Your members’ data, and how we look after it

Where is our data kept?

In London. The database is Supabase, hosted in the United Kingdom, and the site runs on Vercel, also in London. Email goes through Resend, in Ireland. Nothing about your members is stored outside the UK and Ireland, and there is no transfer to the United States in the ordinary running of the service. The one exception is a choice of yours: if you connect scorecards, the answers people give them are kept by InsightSquirrel, our sister product, in the EU. The full list of who processes what, and where, is in the privacy policy.

Who owns it?

You do. For your members’ data you are the data controller and we are your processor, which is what the data processing terms set out. We do not sell it, we do not share it with anybody else, and we do not use it to train anything.

Can another organisation see our members?

No, and not by accident either. Every table in the database carries the organisation it belongs to, and the database itself refuses to return a row from a different organisation, whatever the application asks for. The connection the site runs on cannot turn that off. Every table of yours is covered by a test that tries to read it as another organisation and proves it cannot.

Who inside our organisation can see what?

Owners and admins see everything. A region manager sees their region, and a group manager sees their group, and neither sees the rest. Members see each other in the directory, and only what each person has chosen to show: contact details are never handed over by the directory, only through an introduction both people have agreed to.

Do you take our members’ money?

Never. We do not collect membership fees, we do not take a percentage, and there is no payment processing between you and your members anywhere in the product. Your members pay you the way they already do, and an organiser records the payment. The only payment we handle is your own licence. That is a deliberate line, not an oversight.

What about the AI assistant?

Barry helps you set things up and answers questions about using NetworkingBadger. He is never given anybody’s name, email address or phone number, he cannot see your members, and he cannot change anything in your account. He can put you in touch with us, if you ask him to.

What happens to guests’ details?

A visitor says what you may do with their details when they register, and every email checks that choice before it is sent. If somebody says they do not want membership information, they do not get any, whatever an organiser clicks. A member can also ask for their own words in the group chat to be erased.

Can we get our data out?

At any time, from the Billing page, as CSV files you can open in a spreadsheet. Export is available in every state, including after a failed payment and after you cancel. We never hold your data back to make you stay.

What happens if we leave?

Your organisation data is kept for 90 days after you cancel, so you can come back or export something you forgot, and then it is deleted permanently. Individual people can ask to be deleted sooner, and there is a page about deleting an account.

How do you keep accounts safe?

Sign in is by password or by a link sent to your own email address, and Apple and Google sign in are offered too. Passwords are stored only as a hash. A reset link works once and expires in an hour, and using it signs you out everywhere else. Repeated attempts at a password, or at flooding somebody’s inbox, are counted and stopped. The whole site is served over HTTPS with a strict content security policy.

Is it GDPR compliant?

We are a UK company and the product is built for UK data protection law: a lawful basis for every email, consent recorded and checked at the point of sending, data kept in the UK, deletion on request, export on demand, and a processing agreement you do not have to ask for. We are not solicitors and we do not give legal advice on your own obligations, but everything on this page is written down properly in the privacy policy and the processing terms.

Who do we ask if something worries us?

Write to us. A person answers, and if it is a security concern we would rather hear it early and be wrong than late and be right.