Privacy Policy | The Trans Inclusion Toolkit

Last reviewed: 30 September 2026

1. Who We Are

This website — The Trans Inclusion Toolkit (https://thetransinclusiontoolkit.co.uk) — is operated by SEE Change Happen Ltd, a company registered in England and Wales.

Company Registration: 13138905
Registered Address: 1 The Briars, Waterberry Drive, Waterlooville, PO7 7YH
Contact Email: [email protected]

SEE Change Happen Ltd is the data controller for personal data collected through this site. This means we decide how and why your personal data is processed.

2. What Data We Collect

We collect personal data in the following ways:

Data you provide directly

When you submit a form on this site (such as the contact form or email signup), we collect the information you enter. This may include your first name, last name, email address, job role, organisation name, areas of interest, and any message you choose to write. Form submissions are sent server-side to HubSpot, our customer relationship management platform, only when you explicitly submit the form.

Trans Inclusion Impact Diagnostic

When you take the Trans Inclusion Impact Diagnostic — our free online self-assessment, available at app.thetransinclusiontoolkit.co.uk — we collect the following data:

Registration details — your first name, last name, and email address (provided when you start the diagnostic)
Diagnostic responses — your answers to the diagnostic questions about your organisation's trans inclusion readiness. These are organisational self-assessments, not personal data about your gender identity, beliefs, or protected characteristics
Calculated scores — your overall score, your scores across the five governance domains, and your maturity tier assignment, generated automatically from your responses

This data is processed on our platform to generate your diagnostic results, which are available in your account immediately on completion — we do not email the report to you. Your responses, scores, and results are stored in our platform database (Supabase), which is hosted in the United Kingdom.

Important: The diagnostic assesses your organisation's governance readiness. It does not ask about your personal gender identity, sexual orientation, religion, or any other special category data as defined under UK GDPR Article 9.

Quinn AI Inclusion Assistant

When you use Quinn — our AI-powered inclusion assistant, available at app.thetransinclusiontoolkit.co.uk — we collect the following data:

Conversation messages — the questions you type and the responses Quinn generates. Your messages are sent to OpenAI (via their API) to generate responses. OpenAI processes this data under their API data usage policy, which states that API inputs and outputs are not used to train their models
Quality review — if you rate an answer with the thumbs up/down buttons, we keep a record of that exchange so we can check answer quality. Exchanges you don't rate are not recorded at all. That record holds the full text of your question and Quinn's answer only if you are taking part in the pilot or hold a superuser account; for everyone else it holds non-identifying metadata only — the topic tags your question matched, the message lengths and your rating — not the text you typed. Taking part in the pilot is a flag on your account, not an access level: a trial code on its own does not put you in it. To answer repeated questions quickly, Quinn's answers are held in a short-term cache for up to an hour
Knowledge base queries — your questions are converted into mathematical representations (embeddings) and matched against our knowledge base stored in Pinecone, a vector database service. No personal data is stored in Pinecone — only your query embedding is sent temporarily to find relevant content
Feedback — we store your rating. If you choose to add a comment ("tell us more"), we store what you write
Saved chats — once you are signed in, your Quinn conversations are saved to your account so you can come back to them later, on any device. This is separate from the quality-review record above: saved chats are yours to re-read, and they hold the text of the conversation whatever your access level. Before you sign in, nothing is saved; in demo mode a chat lasts only until you close the tab. Saved chats stay until you delete them (you can rename or delete any chat from your chat list) or until your account is deleted. Starting a new chat doesn't delete earlier ones

Important: Quinn provides general educational guidance — not legal, HR, or professional advice. Responses are AI-generated and may contain errors or inaccuracies. Please do not share personal information about identifiable individuals or confidential organisational data in your conversations with Quinn.

Subscriptions and payments (Stripe)

When you purchase a paid subscription to The Trans Inclusion Toolkit, your payment is processed by Stripe, a PCI DSS Level 1 certified payment processor. We collect and process the following data in connection with your subscription:

Payment information — your card details are entered directly on Stripe's hosted checkout page. We do not see, store, or have access to your full card number or payment credentials. Stripe provides us with a limited reference (last four digits, card brand, and expiry month) for identification and support purposes only
Billing details — your name, email address, and billing address as provided at checkout. These are stored by Stripe and shared with us to manage your subscription
Subscription metadata — your access level, billing cycle (monthly/annual), start date, renewal date, and payment status. This data is stored in our platform database (Supabase Postgres), where it is used server-side to decide your access level and therefore which features you can use on the platform
Stripe Customer ID — a unique identifier assigned by Stripe, stored in our platform database to link your subscription to your account
Invoice and transaction history — records of payments, refunds, and billing events are maintained by Stripe and accessible to you through the Stripe billing portal, which you open from the Account area of the app

Your payment data is processed by Stripe in accordance with their Privacy Policy and is protected by PCI DSS Level 1 security standards — the highest level of certification in the payment industry.

Analytics and tracking

We do not run Google Analytics, social-media pixels, or third-party advertising networks on this site.

We measure visits with Cloudflare Web Analytics, provided by our hosting provider, Cloudflare. It records the page you visited, the site that referred you, and broad device and country information. It sets no cookies, does not use your IP address to identify you, and does not follow you across other sites. We use it only in aggregate, to see which pages are useful and where visitors arrive from.

This site also loads a tracking script from HubSpot, our CRM platform, to help us understand site usage and support marketing communications. HubSpot's analytics cookies are non-essential and are gated behind this site's own first-party cookie banner, which appears on your first visit: those cookies are only set if you accept the banner; if you decline, no HubSpot analytics cookies are set at all. You can change your choice at any time using the "Manage cookies" link in the site footer, which reopens the banner.

Where this site includes a contact or enquiry form, the information you enter is sent server-side to our CRM (HubSpot) only when you explicitly submit the form, regardless of your cookie consent choice.

Guided Pathway Data

When you use the guided pathway, we collect and store the following data to provide the service:

Organisation profile — organisation name, type, sector, size, and your role. Retained for as long as your account exists.
Pathway progress — which steps you have completed, your selections, and AI-generated analysis results. Retained for as long as your account exists.
DocuVault™ documents — policy files you upload for analysis. You can delete these at any time from within the app, and they are removed when you delete your account.
Health check scores — AI-generated quality scores for uploaded policies. Stored alongside the policy files.
Usage telemetry — which tools you use, how often, and at what access level. Used to enforce fair usage limits, to improve the service, and to shape the coaching emails you receive during a pilot, trial or subscription — for example, whether the step we suggested yesterday has been opened, so an email never assumes you have done something you haven’t. No content of your policies or analysis is stored in telemetry, and none is used in these emails.
Feedback and reports — any bug reports, feedback, or snagging tickets you submit, including screenshots if provided.

Data Retention

Your guided pathway data — organisation profile, pathway progress, vault documents, health check scores, and diagnostic results — is retained for as long as your account exists.

There is a single inactivity timer, and it applies only to free accounts. It is keyed to your last sign-in, so signing in resets it. While you hold a paid subscription the timer does not run. If your subscription ends, your account returns to the free access level and the free-account timer applies from that point.

On a free account, if you have not signed in, we send reminders to the email address on your account.

These are reminders only. We do not operate an automatic deletion process: your pathway data, vault policies, and diagnostic results are not erased on a timer.

Deletion is separate, and it happens on request. You can delete your account at any time using the Delete account control in your account settings in the app, or by contacting us. Deletion takes effect immediately, except for abusive or threatening messages (see Abusive or threatening messages under Data Retention below) and anonymised support correspondence records (see Support correspondence below), each kept for the periods described there.

Subscription data (payment history, invoices) is retained by Stripe in accordance with their data retention policy and UK financial record-keeping requirements.

AI Processing

Several tools in the guided pathway use artificial intelligence to analyse your policies and generate guidance, using AI models provided by OpenAI, our AI sub-processor. We do not name specific models, because they are replaced over time. When you use these tools:

The text of your uploaded policies is sent to OpenAI's API for analysis.
OpenAI does not use your data for training. We use their API under a data processing agreement that prohibits training on customer content.
AI-generated outputs are decision-support guidance, not legal advice.
We do not store the raw AI API responses beyond the structured results saved in your pathway state.

3. How We Use Your Data

We use the personal data we collect to:

Respond to your enquiries — when you submit a contact form, we use your details to get back to you
Send requested research materials — if you sign up for our email list, we send you the Beyond Compliance research findings and related resources
Improve our website — our cookieless visit measurement (Cloudflare Web Analytics) helps us understand which content is most useful and how visitors navigate the site
Send marketing communications — only with your explicit consent, we may send you updates about our research, services, and events. You can unsubscribe at any time
Deliver your diagnostic results — when you complete the Trans Inclusion Impact Diagnostic, we use your responses to generate a personalised report and calculate your scores across the five governance domains. Your results are available in your account as soon as you finish
Benchmark and improve the diagnostic — we use aggregated, anonymised diagnostic data to improve the quality and relevance of the assessment. Individual responses are never published or shared in identifiable form
Provide the Quinn AI assistant — when you ask Quinn a question, we process your message through OpenAI and Pinecone to generate a relevant, context-aware response grounded in the Toolkit knowledge base
Improve Quinn's responses — we use feedback ratings (thumbs up/down) to assess the quality and accuracy of Quinn's responses and identify areas for improvement. Individual conversations are reviewed only where they have been stored under the conversation logging rules described above, or where you have flagged them through the feedback system
Process your subscription — when you purchase a paid subscription, we use your billing and subscription data to manage your access level, process payments via Stripe, send renewal reminders, and provide subscription management through the Stripe billing portal, opened from the Account area of the app
Ensure site security — we monitor for security threats and maintain the integrity of the site

4. Legal Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing your personal data. We rely on the following bases:

Consent — when you subscribe to our email communications or answer our feedback questionnaire, you give explicit consent for us to process the data you provide, and nothing is stored until you tick the box. The short daily check-in is the one exception, and it is covered by the next bullet. You may withdraw consent at any time by contacting us or using the unsubscribe link in our emails
Legitimate interests — we use our cookieless visit measurement to improve our site and services. When you send a contact or enquiry form, we use the details you give (held in our CRM, HubSpot) to reply to you and follow up on what you asked. We also store the short daily check-in answers that pilot, trial and subscription users send us from our coaching emails, so that we can improve the service they are already using. There is no consent box on that check-in, and we never publish or quote what you write there. We have assessed that this processing is proportionate and does not override your rights. To have a check-in answer corrected or deleted, email [email protected] and quote the Support ID shown in your account — that is what lets us find your answers, because the check-in does not ask for your name
Contractual necessity — where you have purchased a subscription or requested a service from us (such as a paid subscription, diagnostic session, or executive briefing), we process your data as necessary to deliver that service, manage billing, and maintain your access

5. Cookies

Cookies are small text files placed on your device when you visit a website. This site does not set any analytics or advertising cookies unless you accept them via the cookie banner described below. The following cookies are used:

Functional and security cookies (always set)

__cf_bm — Cloudflare bot management, used to protect the site from automated abuse (expires after 30 minutes).
cf_clearance — Cloudflare security, set only if your browser is asked to pass a security check, so you are not asked again straight away (expires after a short period, 30 minutes by default).
Turnstile verification cookie — set only when you submit a form, to confirm you are not a bot (short expiry).

Analytics cookies (only if you accept)

This site shows a first-party cookie banner on your first visit. If you accept, HubSpot sets the following cookies to help us understand site usage:

hubspotutk — visitor identification for analytics, up to 13 months
__hstc — main HubSpot analytics cookie, up to 13 months
__hssc — session tracking, 30 minutes
__hssrc — session cookie, deleted when you close your browser

If you decline, none of these cookies are set and no HubSpot analytics tracking takes place. Your accept/decline choice itself is stored in your browser's local storage, not a cookie. You can change your choice at any time using the "Manage cookies" link in the site footer, which reopens the banner.

Preferences

Your light/dark theme preference is stored in your browser's local storage, not a cookie, and never leaves your device.

Account and platform sign-in

Signing in to your account at app.thetransinclusiontoolkit.co.uk is passwordless: we email you a one-time code, and once you have entered it your session token is stored in your browser's local storage, not in a cookie. The platform does not set an authentication cookie. That session data is covered by this Privacy Policy but operates on the app subdomain, not on this marketing site.

Managing cookies

You can control cookies through your browser settings at any time. To change your analytics consent choice, use the "Manage cookies" link in the site footer to reopen the cookie banner and select accept or decline. Declining removes the HubSpot analytics cookies described above; the strictly necessary security cookies remain, as the site cannot function safely without them.

6. Third-Party Services

We use the following third-party services that may process your data:

Stripe — payment processing for paid subscriptions. Stripe handles all card data and billing in accordance with PCI DSS Level 1 standards. Stripe Privacy Policy
HubSpot — CRM, form processing, and email communications. Contact records are created server-side only when you submit a form. HubSpot Privacy Policy
Cloudflare — hosting, content delivery, cookieless visit measurement (Web Analytics), and security, including bot management and spam protection (Turnstile) on forms here and on the app's sign-in and human-verification checks. Cloudflare Privacy Policy · Cloudflare Turnstile Privacy Addendum
Supabase — the platform's database, authentication, file storage, and server-side functions for the app at app.thetransinclusiontoolkit.co.uk. Your account, diagnostic, and pathway data is held here, in the United Kingdom (London). Supabase Privacy Policy
Resend — transactional and support email, including one-time sign-in codes, account notifications, and reminder emails. Resend Privacy Policy
OpenAI — powers the Quinn AI inclusion assistant. Your chat messages are sent to OpenAI's API to generate responses. OpenAI does not use API data to train its models. OpenAI is also used to sort and prioritise messages sent to our support team, and to suggest answers from our approved help articles. A person reviews every reply that is not an approved help answer. OpenAI Enterprise Privacy
Pinecone — vector database service used by Quinn to search the Toolkit knowledge base. Only mathematical representations of your query are sent; no personal data is stored. Pinecone Privacy Policy
Amazon Web Services (AWS) — delivering website video (Amazon CloudFront) and storing encrypted off-site backups of the platform database (Amazon S3, London). AWS Privacy Notice
GitHub — running the automated job that encrypts and transfers platform database backups. GitHub Privacy Statement

Each of these services operates under its own privacy policy. We have data processing agreements in place where required.

We do not sell your personal data to third parties. We share personal data only in the following circumstances:

With data processors — we share data with Supabase, Stripe, HubSpot, Cloudflare, OpenAI, Pinecone, Resend, Amazon Web Services, and GitHub as necessary to provide the services described above. These processors act on our instructions under appropriate data processing agreements
Where required by law — we may disclose personal data if required to do so by law, regulation, or court order
To protect our rights — we may disclose data to enforce our terms of use or to protect the rights, property, or safety of SEE Change Happen Ltd, our users, or the public

8. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

Encryption in transit — the site uses HTTPS (TLS) encryption for all connections
Secure data processing — form data is processed and stored by HubSpot, which maintains SOC 2 Type II certification
AI service security — Quinn chat messages are transmitted to OpenAI and Pinecone via encrypted API connections. OpenAI does not use API data to train its models
Access controls — access to personal data is restricted to authorised personnel on a need-to-know basis
Payment security — subscription payments are processed by Stripe, which is PCI DSS Level 1 certified. Card data is entered directly on Stripe's secure hosted checkout page and never passes through our servers
Platform data storage — your account, diagnostic, and pathway data is held in our Supabase database in the United Kingdom, protected by database-level access policies that restrict each account to its own records
Managed secrets — the API keys and service credentials the platform uses are held as platform-managed encrypted secrets by our hosting and backend providers. They are available only to server-side code and are never exposed to your browser
Regular review — we periodically review our security practices and update them as necessary

While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

Form submissions — contact form and enquiry data is retained in our HubSpot CRM for the duration of the business relationship plus 2 years
Email subscriber data — retained until the subscriber opts out or requests deletion
Diagnostic data — your diagnostic responses, scores, and results are retained for as long as necessary to deliver the service and for benchmarking purposes. You may request deletion at any time
Analytics data — Cloudflare Web Analytics holds aggregated visit records (page, referring site, broad device and country) that are not linked to your identity, under Cloudflare's own retention limits
Account data — retained for as long as your account exists. On a free account, if you have not signed in we send reminder emails. We do not delete accounts automatically; deletion happens when you ask for it, and takes effect immediately (see Data Retention under Guided Pathway Data)
Subscription and billing data — your subscription metadata (access level, billing cycle, start/end dates) is retained in our platform database for the duration of your subscription plus 2 years for accounting and tax purposes. Stripe retains payment and invoice records in accordance with their own retention policies and applicable financial regulations. If your subscription ends, your saved assessments and tool outputs stay in your account, which returns to the free access level
Quinn conversations — chat messages are processed in real time by OpenAI. Whether the text of a rated exchange is kept for quality review depends on whether you are in the pilot or a superuser, as described under Quinn AI Inclusion Assistant above; saved chats hold your conversation text once you are signed in. Feedback ratings and comments are retained for quality improvement purposes. Saved chats stay in your account until you delete them or your account is deleted
Abusive or threatening messages — if a message sent to us is abusive, hateful or threatening, we keep the original, unaltered, as evidence, separately from ordinary support records. Only our support team can open it, and every time it is opened is recorded. We keep it for at least six years from the date we received it, and longer if it is needed for a legal claim or a report to the police. We keep it because we may need it to protect our staff or to establish, exercise or defend legal claims, and for the same reason we may decline a request to delete it where the law allows. We never reply to these messages
Support correspondence — if you contact support, we keep a record of the conversation after your account is deleted, with your name and email address removed, so we can show what was asked and how we answered. We delete these records two years after the ticket closes

You may request deletion of your personal data at any time by contacting [email protected], except where the law allows us to keep it, as described under abusive or threatening messages above, and except for the anonymised support correspondence record described above, which we keep for two years after the ticket closes.

10. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

Right of access (Article 15) — you may request a copy of the personal data we hold about you. We will provide this within 30 days of your request
Right to rectification (Article 16) — if the data we hold about you is inaccurate or incomplete, you may request that we correct it
Right to erasure (Article 17) — you may request that we delete your personal data. This is sometimes known as the "right to be forgotten". We will comply unless we have a legal obligation to retain the data
Right to restriction of processing (Article 18) — you may request that we limit how we process your data while a concern is being resolved
Right to data portability (Article 20) — you may request your data in a structured, commonly used, machine-readable format so that you can transfer it to another service
Right to object (Article 21) — you may object to processing based on legitimate interests or direct marketing. We will stop processing unless we can demonstrate compelling legitimate grounds
Rights related to automated decision-making (Article 22) — we do not use automated decision-making or profiling that produces legal or similarly significant effects. Quinn's AI responses are informational only and do not produce decisions with legal effects
Right to withdraw consent — where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal

To exercise any of these rights, please contact [email protected]. We will respond within 30 days of receiving your request. If we need more time (up to a further 60 days for complex requests), we will inform you and explain why.

11. International Data Transfers

Supabase provides the platform's database, authentication, file storage, and server-side functions. Our Supabase project is hosted in the United Kingdom (London), so the account, diagnostic, and pathway data held there stays in the UK and does not involve a restricted international transfer.

HubSpot, our CRM and marketing platform, processes some data in the United States. HubSpot maintains appropriate safeguards for international data transfers, including Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Agreement. For details, please refer to HubSpot's Data Processing Agreement.

Stripe processes payment data in the United States and other jurisdictions. Stripe maintains appropriate safeguards for international data transfers, including Standard Contractual Clauses and certification under the EU-US Data Privacy Framework. See Stripe's Privacy Policy for details.

Cloudflare provides hosting, content delivery, and security for this site across its global edge network. Where this involves processing personal data outside the United Kingdom, it takes place under Cloudflare's Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses and the UK Addendum (International Data Transfer Agreement). See Cloudflare's Privacy Policy for details.

OpenAI processes Quinn chat data in the United States, under OpenAI's Data Processing Addendum, which incorporates the Standard Contractual Clauses and the UK Addendum. Pinecone also processes data in the United States, under Pinecone's Data Processing Addendum, which incorporates the Standard Contractual Clauses and the UK Addendum.

Resend, which sends our transactional and support email, processes it in Ireland (European Union). The UK treats the European Economic Area as adequate, so this is not a restricted transfer. See Resend's Privacy Policy for details.

Amazon Web Services (AWS) delivers website video through Amazon CloudFront's global network and stores our encrypted off-site database backups in Amazon S3, in London, United Kingdom (eu-west-2). The backup data therefore stays in the UK and does not involve a restricted transfer. Where video is delivered through CloudFront's global network, this takes place under AWS's Data Processing Addendum, which incorporates the Standard Contractual Clauses and the UK Addendum (International Data Transfer Agreement). See AWS's GDPR Data Processing Addendum for details.

GitHub runs the automated job that encrypts and transfers our platform database backups, and processes data in the United States. GitHub maintains appropriate safeguards for international data transfers, including Standard Contractual Clauses and the UK International Data Transfer Agreement. See GitHub's Data Protection Agreement for details.

12. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with a revised "Last reviewed" date. Where changes are material, we may also notify email subscribers directly. We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this privacy policy or how we handle your data, please contact us:

Email: [email protected]
Post: SEE Change Happen Ltd, 1 The Briars, Waterberry Drive, Waterlooville, PO7 7YH

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: https://ico.org.uk
Telephone: 0303 123 1113