Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your name and email address through our authentication provider (Supabase Auth).

Organization Profile

To match you with grants, we collect information about your organization including its name, type, size, location, mission, budget, and population served. For education organizations, this may include grade range, enrollment, and Title I status.

Application Content

When you use the application builder, we store the content you provide and the AI-generated drafts produced for your applications.

Payment Information

Payment processing is handled entirely by Stripe. We do not store credit card numbers or bank account details on our servers. We receive from Stripe only the information necessary to confirm your transaction (e.g., payment status, last four digits of your card).

Usage Data

We collect standard usage analytics such as pages visited, features used, and session duration to improve the platform.

2. How We Use Your Information

• Provide the service: Match you with grants, generate application drafts, and process payments.
• Improve the product: Analyze aggregated, anonymized usage patterns to improve matching accuracy and user experience. We do not use individual application content for product development.
• Communicate with you: Send transactional emails related to your account, purchases, and platform updates.

3. Third-Party Services

We use the following third-party services to operate GrantEngine:

• Stripe processes payments. Your payment information is subject to Stripe's Privacy Policy.
• Supabase provides our database and authentication infrastructure. Data is stored in Supabase-managed infrastructure with encryption at rest.
• Anthropic (Claude API) powers AI-assisted application drafting. When you use the application builder, relevant portions of your organization profile and application inputs are sent to the Claude API to generate draft content. Your application content is not used by Anthropic to train AI models. We use the API under Anthropic's commercial terms, which prohibit training on customer data.

4. FERPA and COPPA Considerations

GrantEngine is designed to be used by organizational staff (e.g., school administrators, grant writers), not by students or children. We do not knowingly collect personal information from children under 13.

For K-12 education organizations: GrantEngine collects aggregate school-level data (e.g., enrollment numbers, Title I status, free and reduced lunch percentages) to improve grant matching. We do not collect, store, or process individual student records or personally identifiable student information protected under FERPA.

If you believe that student-level data has been inadvertently provided to GrantEngine, please contact us immediately at josh@palavir.co and we will delete it promptly.

5. Data Retention and Deletion

We retain your account data and application content for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us at josh@palavir.co.

Upon receiving a deletion request, we will remove your data from our active systems within 30 days. Some data may persist in encrypted backups for up to 90 days before automatic deletion.

6. Data Security

We use industry-standard security measures including encryption in transit (TLS) and at rest, secure authentication, and access controls. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

7. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Your continued use of GrantEngine after changes are posted constitutes your acceptance of the revised policy.

8. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at josh@palavir.co.