Privacy Policy

Scope

This policy applies to personal information we collect through the Services, in account and billing interactions, in support communications, and when you interact with our public website, emails, or product features. It does not apply to third-party websites, grantor portals, payment pages, AI providers, analytics services, or other services that have their own privacy policies.

If you use the Services for an organization, your organization may also control or administer personal information in your workspace. Organization owners and administrators may be able to access, export, retain, delete, or manage workspace content and account activity.

Information We Collect

Depending on how you use the Services, we may collect the following categories of information:

• Account and contact information, such as name, email address, phone number, login information, role, organization, and communications preferences.
• Organization profile information, such as legal name, DBA, EIN or tax status, mission, programs, service areas, leadership, team members, budgets, grant history, website, eligibility details, and funding goals.
• Workspace and application information, such as saved grants, shortlists, grant-fit notes, application status, deadlines, assignments, tasks, comments, generated drafts, verification reports, and outcome records.
• Uploaded files and generated content, such as budgets, tax documents, payroll files, impact reports, program narratives, letters, grant applications, attachments, PDFs, DOCX files, notes, prompts, chats, and other materials you upload or generate.
• Billing and subscription information, such as plan, usage, invoice status, payment history, Stripe customer or subscription identifiers, discounts, and billing contact details. We do not intentionally store full payment card numbers.
• Device, usage, and analytics information, such as IP address, browser type, device identifiers, pages viewed, referring pages, feature interactions, search queries, crash or diagnostic information, approximate location derived from IP address, and consent preferences.
• Support and communications information, such as emails, forms, feedback, sales inquiries, security reports, accessibility requests, and recordings or transcripts if you choose to participate in a call or demo.

Sensitive Information

Grant work may involve sensitive information. Depending on what you upload or enter, Customer Data may include government identifiers, financial records, tax records, payroll information, bank or budget details, health or disability-related program information, demographic information, information about beneficiaries, or other confidential or regulated information.

We do not require you to upload sensitive information unless it is needed for a feature or your grant work. You should avoid uploading sensitive information that is not necessary, and you are responsible for obtaining required permissions, notices, and consents before uploading information about other people.

Sources of Information

We collect information from:

• you and other authorized users in your organization;
• organization owners, administrators, consultants, or collaborators who invite you or manage a workspace;
• public sources, grantor websites, government databases, foundation records, and other grant-related sources;
• service providers such as authentication, payment, analytics, infrastructure, search, email, and AI providers; and
• your browser, device, and interactions with the Services.

How We Use Information

We use information to:

• provide, operate, secure, troubleshoot, and improve the Services;
• create and manage accounts, organizations, workspaces, roles, permissions, subscriptions, invoices, and billing;
• search grant and foundation data, calculate fit, identify eligibility issues, and organize grant opportunities;
• retrieve organization-scoped context and insert relevant information into AI-assisted drafts, analyses, documents, and recommendations;
• generate, review, verify, score, export, and manage grant-related drafts and documents;
• store and process documents in organization-scoped vaults and workspaces;
• send product, account, security, support, deadline, billing, and service communications;
• measure usage, diagnose issues, prevent fraud, enforce terms, and protect the Services;
• comply with law, legal process, audits, disputes, and rights requests; and
• use analytics only as described in this policy and our privacy choices tools.

AI Processing and Model Training

We use AI model providers and related infrastructure to support search, drafting, analysis, verification, summarization, classification, and workspace assistance. Customer Data may be sent to these providers as needed to provide the requested feature.

We do not use Customer Data to train foundation models unless we obtain separate express permission. Customer Data is used to provide the Services to the relevant customer or organization, including to retrieve organization-scoped context for that organization's drafts and documents.

We design the Services to keep organization data separated by workspace, tenant, account, role, and access controls. No security or access-control system is perfect, but cross-organization use of Customer Data is not permitted by our product design or policies.

How We Disclose Information

We may disclose information to:

• Service providers and subprocessors that help us provide the Services, including Stripe, Firebase/Google, Vercel, PostHog, Plausible, Anthropic, OpenAI, Resend or SendGrid, Cloudflare/R2/S3-compatible storage, Upstash, ZH Search, and our API gateway and database infrastructure.
• Organization users and administrators according to workspace roles, permissions, and collaboration settings.
• Grantors, agencies, consultants, collaborators, or third parties when you direct us to export, submit, share, email, or otherwise transmit information.
• Professional advisors, auditors, legal authorities, and compliance parties when reasonably necessary for security, legal, accounting, audit, dispute, or compliance purposes.
• Successors or transaction parties in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.

Analytics, Cookies, and Privacy Choices

We use analytics to understand product usage, diagnose issues, and improve the Services. Our current analytics tools may include Plausible, Vercel Analytics, Firebase Analytics, and PostHog. We do not currently use retargeting pixels or cross-context behavioral advertising.

Where our consent tools apply, analytics tags are blocked until you accept analytics. You can decline analytics or change your choice from our Your Privacy Choices page.

We do not sell personal information or share personal information for cross-context behavioral advertising. We also make reasonable efforts to honor Global Privacy Control or similar legally recognized opt-out signals as a request to opt out of sale, sharing, or targeted advertising where applicable.

Retention

We retain personal information and Customer Data for as long as reasonably necessary to provide the Services, maintain accounts and workspaces, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support legitimate business needs.

Retention periods vary by data type. Account, billing, audit, and legal records may be retained after account closure where required or permitted by law. Deleted data may remain in backups, logs, or archival systems for a limited period before being overwritten or deleted according to our retention practices.

Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, port, or restrict certain personal information; opt out of sale, sharing, targeted advertising, or profiling; limit certain uses of sensitive personal information; appeal a privacy decision; or withdraw consent where processing is based on consent.

To exercise privacy rights, email support@grantauthority.org. You may also use our Your Privacy Choices page for analytics and opt-out preferences.

We may need to verify your identity or authority before fulfilling a request. If your information is controlled by your organization, we may refer the request to that organization or ask you to contact the organization administrator.

California Residents

California residents can review our supplemental California Privacy Notice, which includes a notice at collection, personal information categories, retention information, rights information, and sale or sharing disclosures.

Children and Minors

The Services are not intended for children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided personal information to us, contact us and we will take appropriate steps.

Security

We use administrative, technical, and organizational safeguards designed to protect personal information and Customer Data, including access controls and organization-scoped data boundaries. No website, application, network, model, or storage system is completely secure, and we cannot guarantee absolute security.

Accessibility and Alternative Formats

If you need this policy or a privacy notice in an alternative format because of a disability, please contact support@grantauthority.org.

Changes to This Policy

We may update this policy from time to time. If changes are material, we will make reasonable efforts to notify you, such as by posting the updated policy, changing the date above, or providing account or email notice.

Contact