Trust, security & privacy

The CRM is a private application for TechStart CIC staff and board members. Access requires an account; sign-up is not open to the public. Sessions are protected by email/password authentication with optional Google sign-in for invited accounts.

Permissions follow defined roles (admin, staff, board). Admins manage invites, role changes and account deactivations from the in-app Settings area, and those actions are recorded in an audit log.

The CRM stores operational records that TechStart CIC needs to deliver its programmes: contacts, organisations, young people, employers, funders, grants, donations, programmes, cohorts, events, tasks, notes and related activity history.

Records are only entered or imported by authorised TechStart CIC staff. We do not collect data from members of the public through this application.

Database access is restricted by row-level security policies that limit reads and writes to authenticated users acting through the application. Administrative operations (inviting users, changing roles, deactivating accounts) are restricted to admin role holders and verified server-side.

Data is transmitted over HTTPS. Application secrets are kept on the server and are not exposed to the browser.

TechStart CIC processes personal data in line with the UK GDPR and the Data Protection Act 2018. Personal data held in the CRM is used to run TechStart CIC's programmes and to keep records of our work with young people, employers, funders and partners.

If you are a data subject and want to exercise your rights — access, correction, deletion, or objection — contact TechStart CIC using the details below.

The application is hosted on the Lovable platform, which provides hosting, database and authentication services for the CRM. Additional subprocessors may be used by TechStart CIC for email and operational purposes; contact us for the current list.

For security, privacy or data protection questions about this application, contact TechStart CIC via careersupport.org.uk.