Privacy Policy
Last updated: [Date]
[Company Legal Name], [Governing State/Jurisdiction], and [support@yourdomain.com] below with real values, and have this document reviewed by counsel.1. Overview
This Privacy Policy explains what information [Company Legal Name] collects through GrantSprout (the “Service”), how it is used, and the choices you have.
2. Information We Collect
- Account information (email address, and OAuth profile details if you sign in that way), managed via Supabase Auth.
- Organization information you enter (organization name, mission, focus areas, and similar details).
- Grant pipeline data (funders, amounts, deadlines, requirements, notes, and impact/outcome logs).
- Documents you upload and attach to your organization or to specific grants.
- Payment information for paid subscriptions — handled entirely by Stripe; GrantSprout never stores your card number.
3. How We Use Information
We use collected information to operate the Service, send deadline reminder emails, process subscription payments, respond to support requests, and maintain the security of the Service.
4. Cookies & Analytics
The Service uses Vercel Analytics to understand aggregate usage patterns. Vercel Analytics is designed to be privacy-friendly and does not use cross-site tracking cookies by default.
5. Third-Party Processors
- Supabase — authentication, database, and file storage.
- Stripe — payment processing for paid subscriptions.
- Brevo — transactional email, including deadline reminders.
- Discord — receives your email address, approximate location, and sign-in timestamp on every login, for internal security notifications.
6. Data Retention
We retain your data for as long as your account is active. If you delete your organization or account, we will delete or anonymize your data within a reasonable period, except where we are required to retain records for legal or accounting purposes.
7. Data Security
Your data is stored in Supabase and protected by Row Level Security policies that restrict access to members of your own organization. No method of transmission or storage is 100% secure, but we take reasonable steps to protect your information.
8. Your Rights
You may request access to, export of, or deletion of your data at any time by contacting [support@yourdomain.com].
9. Children’s Privacy
The Service is not directed at children under 16, and we do not knowingly collect their data.
10. International Users
Your information may be processed in the United States or other countries where our sub-processors operate.
11. Changes to This Policy
We may update this Privacy Policy from time to time; we will update the date above when we do.
12. Contact
Questions about this Privacy Policy can be sent to [support@yourdomain.com].