open to asks GROW, by email, to delete their account, he deletes it there, exactly as their own Delete my account would; nobody at GROW downloads a member's data for them. Each approval, decline, removal and account deleted is a line of the record above, naming the member's account but never an email address, and an account deleted only as "a GROW member".
On the CSO (Central Statistics Office) tab, which is shown only to the owners and to the people David gives CSO on Allow permissions, GROW publishes only anonymised statistics internally across members, profiles, mentee details, events, mentoring sign-ups and pairings: every count is rounded to the nearest 5, groups of 1 to 4 are shown as fewer than 5, a split is shown only when both groups are 10 or more, and where hiding a single small group would allow it to be worked out from a total, the next smallest group is hidden too. Figures are shown one dimension at a time and by academic year only, never naming anyone or showing an email address, a date of birth or a free-text answer, and CSV exports carry the same suppressed figures.
Why: so that GROW can see who did what and when, put mistakes right, account for the charity's money, and keep the records it holds about its partners, mentees, mentors and staff accurate and secure.
How long: the record is kept as the charity's audit trail, with no set end date. Nobody on the site can edit or delete a line. (Repeated changes to the same thing by the same person within ten minutes, such as clicks on one capacity cell, are kept as one line showing where it was left.) When GROW erases a mentee's or mentor's sign-up, or a claimant's online claim, at their request, their name is replaced with "a mentee", "a mentor" or "a claimant" on the lines about that sign-up or online claim. Every online claim goes straight onto the event's list of claims as a claim. If that claim is still there when the online claim is erased, the lines about it keep their name, as a financial record, even if it is removed later; if it had already been removed, they show "an attendee" instead.
What else the site keeps about you
- Your account: the email address and name your Google account gives when you sign in (GROW Insights uses Google sign-in and never sees your password), your role on the site, who gave you access, when you last signed in, and the parts of the site you have been given on Allow permissions (who gave each and when).
- Your team profile: your name, title, team, email and anything you write about yourself, which everyone signed in can see, the email included; your email address is also shown to anyone signed in on the records you add or act on (for example "added by", notes, approvals and payments on claims).
- Your work: what you add to the site (invoices, contracts, pairings, events, notes and so on) is kept with your name or email and the time, as part of GROW's records. An engagement email you send a mentee, and a partner opportunity email you send members, are kept with your name too.
- Your availability on the team capacity grid (including leave, any note on it, and who set it and when), which everyone signed in can see; anyone signed in can also set it for you.
- Staff expenses: what you claim, any notes, your receipts, the reason if one is rejected, and the bank details you give to be paid, which only the owners and the people David gives Staff Expenses on Allow permissions can see; they reveal the bank details one claim at a time, and every look is logged. (If you link an expense to an event, everyone with Finance sees how many staff expenses that event has and their total, but whose only with Staff Expenses as well. When your expenses are matched to the bank payment that paid them in Accounting, only people with both Finance and Staff Expenses see the match: to everyone else with Accounting the bank line reads as any other, and the event's bank figure they see leaves it out.)
- Gifts: owners record gifts you receive through your work for GROW (the value, the date, a description and any notes), against GROW's limit of £50 in any 12 months. Only the owners can see the register.
- Accounting: a payment GROW makes to you (expenses, for example) appears on GROW's bank statement as the bank shows it: usually your name, the amount and the date, and for some transfers your account number. Everyone with Accounting (the owners, and whoever David gives Finance on Allow permissions) can see it, and reconciling it puts your name, the amount and the bank's date for it on the Owner Dashboard.
- Your layout choices: settings such as column widths, kept on your account.
Two-step sign-in: your passkeys
After you sign in with Google, GROW Insights and the staff expenses portal ask for a passkey: Face ID, Touch ID, Windows Hello or your phone. The passkey itself is made and kept by your own phone, computer or password manager (Apple's, Google's, Microsoft's or another), under its own terms, and never leaves it.
- What GROW keeps for each passkey: a public key (which can check a sign-in but can never make one) and the technical details a passkey comes with (its identifier and type, a count your device keeps of its uses, and how the device connects, such as USB or Bluetooth), the name you give the device, the date it was added and the day it was last used, with your email address. Nothing biometric: your fingerprint, your face and your PIN stay on your device and are never sent to GROW.
- Recovery codes: the ten codes you are shown once, for when you lose your passkey, are kept only as salted hashes, from which the codes cannot be read back. A code you use is deleted, and making new codes deletes all the old ones.
- What owners see and can do: on Staff Access, whether you have two-step sign-in set up and how many passkeys you have, never the keys or the codes. An owner can reset your two-step sign-in if you lose your passkeys and your codes: your passkeys and codes are deleted, you are signed out, and you set up a new passkey at your next sign-in. An owner's own is reset by another owner. An owner sees the same on Staff Expenses for someone with expenses access alone, and can reset theirs there.
- Emails about your sign-in: whenever a passkey is added to or removed from your sign-in, new recovery codes are made, one of your recovery codes is used, or an owner resets your two-step sign-in, GROW emails you at the address you sign in with to say what happened and when (never which device), so that if it was not you, you can tell an owner straight away.
- How long: until you remove a passkey (you can remove any but your last) or an owner resets them; and once you can no longer sign in to the site or the staff expenses portal, your passkeys and codes are deleted (the site checks for these every day). Copies stay in backups until those expire.
Why GROW uses it
GROW uses this information to run the charity's work and its finances, and to keep them accountable and secure. Its lawful basis is its legitimate interests in doing so, and, for financial records such as expenses and payments, the legal obligation to keep proper accounts.
Cookies and your browser
- Two cookies keep you signed in: one for the site and one for the staff expenses portal. They are needed for the site to work, so the site does not ask first. A sign-in ends after 7 days without use, after 30 days at most, or when you sign out, and signing out of either ends both (and a GROW member account's sign-in on the same browser too, if you have one).
- There are no advertising or analytics cookies, and no tracking scripts. The only outside script is Google's sign-in button, which comes from Google and may use Google's own cookies, under Google's privacy policy.
- Your browser keeps a contract you are drafting until you sign out, and how much of the Partnerships timeline you last chose to show. Neither is kept on GROW's server: the draft is sent to it only to make the Word or PDF file you download.
Who else handles your information
GROW does not sell your information or share it for marketing. These services handle it for GROW, only to run the site:
- Fly.io hosts the site and its database, in London, keeps daily snapshots of the database, and keeps the server's logs.
- Google signs you in, on the site and the staff expenses portal.
- GitHub holds the daily backups, in a private repository. Every backup is encrypted on GROW's server before it leaves, with a key only David holds, offline: no one else can open one, not GitHub, nor anyone with access to the repository, nor anyone who downloads one.
- Resend sends GROW's emails: an email to each owner, and each person given Staff Expenses, who has expense alerts switched on, when a staff expense is submitted, with the name of the person who submitted it, the amount and its reference; an email to you whenever your two-step sign-in changes, saying what happened and when; the email to the team member who sent a mentee the engagement email (and anyone else set to be told) when the mentee answers it, with their answer and note; the confirmation email to a mentor who signs up through a partner firm's own sign-up form, with their name and reference, saying GROW has their details; and the emails mentees are sent, which their own notice describes.
- Lunch Flow, once connected, brings GROW's own bank lines into Accounting.
How long things are kept
- The record of your use (GROW's audit trail, read on the Owner Dashboard): with no set end date, as above.
- Your passkeys and recovery codes: until you remove them or an owner resets them, and deleted once you can no longer sign in anywhere, as above.
- Your team profile: kept after you leave (archived with its details, so you can be added back); your name and email stay on the records you worked on and on the Owner Dashboard. Your Staff Access entry is deleted when you are removed from it.
- What you were given on Allow permissions: deleted when your email is changed or moved to another person, or when it can no longer sign in; each change stays a line of the record.
- Bank details on a staff expense: deleted as soon as you are paid, and straight away if the expense is rejected or an owner removes them; otherwise six months after you submitted it if it is never dealt with. Receipts on a rejected expense are deleted 30 days after it is rejected. The site checks for these every day; copies stay in backups until those expire.
- Events: your dietary and access needs on an event's guest list, and the answers people give on an event's sign-up form to questions ticked Diversity question or Sensitive in the form builder, to questions about dietary or access needs (known by their wording, unless set to be used for nothing), and in a box for the details of one of those answers straight after it, are removed 30 days after the event. For an event with no date, that is 30 days after its form closed (its closing day, the day it was closed or imported, or the day the event was archived); a form still open keeps them until it closes, and the guests of an undated event with no form keep theirs until it is archived. Only the totals are kept, shown rounded to the nearest 5 with groups of fewer than 5 hidden, so they cannot be traced to anyone. The site checks for this every day; copies stay in backups until those expire.
- Financial records (invoices, expense claims and their receipts, payments and bank lines): kept with no set end date, and at least as long as charities must keep them.
- Backups: daily copies on GitHub for the last 30 days, and each Sunday's copy for up to six months; Fly.io's daily snapshots for 5 days (unless that is extended); and a full backup an owner downloads, for as long as they keep it. The daily copies and every full backup are encrypted, and only David can open them.
Your rights
You can ask GROW for a copy of the information it holds about you, to correct it, to delete it (where GROW does not need to keep it, for example as a financial record), to limit how it is used, or to stop using it. Email david.growmentoring@gmail.com; GROW will answer within a month.
If you are unhappy with how GROW has handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we would be grateful for the chance to put it right first.
Changes to this notice
When GROW changes what the site keeps or how it is used, this page changes with it, and the date at the top says when.
Using one of GROW's public forms (a travel claim, event check-in, an event sign-up or a mentoring sign-up)? Each form says how GROW uses what you enter. A GROW member account has its own notice, at /portal/privacy.