VorlanaProve your outcomes to funders. Skip the admin.
Vorlana captures the work you already do — people, events, volunteers, feedback, and everything you reuse, repair and grow — and turns it into funder-ready reports, forms and bids. So your time goes to people, not paperwork.
Your funders want evidence of outcomes. Getting it out of spreadsheets, sign-in sheets, Google Forms and email threads eats the weekend that should have been yours.
One place for the work — and the proof it happened.
People & caseload
Referrals, stages, barriers and outcomes for each participant — with safeguarding flags, case notes and a pipeline showing who needs chasing today.
Events & feedback
Print one code per session. People scan to leave feedback, volunteers check in and out. Your own survey questions, kept word for word — no app, no login.
Volunteers & hours
Log sessions against people and events, then show the total contribution — and its value at the Living Wage. The line that makes a board sit up.
Funder reporting
Pick a funder and a period. Every figure is calculated from your records — the writing is drafted around them, with the gaps in your data stated plainly, not papered over.
Forms & paperwork
Start and end forms generated as Word documents. Upload a funder's own blank form and it comes back completed from the participant's record — ready for your check.
Finding funding
Search live opportunities that fit your work, then draft the expression of interest — answering the funder's actual questions, within their word limits, from your real outcomes.
Reuse, repair & growing
Take a photo and Vorlana names the item or crop and reads the scales. Tap where it went. Kilos diverted, meals shared, repair fix rate and CO₂e add up on their own.
Chain of custody
Donated laptops, furniture or bikes get a QR passport. Each step — collected, wiped, tested, rehomed — is recorded with who and when, in a history that can't be quietly changed.
Works on any phone
Add Vorlana to your home screen and it opens like an app. Log by photo, type a sentence or say it out loud — "12 kilos of tomatoes to the food bank" — and check before it saves.
Three steps from a session to a report you can send.
Capture
A QR code at the session, a few taps on a phone, or bring in the years you already have in spreadsheets and Google Forms.
Prove
Attendance, hours, outcomes and feedback add themselves up — so you always know where every funder stands, without asking anyone.
Report
Generate the report, the funder's form, or the next bid. Drafted from real figures, ready for you to check and send.
The rest of the week, handled.
One product, three sizes. Priced against the paperwork it replaces.
Community
- Up to 2 funder contracts
- Up to 3 staff logins
- Email support
Standard
- Unlimited programmes and funders
- Up to 10 staff logins
- Onboarding call and priority support
Provider
- Unlimited staff
- Contract and funder reporting set up for you
- Help with chain of custody and partner referrals
- Named support and help moving your data
We set every organisation up personally. Ask for a 14-day trial and we will have you running within a day. Pay yearly and get two months free (paying monthly costs 20% more). Prices are per organisation. Consortia, councils and multi-site networks: Partnership from £8,000 a year, with an account for each site, get a quote. Combined reporting across sites is being built with our first partners. AI features have a generous daily fair-use limit. Data is hosted in the EU/EEA.
Whoever your funder is, Vorlana reports to them.
From central government to a single community trust — bring your own funders and their formats. These are just a few we're already shaped for:
Your data stays yours. Hosted in the EU/EEA, aligned to UK GDPR, with role-based access so staff only see what they need. Equality data is voluntary and reported only in aggregate.
Spend your week on people, not paperwork.
See how Vorlana turns the work you already do into funder-ready proof — book a 20-minute demo with your own data in mind.
Policies
How Vorlana handles data, and the terms you use it on. Tap a policy to open it.
Privacy policy
Vorlana is run by Winters Ventures Ltd. When a charity or community organisation uses Vorlana to record its participants, volunteers and feedback, that organisation is in charge of that information and we look after it on their behalf. For our own website, customer accounts and enquiries, we are in charge. We never sell personal data and never use it for advertising.
1. Who we are
Vorlana is a trading name of Winters Ventures Ltd, a company registered in England and Wales (company no. 15188761), registered office 76 Livermore Green, Peterborough, Cambridgeshire, PE4 5DQ.
For anything about this policy or your personal data, email hello@vorlana.com.
2. Two different roles
When we are the controller
We decide how and why personal data is used for: visitors to vorlana.com; people who ask for a demo or contact us; the people who hold accounts on Vorlana (for example staff at a customer organisation); and our own business records such as invoices.
When we are the processor
Our customers use Vorlana to record information about the people they work with — participants, volunteers, event attendees, donors, partners and others. We call this Customer Data. The customer organisation is the controller of Customer Data and decides what is collected and why. We process it only on their instructions, under our Data processing agreement.
If you are a participant, volunteer or attendee of an organisation that uses Vorlana and you have a question about your information — including a request to see, correct or delete it — please contact that organisation directly. If you contact us, we will pass your request to them.
3. What we collect when we are the controller
| Who | What | Why | Lawful basis |
|---|---|---|---|
| Demo requests and enquiries | Name, email, organisation, role, and anything you tell us in your message | To reply, arrange a demo and follow up about Vorlana | Legitimate interests — responding to people who contact us |
| Account users | Name, email, organisation, role, sign-in details, and a record of activity needed to keep the service secure | To provide the service, keep accounts secure, and give support | Contract with the customer organisation; legitimate interests in security |
| Customers' billing contacts | Name, email, organisation, invoices and payment records | To bill and keep accounting records | Contract; legal obligation (tax and accounting) |
| Website visitors | Technical information your browser sends, such as IP address and browser type, held briefly in server logs | To run the website securely and fix problems | Legitimate interests |
We do not use advertising or analytics cookies, and we do not track you across other websites. See our Cookie policy.
4. Customer Data
Customer Data can include names and contact details, attendance, volunteer hours, feedback, outcomes, notes, and — where a customer chooses to collect it — equality information such as age, ethnicity, gender, disability, religion or sexual orientation. Some of this is special category data under UK GDPR. Each customer is responsible for having a lawful basis, and where needed a condition under Article 9, for what it records.
Vorlana is designed to help customers collect less: feedback can be anonymous; equality questions are optional and default to “Prefer not to say”; postcodes on public forms are limited to the first half (for example PE2); and demographic answers from feedback forms are stored without a name or email attached.
We do not use Customer Data for our own purposes, do not sell it, and do not use it to train AI models.
5. AI features
Some features use AI provided by Anthropic to draft text such as reports and summaries. When you use one, we send Anthropic the information needed to produce that text — mainly figures Vorlana has already calculated and short excerpts such as feedback comments — and not whole records where it can be avoided. Under Anthropic's commercial terms, content sent through its API is not used to train its models by default. AI-generated text can contain mistakes, so customers should review it before sharing it.
If staff take a photo to log an item, the photo is sent to Anthropic to identify the item and read any scale display or label. Vorlana does not store the photo — only the details the user confirms, such as the item type, weight or serial number.
6. Who we share data with
We use a small number of trusted providers to run Vorlana. They only process data on our instructions. The current list, with locations, is on our Sub-processors page. We may also share information if the law requires it, or to protect the rights, safety or property of our customers, the public or ourselves.
7. International transfers
Some of our providers are based in, or may access data from, the United States. Where personal data leaves the UK, we rely on adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the provider's security measures.
8. How long we keep it
- Enquiries and demo requests — up to 2 years after our last contact, unless you become a customer.
- Account users — while the customer's account is active, then deleted as below.
- Billing records — 6 years after the end of the financial year they relate to, as required by UK law.
- Server logs — kept by our hosting providers for short periods, typically days to weeks.
- Customer Data — until the customer deletes it or closes their account. After closure we delete it within 90 days, having given the customer the chance to export it. Copies in backups are overwritten as backups expire, within 30 days after that.
9. How we protect it
Data is encrypted in transit and at rest, each organisation's data is kept separate at database level, and access by our own team is limited to what is needed to run and support the service. Details are on our Security & backups page.
10. Your rights
Under UK data protection law you have the right to: be told how your data is used; get a copy of it; have it corrected; have it deleted; restrict or object to how it is used; and, in some cases, move it to another provider. Where we rely on consent, you can withdraw it at any time.
To use these rights, email hello@vorlana.com. We will reply within one month. If your request is about Customer Data, we will pass it to the organisation responsible and help them respond.
11. Complaints
Please tell us first and we will try to put it right. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.
12. Changes
We will update this page when things change and show the date at the top. If a change significantly affects how we use your data, we will tell account holders by email.
Terms of service
These terms are the agreement between your organisation and Winters Ventures Ltd for using Vorlana. Your data stays yours. We keep it safe, only use it to provide the service, and let you export it whenever you want. AI-drafted reports are a starting point — please check them before you send them to anyone.
1. About these terms
These terms apply between Winters Ventures Ltd (“we”, “us”), trading as Vorlana, and the organisation that signs up for Vorlana (“you”, “the Customer”). By creating an account or using Vorlana you confirm that you have authority to accept these terms on behalf of your organisation. Vorlana is a business service and is not intended for use by consumers.
These terms include our Data processing agreement and Acceptable use policy. If you have signed a separate order form or agreement with us, that document takes priority where it differs.
2. The service
Vorlana is online software that helps organisations record participants, volunteers, events and feedback, and turn them into outcome evidence and reports. We may improve and change features over time. We will not remove a core feature you rely on without giving you reasonable notice.
3. Accounts
- You are responsible for who you invite to your account and what access they have.
- Keep sign-in details secure and tell us straight away at hello@vorlana.com if you think an account has been compromised.
- You are responsible for everything done through your account, except where it results from our own failure.
4. Fees and payment
Fees are as shown on your plan or order form. Unless agreed otherwise, fees are billed in advance, are payable within 30 days of invoice, and exclude VAT where it applies. If an invoice is more than 30 days overdue we may, after giving you at least 14 days' written notice, suspend access until it is paid. We will give at least 30 days' notice of any price change, which will apply from your next billing period.
Free trials and pilots run for the period we agree. At the end, you can choose a paid plan or we will close the account as described in section 11.
5. Your data
You own all the data you and your users put into Vorlana (“Customer Data”). You give us permission to host, copy and process it only to provide, secure and support the service for you, as set out in the Data processing agreement. We do not sell Customer Data, use it for advertising, or use it to train AI models.
You are responsible for the lawfulness of the data you collect, including having a lawful basis and, for special category data such as health or ethnicity, an appropriate condition — and for telling the people you work with how their information is used.
You can export your data at any time.
6. AI-generated content
Some features use AI to draft reports, summaries and other text from your records. Vorlana calculates the figures from your data, but AI-written text can still contain errors or phrasing that does not suit your purpose. You are responsible for reviewing AI-generated content before relying on it or sharing it with funders, boards or anyone else.
7. Acceptable use
You must use Vorlana in line with our Acceptable use policy and the law. We may suspend access that puts the service, other customers or the public at risk, and will tell you promptly why.
8. Availability and support
We aim to keep Vorlana available at all times, but it may occasionally be unavailable for maintenance, updates or reasons outside our control. We will give advance notice of planned maintenance where we reasonably can. Support is by email at hello@vorlana.com during UK working hours.
We back up data regularly as described on our Security & backups page.
9. Intellectual property
We own Vorlana, including the software, design and documentation. You receive a right to use it for your organisation's own work while your account is active. You may not copy, resell or reverse-engineer it. If you send us suggestions, we may use them freely to improve Vorlana.
10. Confidentiality
Each of us will keep the other's confidential information private and use it only for the purposes of this agreement, except where it is already public, is required to be disclosed by law, or the other party agrees.
11. Ending the agreement
- You can cancel at any time by emailing us. Unless your order form says otherwise, cancellation takes effect at the end of your current billing period and fees already paid are not refunded.
- Either of us can end the agreement straight away by written notice if the other seriously breaches these terms and does not fix it within 30 days of being asked, or becomes insolvent.
- After the agreement ends you will have 30 days to export your data. We then delete Customer Data within 90 days of the end date, and backup copies expire within a further 30 days.
12. Liability
Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.
Subject to that, neither of us is liable for loss of profit, revenue, funding or goodwill, or for any indirect or consequential loss. Our total liability to you in any 12-month period is limited to the fees you paid us in the 12 months before the event giving rise to the claim.
We provide Vorlana with reasonable skill and care. Except as set out in these terms, we do not give any other warranties, including that the service will be error-free or that reports will result in any particular funding decision.
13. Changes to these terms
We may update these terms. We will give at least 30 days' notice of any material change by email to your account's main contact. If you do not agree, you can cancel before the change takes effect.
14. General
- Neither of us is responsible for delays caused by events outside our reasonable control.
- You may not transfer this agreement without our consent. We may transfer it to a company that takes over Vorlana, and will tell you if we do.
- If any part of these terms is found unenforceable, the rest continues to apply.
- These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
- Notices to us should go to hello@vorlana.com. Notices to you will go to your account's main contact email.
Data processing agreement
This agreement covers the personal data your organisation puts into Vorlana. You are the controller and decide what is collected; we are the processor and only use it to run Vorlana for you. It forms part of our Terms of service and meets the requirements of Article 28 of the UK GDPR.
1. Parties and scope
This data processing agreement (“DPA”) is between the Customer (the controller) and Winters Ventures Ltd, trading as Vorlana (the processor). It applies whenever we process personal data within Customer Data on the Customer's behalf. Words such as “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meanings given in the UK GDPR.
2. Details of the processing
| Subject matter | Providing the Vorlana service: storing, organising and analysing records, and producing reports |
|---|---|
| Duration | For as long as the Customer uses Vorlana, plus the deletion period in section 9 |
| Nature and purpose | Hosting, storage, retrieval, calculation of statistics, generation of reports and documents, sending emails the Customer triggers, backups, and support |
| Types of personal data | Names and contact details; attendance, volunteer hours and check-ins; feedback and survey answers; outcomes, notes and case information; documents the Customer uploads; and, where the Customer chooses to collect them, special category data such as ethnicity, health or disability, religion and sexual orientation |
| Categories of data subjects | The Customer's participants, service users, volunteers, event attendees, staff, donors, partners, employer contacts and other people the Customer works with |
3. Our obligations
We will:
- process personal data only on the Customer's documented instructions — which are these terms and the Customer's use of Vorlana's features — unless the law requires otherwise, in which case we will tell the Customer first unless the law forbids it;
- tell the Customer if we believe an instruction breaks data protection law;
- make sure everyone who can access the data is bound by confidentiality;
- apply the security measures in section 5;
- use sub-processors only as set out in section 6;
- help the Customer, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights, and to meet its obligations on security, breach notification, data protection impact assessments and consultation with the ICO;
- delete or return personal data at the end of the service as set out in section 9;
- make available the information needed to show we meet this DPA, and allow for and contribute to reasonable audits as set out in section 8.
4. The Customer's obligations
The Customer is responsible for having a lawful basis for the personal data it puts into Vorlana (and an Article 9 condition for special category data), for giving people appropriate privacy information, for the accuracy of what it records, and for managing who in its organisation has access.
5. Security
We keep appropriate technical and organisational measures in place, including:
- encryption of data in transit (HTTPS) and at rest;
- database-level separation so each organisation can only reach its own records;
- role-based access within each organisation's account;
- restricting our own staff's access to production data to what is needed to run and support the service;
- daily backups of the database;
- imports that can be undone, and clean-up limited to one organisation's records;
- keeping public forms (QR check-in and feedback) from revealing stored records, and limiting how often they can be used.
More detail is on our Security & backups page. We may update these measures, but will not reduce the overall level of protection.
6. Sub-processors
The Customer gives general authorisation for us to use sub-processors. Our current sub-processors are listed below and on our Sub-processors page. We will give at least 30 days' notice by email before adding or replacing one. If the Customer objects on reasonable data protection grounds, we will discuss it in good faith; if we cannot resolve it, the Customer may end the affected service and receive a pro-rata refund of prepaid fees. We impose data protection terms on each sub-processor that are no less protective than this DPA, and remain responsible for their performance.
| Provider | What they do for Vorlana | Data involved | Location |
|---|---|---|---|
| Supabase Inc. | Database, user sign-in and file storage (for example organisation logos) | All Customer Data and account data | Amazon Web Services data centre selected for Vorlana. Where this is outside the UK, the safeguards described in our Privacy policy apply. |
| Vercel Inc. | Hosts the website and app, and runs the server functions behind them | Data passing through the app while in use; technical logs | United States and global edge network |
| Anthropic PBC | AI features: drafting reports, summaries and other text | Only what is sent to generate that text — mainly calculated figures and short excerpts such as feedback comments | United States |
| Resend (Plus Five Five, Inc.) | Sends emails, such as team invitations and demo requests | Names and email addresses, and the content of those emails | United States |
7. International transfers
Where personal data is transferred outside the UK, we make sure a lawful transfer mechanism is in place — UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework for certified providers) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses — together with appropriate supplementary measures.
8. Personal data breaches and audits
We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. We will provide the information the Customer reasonably needs to meet its own reporting obligations, and keep it updated as we learn more.
We will answer reasonable written questions about our data protection practices. Where the Customer reasonably needs more, we will agree the scope, timing and cost of an audit in advance; audits must not compromise the security or confidentiality of other customers' data.
9. End of processing
When the service ends, the Customer has 30 days to export its data. We then delete Customer Data from live systems within 90 days of the end date. Backup copies are overwritten as backups expire, within a further 30 days. We will confirm deletion in writing on request. We may keep data only where the law requires it.
10. Liability and precedence
The liability limits in our Terms of service apply to this DPA. If this DPA conflicts with the terms on the processing of personal data, this DPA takes priority.
Contact
Data protection questions: hello@vorlana.com.
Sub-processors
These are the companies that help us run Vorlana and may process personal data on our customers' behalf. We give customers at least 30 days' notice before adding or replacing any of them.
Current sub-processors
| Provider | What they do for Vorlana | Data involved | Location |
|---|---|---|---|
| Supabase Inc. | Database, user sign-in and file storage (for example organisation logos) | All Customer Data and account data | Amazon Web Services data centre selected for Vorlana. Where this is outside the UK, the safeguards described in our Privacy policy apply. |
| Vercel Inc. | Hosts the website and app, and runs the server functions behind them | Data passing through the app while in use; technical logs | United States and global edge network |
| Anthropic PBC | AI features: drafting reports, summaries and other text | Only what is sent to generate that text — mainly calculated figures and short excerpts such as feedback comments | United States |
| Resend (Plus Five Five, Inc.) | Sends emails, such as team invitations and demo requests | Names and email addresses, and the content of those emails | United States |
Other services used by our website
These are not sub-processors of Customer Data, but you may see them load in your browser:
- Google Fonts — provides the typefaces on vorlana.com. Your browser requests the fonts from Google, which receives your IP address.
- Cloudflare cdnjs and unpkg — serve some open-source code libraries used by the app (for example the QR code generator). Your browser requests them directly.
Changes
We will update this page and email account holders at least 30 days before a new sub-processor starts handling Customer Data. To ask a question or object to a change, email hello@vorlana.com.
Security & backups
Your data is encrypted, kept separate from every other organisation's, and backed up every day. Public QR forms never give access to stored records.
Where your data lives
Vorlana's database, sign-in and file storage are hosted by Supabase on Amazon Web Services. The website and app are served by Vercel. Our full list of providers is on the Sub-processors page.
Encryption
- In transit: every connection to Vorlana uses HTTPS.
- At rest: the database and stored files are encrypted by our hosting provider.
Keeping organisations separate
Every record belongs to one organisation. The database itself enforces this with row-level security rules, so a signed-in user can only reach records for the organisations they are a member of — even if there were a mistake elsewhere in the app. Within an organisation, roles control who can change settings.
Public QR pages (event feedback and volunteer check-in) run through a server function. They never give the browser direct access to the database, never return lists of people, can be switched off at any time, and are rate limited.
Backups
The database is backed up automatically every day by our hosting provider, Supabase. If you delete something by mistake, email hello@vorlana.com as soon as possible and we will do everything we can to recover it.
You can also export your own data from Vorlana at any time.
Safe changes
Imports into Vorlana can be undone in one click, and removes exactly what that import added. Any clean-up we carry out on your behalf is limited to your organisation's records only.
Our own access
Only the people who run Vorlana can access the live systems, each with their own account. We look at Customer Data only when needed to provide support you have asked for, to fix a problem, or where the law requires it.
AI features
When you use an AI feature, we send Anthropic the calculated figures and short excerpts needed to draft the text — not your full database. Under Anthropic's commercial terms, this content is not used to train its models by default.
If something goes wrong
If we become aware of a breach affecting your data, we will tell you without undue delay and within 48 hours, explain what happened and what we are doing about it, and help you with any report you need to make to the ICO.
Reporting a security issue
If you think you have found a security problem in Vorlana, please email hello@vorlana.com with the subject “Security”. Please do not test it against other organisations' data.
Cookie policy
We don't use advertising or analytics cookies, and we don't track you around the web. The only things we store in your browser are what's needed to keep you signed in and make forms quicker to use — so there's nothing to accept or decline.
What we store on your device
| What | Where | Why | How long |
|---|---|---|---|
| Sign-in session | The Vorlana app | Keeps you signed in securely. Stored in your browser's local storage by our sign-in provider, Supabase. | Until you sign out, or the session expires |
| Your app preferences | The Vorlana app | Remembers small choices on this device: which areas your organisation has switched on (so the menu doesn't flicker), whether demo mode is on, and if you've dismissed the "install the app" banner. | Until you clear your browser data |
| Saved app files | The Vorlana app | If you install Vorlana on your phone, a small copy of the app's styles and icons is saved so it opens quickly and can show a clear "no connection" screen. No records or personal data are saved this way. | Replaced with each update |
| Your name on the check-in page | Public volunteer check-in page | Remembers the name or email you typed, so you don't have to type it again next time. It stays on your device only. | Until you clear your browser data |
These are strictly necessary for the service you have asked for, so under UK law they do not need your consent.
Third parties
Our website loads its typefaces from Google Fonts and some app code from Cloudflare cdnjs, jsDelivr and unpkg. When your browser fetches these files, those providers receive your IP address and browser details. They do not set cookies for us, and we do not use them to track you.
Managing storage
You can clear cookies and local storage in your browser settings at any time. If you do, you will be signed out of Vorlana and the check-in page will forget your name.
Changes
If we ever add cookies that are not strictly necessary — for example to understand how the website is used — we will update this page and ask for your consent first.
Questions: hello@vorlana.com.
Acceptable use policy
Use Vorlana for your organisation's legitimate work, collect only what you need, and don't try to break it or get at anyone else's data.
You must not use Vorlana to
- break the law, including data protection, equality and anti-discrimination law;
- collect or store personal data you have no lawful basis to hold, or more than you need;
- upload anything harmful, such as malware, or content that is abusive, threatening, discriminatory or that you do not have the right to use;
- send spam or unsolicited messages through Vorlana's email features;
- try to access another organisation's data, another user's account, or parts of the system you are not authorised to use;
- probe, scan or test Vorlana's security without our written permission;
- overload the service, including by automated scraping or excessive requests;
- copy, resell or reverse-engineer Vorlana, or use it to build a competing product;
- misuse public QR pages, for example by submitting false feedback or check-ins, or using them to find out who uses an organisation's services.
Sensitive information
Vorlana can hold sensitive information, such as safeguarding notes and equality data. Only record what your organisation needs, keep it accurate, and restrict access to the people who should see it.
If this policy is broken
We may remove content, suspend access or, for serious or repeated breaches, close the account. Where we can, we will talk to you first and give you the chance to put things right. We will tell you promptly why we have acted.
Reporting misuse
Email hello@vorlana.com.