Privacy Policy

This is a draft. Replace with text reviewed by your own counsel before launch. The structure below covers what Google OAuth verification, Stripe production graduation, and most data-privacy regulators expect.

1. What we collect

• Account data — name, email, username, password hash, profile picture (if you sign in with Google).
• Work data — non-profit client profiles, funder records, RFP documents you upload, proposal drafts, and exports you generate.
• Usage data — page views, feature usage, errors, IP address, and approximate location for security and product improvement.
• Billing data — handled by Stripe; we store only the subscription ID, plan tier, and billing email. We never see card numbers.

2. How we use it

• To run the service — render your dashboard, draft proposals with AI, send notifications, accept payments.
• To improve the product — anonymous aggregate analytics, error tracking, and (if you opt in) feedback on AI output quality.
• To communicate — transactional emails (verification, password reset, deadline reminders) and optionally product news you can opt out of.

3. Who we share it with

• AI provider (Anthropic) — the text content of your draft sections + relevant client/RFP context is sent to Anthropic to generate drafts. Anthropic does not train on this data per their commercial terms.
• Stripe — billing only.
• Google — if you sign in with Google, your basic profile (name, email, picture).
• Email provider — to deliver transactional email.
• We do not sell your data to anyone, ever.

4. How long we keep it

For as long as your account is active. If you delete your account, we remove your data within 30 days, except logs we are required to retain for security or accounting purposes (max 13 months).

5. Your rights

You can export every proposal as DOCX or PDF at any time. To request data export, correction, or deletion outside the app, email privacy@grantwriter.app.

6. Security

Data is encrypted in transit (HTTPS). Passwords are hashed with bcrypt. Each consultant account is isolated — you cannot see another consultant's clients, funders, RFPs, or proposals.

7. Children

GrantWriter is intended for professional grant consultants over the age of 18. We do not knowingly collect data from anyone under 13.

8. Changes

We'll notify you by email at least 14 days before any material change to this policy.

9. Contact

Privacy questions: privacy@grantwriter.app