Human-in-the-Loop Donor Analytics: Building Trustworthy AI for Fundraising

Fundraising teams are under pressure to do more with less: identify the right donors, personalize outreach, and forecast revenue with confidence. That pressure is exactly why donor analytics has become a prime use case for fundraising AI. But the moment a model starts ranking donors, triggering journeys, or suppressing outreach, you are no longer dealing with a neutral prediction system—you are shaping relationships, trust, and long-term giving behavior. As Rochelle M. Jerry notes in the broader conversation around AI in fundraising, technology can accelerate work, but strategy still has to stay human; for a grounding perspective on that mindset, see Using AI for Fundraising Still Requires Human Strategy.

This guide shows engineering, data, and advancement teams how to design human-in-the-loop systems for donor scoring and segmentation that are useful, explainable, and ethically defensible. We will walk through a practical architecture, model governance patterns, bias mitigation techniques, CRM integration choices, and testing workflows that keep humans in control of high-stakes decisions. If you are building an operating model for data-driven fundraising, it helps to think like a product team as well as an analytics team; that broader systems view aligns well with Design Your Creator Operating System: Connect Content, Data, Delivery and Experience.

Why human-in-the-loop matters in donor analytics

Donor relationships are not just prediction targets

In commerce, a prediction model can optimize clicks or conversion with relatively bounded downside. In fundraising, however, a false positive or false negative can affect a person’s sense of belonging, trust in your institution, and future willingness to give. A high-value donor misclassified as “low priority” may be ignored at a critical moment, while a prospect over-targeted by automation may experience fatigue and disengage. That is why the decision loop must include humans who understand context the model cannot see, such as board relationships, recent life events, grant dependencies, or campaign-specific constraints.

Human oversight is also essential because fundraising data is often incomplete and socially shaped. Wealth proxies, engagement metrics, event attendance, and open rates can all reflect access, privilege, and communication habits rather than pure generosity. A model trained to “optimize” on those features can easily replicate historical patterns that are convenient for the organization but unfair to certain donor groups. For a useful analogy, think about how teams evaluate whether a business opportunity is genuinely worth pursuing rather than merely easy to score; the same caution appears in What Actually Makes a Deal Worth It? A Deal-Score Guide for Shoppers.

Human-in-the-loop is a governance pattern, not a checkbox

Many teams say they use human review, but the review stage is too late or too shallow to matter. True human-in-the-loop design means people influence labeling, feature selection, model thresholds, exception handling, and downstream action policies. It also means the system records who overrode what, when, and why, so that governance can be audited over time. Without that traceability, the “human” part becomes ceremonial rather than protective.

In practice, human-in-the-loop should be reserved for decisions with material ethical, reputational, or strategic impact. You do not need a committee to decide whether to send a donation receipt or a generic thank-you email. But you absolutely want review for creating a major gift shortlist, suppressing a segment, escalating a stewardship action, or interpreting a score shift after a life-event signal. If you need a framework for when to limit, restrict, or approve AI-driven actions, the control philosophy in When to Say No: Policies for Selling AI Capabilities and When to Restrict Use maps well to internal fundraising governance.

Use cases that are appropriate for fundraising AI

Donor scoring

Donor scoring estimates the probability or expected value of a future action such as first gift, renewal, upgrade, or planned giving inquiry. Done well, it helps teams prioritize limited staff time and budget. Done poorly, it collapses complex relationship data into a single opaque number and encourages overconfidence. The best systems expose score components, confidence bands, and reason codes so that fundraisers can interpret the result instead of blindly trusting it.

A robust scoring program should support multiple targets rather than a single monolithic “best donor” score. For example, one model may estimate upgrade propensity, another may estimate event response likelihood, and a third may estimate retention risk. That separation reduces confounding and gives the CRM more precise actions to trigger. If you are comparing what enterprise AI buyers actually need before adopting a platform, the feature discipline outlined in What AI Product Buyers Actually Need: A Feature Matrix for Enterprise Teams is a useful reference point.

Donor segmentation

Segmentation uses clustering, rules, or hybrid models to create actionable groups such as “high-engagement recurring donors,” “lapsed mid-level supporters,” or “planned-giving candidates.” Human review matters because segments are not just technical artifacts; they drive messaging tone, channel selection, and resource allocation. When a segment is interpreted as a person type rather than a pattern, teams can start making moral claims the data never justified. A human analyst should always validate whether segments are stable, understandable, and appropriate for stewardship.

Segmentation also supports campaign design and testing. For example, a monthly giving campaign might require separate treatments for new donors, event converts, and legacy supporters. A/B testing can then compare messaging or offer combinations within those approved segments, rather than using the model as an excuse to automate everything at once. This is similar to how teams in performance-driven media think about measurement and outcomes, as shown in Blockbusters and Bottom Lines: How Film Marketers Can Use ROAS to Launch a Hit.

Next-best-action and stewardship triggers

Not every model should make a decision; some should merely suggest one. A next-best-action model might recommend a call, a personal note, a stewardship package, or no action at all, but the final decision can stay with a fundraiser. That is often the most practical human-in-the-loop pattern because it preserves judgment while reducing manual triage. The model becomes an assistant, not an authority.

Stewardship triggers are especially sensitive because the wrong automation can feel invasive or irrelevant. Imagine a system that sends a major-gift solicitation immediately after a donor reports a hardship, or a stewardship email based solely on open behavior without donor intent. Humans should be able to suppress, edit, or route these recommendations before they reach the donor. For teams managing timing-sensitive programs, the logic resembles Top Time-Sensitive Deals You Shouldn't Miss This Month: Flash Sales Across Home, Tech, and Beauty—except your “conversion” is trust, not impulse purchase.

Step 1: Build the right data foundation

Start with stewardship-first data inventory

Before training anything, inventory the data sources that power donor analytics: CRM records, event attendance, email engagement, donation history, web analytics, wealth screening, volunteer activity, and offline interactions. Then classify each source by provenance, freshness, consent posture, and likely bias risk. Data stewardship means knowing not only what you have, but whether you should use it and how confidently you can use it. The goal is to prevent a model from learning from signals that are noisy, intrusive, or operationally unreliable.

A stewardship-first inventory should also identify which fields are operationally actionable. For instance, “attended gala” may be meaningful for segmentation, while “clicked three emails in 14 days” might be useful only when combined with recency and channel preference. In many organizations, the most valuable feature is not the fanciest one—it is the one with stable meaning over time and a defensible collection policy. For teams modernizing data intake, the same discipline appears in From Receipts to Revenue: Using Scanned Documents to Improve Retail Inventory and Pricing Decisions, where raw inputs are only valuable when translated into trustworthy operational signals.

Define the unit of analysis and label windows

One of the biggest donor analytics mistakes is mixing record levels. A person-level score, a household-level view, and a campaign-level response label are not interchangeable. You need to define exactly what the model predicts, over what time horizon, and what information would have been available at prediction time. Without this discipline, leakage can make a model look great in training and fail in production.

For example, if you are predicting a future gift in the next 90 days, the feature set should exclude any signals that arrived after the scoring date. Likewise, labels should reflect the business question: first gift, repeat gift, upgrade, retention, or reactivation. Each use case requires its own target definition and review protocol. Teams that manage model operations at scale often benefit from the same type of exacting process used in Audit-Ready CI/CD for Regulated Healthcare Software: Lessons from FDA-to-Industry Transitions, especially when auditability matters.

Document consent, residency, and retention rules

For many nonprofits, donor data governance is not just a best practice—it is a compliance requirement. Depending on jurisdiction and donor profile, GDPR, HIPAA-adjacent workflows, payment-card concerns, and data residency rules can constrain how records move through analytics pipelines. Your design should make it easy to prove why each field exists, where it is stored, how long it is kept, and who can access it. A model that cannot be explained to auditors should not be allowed to steer donor strategy.

That documentation should also cover CRM sync behavior and deletion propagation. If a donor requests removal or restriction, your analytics layer must honor that status in downstream scoring jobs, training sets, and marketing tools. In other words, compliance is not only about the source system; it is about the propagation path. If your team already manages policy-heavy platforms, the governance lens from Volkswagen's Governance Restructuring: A Roadmap for Internal Efficiency offers a helpful organizational analogy.

Step 2: Design scoring models that stay interpretable

Use simple baselines before complex models

Start with transparent baselines such as logistic regression, gradient-boosted trees with explainability tooling, or rule-based scoring. The purpose is not to avoid sophisticated methods forever, but to establish a benchmark the team can understand and defend. A simple baseline often reveals whether the organization actually has useful signal or merely hopes the data will “magically” produce a strategy. If the baseline performs nearly as well as the complex model, that itself is valuable intelligence.

Only add complexity when it improves a defined metric and preserves operational trust. In fundraising, a tiny lift in AUC is not automatically meaningful if it worsens interpretability, fairness, or deployment friction. Model selection should be tied to the action you intend to take, not to abstract leaderboard performance. That product-oriented mindset echoes the practical buyer criteria in What AI Product Buyers Actually Need: A Feature Matrix for Enterprise Teams and should shape your internal roadmap.

Make score explanations visible in the CRM

Explainable AI is only useful if fundraisers can see it where they work. For each donor or segment, expose top contributing factors such as recency of engagement, giving frequency, program affinity, prior upgrade history, or event participation. Pair those reasons with a confidence indicator or uncertainty flag so staff understand whether the recommendation is robust or provisional. The goal is not to turn fundraisers into data scientists; it is to help them make informed judgment calls quickly.

In practical terms, a CRM record might show: “Upgrade propensity increased due to recent event attendance, renewed email engagement, and consistent monthly giving; confidence moderate because the donor has limited direct-mail history.” That is much more useful than a black-box score of 0.83. It also gives fundraisers language they can use internally when justifying outreach decisions to managers or board members. For teams designing interfaces that must make invisible logic visible, Color Psychology in Web Design: How to Optimize User Experience with Visual Enhancements is a reminder that presentation shapes perception, even in technical tools.

Calibrate thresholds to human capacity, not just model precision

A score is only actionable if the organization can handle the resulting workflow. If your major-gift team can only actively work 300 prospects per quarter, a model that identifies 3,000 “high-priority” donors is operationally useless. Thresholds should therefore be set in partnership with frontline staff, based on capacity, campaign calendars, and stewardship priorities. This is where human-in-the-loop becomes more than a review gate: it becomes a planning mechanism.

Threshold tuning should also be revisited after each campaign cycle. If the model is too aggressive, staff fatigue and donor over-contact will rise. If it is too conservative, you leave money on the table and miss timely opportunities. In volatile environments, teams often need a playbook for safe iteration, much like the disciplined experimentation described in When Experimental Distros Break Your Workflow: A Playbook for Safe Testing.

Step 3: Put humans in the loop at the right decision points

Review design: who approves what, and when?

Human review should be mapped to decision risk. Low-risk actions such as content personalization can be automated with lightweight oversight, while high-impact actions such as major gift solicitation, segmentation exclusions, or donor suppression should require explicit review. Build a matrix that defines who can approve a recommendation, who can override it, and which scenarios require escalation. This is model governance in operational form.

That matrix should also specify response times. If a human review queue is too slow, teams will bypass it, and the control fails. The best systems make review friction proportional to risk: fast approval for routine actions, slower and more careful approval for strategic ones. Think of it as a triage system for organizational judgment rather than a bureaucratic checkpoint.

Capture override reasons as training data

One of the most valuable artifacts in human-in-the-loop systems is the override log. When a fundraiser rejects a recommendation, ask why in structured categories such as “known relationship context,” “bad timing,” “insufficient data,” “reputational concern,” or “segment mismatch.” Those reasons can later inform feature engineering, policy adjustments, or even a separate model that predicts when the primary model is likely to be wrong. This creates a learning loop between humans and the algorithm.

Override logs also improve trust because they prove the team is not delegating judgment blindly. Over time, patterns may emerge: perhaps the model overestimates prospects with high digital engagement but weak offline affinity, or underestimates older donors who prefer direct mail. Those insights are often more strategically important than a marginal score improvement. Teams trying to formalize such feedback loops may find useful analogies in The New Skills Matrix for Creators: What to Teach Your Team When AI Does the Drafting.

Use policy controls to protect vulnerable audiences

Not every donor should be treated the same by automation. You may need rules that suppress automated targeting for minors, patients, emergency aid recipients, politically sensitive constituencies, or anyone who has opted out of profiling. Human-in-the-loop systems should include policy logic that prevents the model from even proposing certain actions. This is especially important when a fundraising organization works across multiple programs with different ethical and legal boundaries.

These controls are not just about compliance; they are about preserving mission integrity. If a model can technically optimize for revenue but violates donor expectations or vulnerable-person safeguards, it is the wrong model. Put plainly, trust is an asset, and once it is lost, no amount of segmentation sophistication will fully recover it. That’s why good teams think in terms of controlled capabilities, similar to the policy discipline in When to Say No: Policies for Selling AI Capabilities and When to Restrict Use.

Bias mitigation and fairness checks for fundraising AI

Audit proxies and historical bias

Bias in donor analytics often enters through proxies. Zip code, device usage, event attendance, giving channel, and email responsiveness can all correlate with wealth, geography, age, or schedule flexibility. If left unchecked, these proxies can produce a model that favors highly visible, high-income, or digitally active donors while undervaluing less visible supporters. You should audit each feature for possible proxy behavior and ask whether it advances the fundraising objective or merely reproduces historical advantage.

Fairness audits should also examine whether certain donor groups are systematically assigned lower scores, fewer opportunities, or lower-touch stewardship pathways. If so, the model may be narrowing your pipeline in ways that hurt long-term growth. Teams should compare model outputs across protected or sensitive cohorts where legally and ethically appropriate, then document both the findings and the remediation plan. For a disciplined view of risk scoring in another domain, Superintelligence Readiness for Security Teams: A Practical Risk Scoring Model illustrates how structured risk review can be made explicit rather than implied.

Use bias mitigation techniques intentionally

Bias mitigation can happen before, during, or after training. Before training, remove or transform features that create unjustifiable proxy effects. During training, use weighting, constraints, or fairness-aware objectives. After training, calibrate thresholds or post-process scores to reduce disparate impact. No single method solves everything, so the right combination depends on the model’s purpose and the team’s tolerance for tradeoffs.

The important point is to treat fairness as an engineering requirement, not a PR statement. A model that is slightly less accurate but significantly more equitable may be the correct choice if it supports broader mission outcomes and donor trust. Just as infrastructure teams cannot ignore cost volatility, fundraiser teams cannot ignore fairness volatility. The analogy to budgeting under uncertainty is clear in Procurement Strategies for Infrastructure Teams During the DRAM Crunch, where constraint-aware planning beats wishful thinking.

Validate with real-world stakeholder review

Numbers alone will not tell you whether a model’s output feels appropriate in the field. Schedule review sessions with major gift officers, annual fund managers, data staff, and compliance stakeholders to inspect sample recommendations and segment outputs. Ask whether the model’s logic matches lived experience, where it misses nuance, and whether any output would be embarrassing or harmful if acted on automatically. This qualitative step often catches issues that metrics miss.

Stakeholder review is also where ethical edge cases surface. A donor with low digital engagement may still be a deeply loyal supporter. A lapsed donor may be lapsed for reasons unrelated to interest. A human reviewer is the only practical way to reconcile those facts with the model’s simplified view. In teams that cultivate feedback cultures, the constructive review approach in A Friendly Brand Audit: How to Give Constructive Feedback to Your Creatives-in-Training offers a useful interpersonal model.

Step 4: Integrate with the CRM and workflow stack

Design CRM write-backs carefully

Your CRM should store not just the score, but the score version, timestamp, explanation fields, review status, and action taken. Avoid overwriting prior scores without keeping history, because model drift and business changes are only visible when you preserve lineage. The workflow should distinguish between raw model outputs, approved recommendations, and executed actions. This distinction is critical for post-campaign analysis and compliance audits.

When integrating with systems like Salesforce, Dynamics, or a donor platform, use idempotent jobs and explicit field mapping so that the scoring service and CRM do not fight each other. If your fundraising team depends on manual notes, event systems, and email automation, the integration architecture has to preserve context across all of them. The same design thinking that helps teams connect content, data, delivery, and experience in Design Your Creator Operating System: Connect Content, Data, Delivery and Experience applies directly here.

Keep the human decision visible in the workflow

When a fundraiser approves or rejects a recommendation, that decision should be visible in the CRM and downstream analytics. Otherwise the organization cannot distinguish between model intent and human judgment. A clear UI should show the recommended action, the rationale, the reviewer, and the final outcome. This helps training, auditing, and future prioritization.

It also improves adoption. Frontline staff are more likely to trust systems that respect their judgment and preserve accountability. If the tool behaves like an invisible boss, users will work around it; if it behaves like a capable assistant, they will use it. Many teams underestimate how much adoption depends on interface clarity and operational fit, a lesson that shows up in Sync Your LinkedIn and Launch Page: A Pre-Launch Audit to Avoid Messaging Mismatch, where consistency across touchpoints is the difference between trust and confusion.

Automate only the safe parts

Not every step in the funnel needs a human checkpoint. Safe automation includes enrichment, de-duplication, standard score calculation, alert generation, and routing recommendations to the right reviewer. High-risk automation, by contrast, includes donor suppression, wealth-assumption-based targeting, or any action that could materially change how a person experiences your organization. The smartest teams automate the plumbing and retain human judgment for the consequential parts.

That split keeps the system scalable without making it reckless. It also makes troubleshooting easier because you can isolate whether an issue arose from data ingestion, feature generation, scoring, approval, or campaign execution. If your team has learned to operationalize at scale, that philosophy aligns with Operate or Orchestrate? A Playbook for Creators Scaling Physical Products.

Step 5: Test, monitor, and improve the model over time

A/B test with ethical guardrails

A/B testing is essential, but in fundraising it must be framed carefully. You should test message variants, stewardship offers, timing, and channel strategies within approved groups, not randomly expose donors to harmful or confusing treatment. Test design should include stop conditions, sample-size logic, and a clear rule for human intervention if results show unexpected distress, opt-outs, or reputational risk. In other words, experimentation must be governed, not just statistically valid.

Test outcomes should include more than revenue. Watch for unsubscribe rates, complaint rates, volunteer attrition, event no-shows, and downstream retention. The goal is long-term relationship quality, not just short-term lift. In that sense, fundraising experimentation is closer to operational learning than pure conversion optimization. A rigorous, metrics-first lens is also central to Using Institutional Earnings Dashboards to Spot Clearance Windows in Electronics, where timing matters but context matters too.

Monitor drift and segment decay

Donor behavior changes over time, especially after campaigns, macroeconomic shocks, leadership transitions, or program launches. A segment that worked well last quarter may degrade quickly if the underlying engagement pattern changes. You should monitor score distributions, calibration, feature stability, and action outcomes monthly or quarterly depending on volume. If drift is detected, re-train, re-threshold, or retire the model rather than letting stale logic persist.

Segment decay is particularly dangerous because teams often keep using segments that are easy to explain, even after they stop being predictive. When a segment becomes stale, it can misallocate staff effort and distort campaign planning. The right response is not to abandon segmentation, but to treat it like a living asset that needs maintenance. This is similar to how organizations think about evolving technical environments in Android Fragmentation in Practice: Preparing Your CI for Delayed One UI and OEM Update Lag.

Create a model governance review cadence

Model governance should have a cadence: version reviews, data quality checks, fairness audits, and business-owner signoff. Each model release should be documented with its intended use, training window, feature set, thresholds, known limitations, and fallback plan. A governance committee does not need to be large, but it should include someone from data, someone from fundraising operations, and someone with compliance or risk oversight. Their job is to ensure the model continues to serve the mission rather than drift into convenience.

This cadence should include sunset criteria. If a model no longer improves decision quality, or if it becomes too hard to explain, it should be retired. Good governance is as much about saying no to obsolete automation as it is about approving new capabilities. That principle fits the broader responsibility model in Volkswagen's Governance Restructuring: A Roadmap for Internal Efficiency.

A practical comparison of model approaches

The table below compares common approaches teams use in donor analytics. The right choice depends on maturity, data quality, and the risk level of the decision you are supporting. In most cases, the best path is to start simpler, prove value, and only add complexity where explainability and governance can keep up. Use this as a decision aid during architecture reviews and vendor evaluations.

Implementation blueprint: from prototype to production

Pilot on one high-value workflow

Do not begin with the entire fundraising organization. Pick one workflow where a better recommendation could matter, such as mid-level donor upgrades or lapsed donor reactivation. Define the target, success metrics, review process, and rollback plan before building anything. A narrow pilot reduces risk while giving you enough signal to evaluate business impact.

Choose a sponsor who owns the workflow and a data owner who can keep the pipeline stable. Then produce a lightweight dashboard that shows score distribution, approved recommendations, and actual outcomes. If the pilot works, expand gradually into adjacent workflows rather than forcing a wholesale replacement. For inspiration on measured rollout and timing, see the systems perspective in When Raid Bosses Refuse to Stay Dead: What the WoW Secret Phase Teaches Developers About Live-Event Design.

Package the model with documentation

Your model should ship with a model card, data dictionary, governance policy, and operating playbook. Include intended use, out-of-scope uses, training data dates, known failure modes, explanation format, review requirements, and escalation contacts. Documentation is not bureaucracy; it is the infrastructure that makes trust repeatable. If a departing analyst is the only person who understands the model, you do not have a production system—you have a dependency risk.

Good documentation also supports procurement and leadership buy-in. Stakeholders want to know whether the system can scale, whether it is compliant, and whether it will create hidden costs. If you are evaluating vendors or building internal capabilities, the procurement lens from Procurement Strategies for Infrastructure Teams During the DRAM Crunch translates neatly to analytics tooling and cloud resources.

Measure success with both revenue and trust

Do not define success only by dollars raised. Add metrics for staff adoption, override rates, donor complaints, unsubscribe rates, segment stability, and time saved per workflow. A system that generates revenue but alienates staff or donors is not a win. Long-term fundraising depends on trust compounding over time, not just short-term performance spikes.

One useful way to frame this is to compare short-term lift against long-term organizational capacity. If the model improves prioritization but increases governance burden beyond what the team can support, the net result may be negative. The discipline of weighing value against practical cost is echoed in A Practical Guide to Setting Up Helpdesk Cost Metrics When Inflation Is Rising, where operational economics shape strategy.

Common failure modes and how to avoid them

Black-box dependency

If nobody can explain why a donor was scored a certain way, adoption will eventually collapse. The workaround is not to add a prettier dashboard; it is to expose the reasoning, the confidence level, and the override path. Black-box dependency is especially dangerous when staff begin treating model output as if it were strategy. Strategy must remain human, even when the model informs it.

Optimization without ethics

When a team chases lift without guardrails, the system may exploit donors rather than steward them. Examples include over-contacting highly responsive donors, suppressing less digitally active supporters, or prioritizing only those who look like past major gifts. Ethical design requires setting constraints before optimization begins, not apologizing afterward. In regulated or sensitive contexts, that constraint-first philosophy mirrors how teams approach Age Verification vs. Privacy: Designing Compliant — and Resilient — Dating Apps.

Governance theater

A quarterly meeting is not governance if it cannot change model behavior. Governance must influence data access, threshold updates, review rules, and retirement decisions. If the committee only receives reports after the fact, the model is effectively self-governing. That is unacceptable for high-stakes donor operations where trust and compliance matter.

Frequently asked questions

Conclusion: build models that earn trust, not just predictions

Human-in-the-loop donor analytics is not a compromise between old-school fundraising and modern AI; it is the operating model most likely to survive real-world complexity. The organizations that get this right will use donor analytics to sharpen judgment, not replace it, and will use fundraising AI to support stewardship rather than override it. If you design for explainability, fairness, auditability, and CRM-native workflow integration from the beginning, your model can become a trusted part of the fundraising process instead of a source of risk.

That trust is earned through careful data stewardship, thoughtful governance, and continuous collaboration between engineers and fundraising staff. It is also preserved by remembering that the most important decisions in philanthropy are human decisions. For a final complementary lens on audience trust, strategic messaging, and the risks of mismatch, revisit Sync Your LinkedIn and Launch Page: A Pre-Launch Audit to Avoid Messaging Mismatch and Using AI for Fundraising Still Requires Human Strategy.

Pro Tip: If you cannot explain a donor score in one sentence to a fundraiser, you probably cannot defend it to a donor, board member, or auditor either.

Related Reading

• What AI Product Buyers Actually Need: A Feature Matrix for Enterprise Teams - A practical checklist for evaluating AI features before adoption.
• Audit-Ready CI/CD for Regulated Healthcare Software: Lessons from FDA-to-Industry Transitions - A governance model for release discipline in regulated environments.
• Cloud Data Marketplaces: The New Frontier for Developers - How data exchange patterns are changing for engineering teams.
• What OpenAI’s Stargate Talent Moves Mean for Identity Infrastructure Teams - A look at identity, access, and organizational readiness.
• When 'Incognito' Isn’t Private: How to Audit AI Chat Privacy Claims - A useful framework for scrutinizing vendor privacy promises.