Just because the URL is ".org" doesn't mean that it's not out to get your money. Once the ".org" was limited to non-profit groups, but now it seems that there is no control over eligibility. Most ".org"s are legitimate non-profits (my own library is one such, and we're DEFINITELY non-profit!), but there are some out there who take advantage of the original intent of the suffix.

I'm not saying tht the company your fiancee ran across is a bunch of crooks or scam artists, but I find it interesting that they have in essence sent her a spam reply.

As has been said, go it alone if you can.