Privacy Policy

1. Scope

This Policy applies to: (a) visitors to our Site; (b) individuals who create a GrantCue account or are added by a customer organization as team members; (c) people who contact us (support/sales); and (d) users who sign in with, or connect, third-party accounts (e.g., Google or Microsoft) to the Service.

For organizational customers, GrantCue generally acts as a processor/service provider and processes personal information on the customer's instructions. The customer is the controller responsible for its own privacy notices and choices. Where we collect information for our own purposes (e.g., account, billing, security, Site analytics, marketing), we act as a controller.

2. Information We Collect

Information you provide

• Account details (name, email, password), profile, organization/team affiliation.
• Business contact and billing information.
• Content you upload or create in the Service (e.g., grant records, tasks, notes, files).
• Messages and support communications.
• If an admin cancels a paid plan or moves to the Free plan, the reason they choose from a short list and any details they type. Both are optional.

Information collected automatically

• Usage, device, and log data (browser type, pages viewed, timestamps, IP address, identifiers).
• Cookies and similar technologies for essential operations, analytics, and (if enabled) marketing.
• Approximate location derived from IP address (for security and regional settings).

Information from third parties

• If you sign in with or connect Google, Microsoft or another provider, we receive the minimum data needed to provide the requested feature (see Section 10).
• From service providers, partners, and your organization (e.g., your admin adding you to a workspace).

You may decline to provide information; however, some features may not work without it (e.g., authentication).

3. How We Use Personal Information

We use information to:

• Provide, secure, and maintain the Service (authentication, troubleshooting, quality).
• Set up organizations, projects, and collaboration features; manage permissions.
• Fulfill integrations you choose (e.g., Google Calendar, Google Drive and OneDrive).
• Analyze aggregate usage to improve features and performance.
• Understand why organizations cancel or downgrade, from the optional reason an admin gives. Only GrantCue staff read these answers; other members of the organization cannot see them.
• Communicate service updates, security alerts, and administrative messages.
• Comply with law and enforce terms; prevent fraud, abuse, or security incidents.

Legal bases (EEA/UK): contract, legitimate interests, consent (where required), and legal obligations.

4. Our Role: Controller vs. Processor

• Processor/service provider: For content you or your organization submit to workspaces, we process it under your organization's instructions and our data processing terms. Individuals should direct requests (access, deletion, etc.) to the organization where applicable.
• Controller: For our own operations (account, billing, support, product analytics, marketing), we are the controller and respond directly to requests.

5. Cookies & Online Signals

We use cookies and similar technologies for essential operations (login, security, load balancing); preferences (remembering settings); analytics (to understand feature usage); and advertising/retargeting (only if we enable these features — opt-out options provided).

Opt-out preference signals (Global Privacy Control). Where applicable, we honor recognized browser/device-level opt-out preference signals (e.g., GPC) as valid requests to opt out of sale/sharing for cross-context behavioral advertising under California law. See Section 9 for your rights.

You can manage cookie preferences in your browser or via our in-product controls (where available). Blocking certain cookies may limit functionality.

Microsoft Clarity

We use Microsoft Clarity on public informational pages, the account sign-up page, and selected signed-in pages including onboarding, Discover, Dashboard, funder tracking, saved grants, My grants, Tasks, and Applications to understand navigation through heatmaps, session replays, and aggregate interaction metrics. Sign-in, admin, billing, document, and application-writing pages are excluded. Before recording starts, we mask page text, form values, images, and other media and redact app search and filter values from recorded URLs. We associate signed-in activity using an opaque account identifier rather than your email or name. Staff, test, and positively identified automated activity is labelled separately for reporting.

Microsoft provides and operates Clarity and may collect and use information under its own privacy statement and terms, including through cookies and browser storage such as _clck and _clsk. Microsoft states that Clarity playback data is retained for 30 days, while labeled or favorited sessions and dashboard, click, and heatmap data may be retained for up to 9 months.

• Microsoft Privacy Statement
• Clarity Terms
• Clarity cookie list
• Clarity data retention

Sentry

We use Sentry to diagnose application errors and measure sampled application performance. Sentry may receive technical error, browser, device, route, and timing details. We filter sensitive request details before sending telemetry, and Sentry session replay is disabled.

6. How We Share Information

We do not sell personal information. We may disclose information to:

• Service providers/contractors (hosting, analytics, email, payments) bound by confidentiality and data protection terms;
• Your organization and its admins (for workspace oversight and user management);
• Anyone who has a client status report link your organization made, who can read the sections chosen for that link until it expires or is revoked (see Section 17);
• Legal/compliance recipients when required by law or to protect rights;
• Business transfers (e.g., merger, acquisition, or asset sale).

We may share de-identified or aggregated information that cannot reasonably be used to identify you.

7. Data Retention

We keep personal information only as long as necessary for the purposes described here and as required by law. Illustrative defaults (subject to your organization's settings and our backups):

• Account data: retained while the account is active, then deleted or de-identified within 30–90 days.
• Workspace content (tasks/files/notes): retained until you or your organization delete it or terminate the workspace.
• Audit/security logs: kept for security, troubleshooting and compliance. They do not yet have a fixed deletion schedule.
• Cancel and downgrade reasons: kept for 24 months, then deleted by a daily job.
• Client status report links: after a link expires or is revoked it shows nothing. An expired or revoked link and its snapshot are deleted 30 days after it expires or is revoked.
• Backups: a daily backup of the database, with the last 7 kept (disaster recovery only). Point-in-time recovery is not enabled.

8. International Data Transfers

If we transfer personal data internationally (e.g., from the EEA/UK to the U.S.), we use appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and, in the UK, the IDTA/Addendum, plus supplementary measures where appropriate.

9. Your Privacy Rights

(A) California & other U.S. state rights

Depending on where you live, you may have rights to access/know, correct, delete, port, opt out of sale/sharing and targeted advertising, and to non-discrimination. We provide required notices at or before collection and offer opt-out mechanisms as applicable — including honoring GPC.

(B) EEA/UK rights under GDPR

You may have rights to access, rectify, erase, restrict, object, data portability, and to withdraw consent at any time. If we process your information on behalf of a customer, we will refer your request to that customer when required.

How to exercise your rights

• Submit a request via: privacy@grantcue.com
• We'll verify your identity and respond within the applicable timeframe.

10. Google and Microsoft Sign-In and Connected Services

You can sign in to GrantCue with a Google or Microsoft account, and an organization can connect Google Calendar, Google Drive and Microsoft OneDrive. Each is optional, and each asks for your permission on Google's or Microsoft's own screen first. This section says what each one lets GrantCue see and do.

Signing in with Google

If you choose "Continue with Google", Google shares your name, email address and profile picture with us (the openid, email and profile permissions). We use them only to create your account and sign you in, and we get no other Google data this way.

Signing in with Microsoft

If you choose "Continue with Microsoft", Microsoft shares your name, email address and the ID of your Microsoft account with us (the openid, email and profile permissions). It works with work or school accounts from any organization. We use this information only to create your account and sign you in, and we get no other Microsoft data this way.

Google Calendar

An organization admin can connect Google Calendar for the whole organization. GrantCue asks for one permission, to manage events on the calendars the connected Google account owns (calendar.events.owned), and uses it only to add, update and delete the events it creates for grant deadlines, on the main calendar of the Google account the admin connected.

For each saved grant with a close date, a letter of intent deadline or an internal deadline (the admin chooses which kinds), GrantCue adds an all-day event with the grant's title, its agency or funder, up to 2,000 characters of its description, and a link back to the grant in GrantCue. It keeps the ID of each event it created, so it can update the event when the deadline changes and delete it when the deadline or the grant is removed. GrantCue does not read, change or delete any other event, and it does not read your list of calendars or your free/busy information.

Google Drive

An organization admin can connect Google Drive for the whole organization. GrantCue asks for one Drive permission, drive.file, which lets it open only the files that someone picks for it. GrantCue cannot see the rest of the Drive.

Members whose role lets them add documents can then use the Drive picker on the Documents page. The picker is Google's own window, opened with the organization's connection, so it shows the Drive of the Google account the admin connected. For each file picked, GrantCue reads the file's name, type, size and Drive link, and saves them as a document in GrantCue that opens the file in Google Drive. GrantCue never downloads, reads or copies the file's contents. Who can open the file is still decided by its sharing settings in Google Drive.

Microsoft OneDrive

OneDrive is connected once for the whole organization, with one Microsoft account. GrantCue asks Microsoft for three permissions: Files.Read.All (to read the files that account can reach), User.Read (to read the account's basic profile) and offline_access (to stay connected without asking again). When it connects, GrantCue saves the account's name, email address and Microsoft user ID, and the ID and type of its OneDrive, so the organization can see which account is connected.

Members whose role lets them add documents can then browse and search that OneDrive from the Documents page, where GrantCue shows each item's name, size, type, dates and the names of the people who created and last changed it, as OneDrive reports them. Importing a file does not copy it into GrantCue: GrantCue saves the file's name, type, size, OneDrive link and last-changed details as a document that opens the file in OneDrive, along with the temporary download link OneDrive returns, which stops working after about an hour. GrantCue never reads the file's contents, and it never creates, changes or deletes anything in OneDrive.

How we keep the connection

Google and Microsoft give GrantCue access and refresh tokens for each connection. We encrypt them with AES-256 before we store them, and only our servers use them. When a member opens the Drive picker, our server gives that browser a short-lived access token for the picker only, never the refresh token. Only organization admins can disconnect a service.

Disconnecting

An admin can disconnect Google Calendar on the Calendar page or in Settings, Integrations, and Google Drive or OneDrive in Settings, Integrations. Disconnecting deletes the stored tokens from GrantCue at once. Events GrantCue already added stay in the calendar, and documents linked from Drive or OneDrive stay in GrantCue as links until someone deletes them.

When an admin disconnects Google Calendar or Google Drive and no other GrantCue connection uses the same Google account, GrantCue also asks Google to withdraw the access that account gave it, so GrantCue leaves that Google Account's third-party connections. Google keeps one grant per app, so this also withdraws that account's permission to sign in to GrantCue with Google: the next time it continues with Google, Google asks to agree again. Disconnecting OneDrive does not remove GrantCue from the Microsoft account. To do that too, remove GrantCue from the apps that Microsoft account has given access to; for a work or school account, the organization's IT administrator can also remove it. If you remove GrantCue's sign-in access in your Google or Microsoft account, sign in with your email address instead.

• Google Account: third-party apps and services
• Microsoft personal account: apps and services you've given access
• Microsoft work or school account: My Apps

Limited Use of Google data

GrantCue's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will also adhere to the Google Workspace user data and developer policy, including its Limited Use requirements. In practice:

• We use Google data only to provide the features described above, which you can see and use in GrantCue.
• We do not sell it, use it for advertising, or use it to decide anyone's credit or lending.
• We do not use it to create, train or improve any AI or machine-learning model.
• We do not transfer it to anyone else, except as needed to run those features, for security, to comply with the law, or, with your consent, as part of a merger or sale of GrantCue.
• People at GrantCue do not read it, unless you ask us to (for example in a support request), it is needed for security, or the law requires it.
• We treat the data we receive from Microsoft the same way.

• Google API Services User Data Policy
• Google Workspace user data and developer policy

11. Security

We implement administrative, technical, and physical safeguards designed to protect personal information (including encryption in transit, role-based access, logging, and routine backups). No method of transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your password and for any activity in your account.

12. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal information, we will take steps to delete it. Parents may contact us at privacy@grantcue.com.

13. How to Contact Us

• Email: privacy@grantcue.com
• You also have the right to lodge a complaint with your local supervisory authority (EEA/UK).

14. Changes to This Policy

We may update this Policy to reflect changes to our practices, technologies, or legal requirements. We will post the updated Policy with a new effective date and, where required, provide additional notice.

15. State-Specific Disclosures

Residents of California (CPRA), Colorado, Connecticut, Utah, Virginia, and other states with comprehensive privacy laws may have state-specific rights and definitions (e.g., "sale," "sharing," "targeted advertising"). We provide required notices at or before collection and honor recognized opt-out preference signals (e.g., GPC) where applicable.

16. The GrantCue Connector for Claude and ChatGPT

GrantCue runs a public connector, an MCP server at https://www.grantcue.com/api/v1/mcp, that lets AI apps such as Claude and ChatGPT search GrantCue's public grant listings and public foundation profiles. It needs no GrantCue account and no sign-in, and nothing it receives is linked to an account.

What the connector receives

• The request the AI app sends: which of the connector's four search and lookup tools to use, and the details the app chose, such as search words, filters, a grant ID or a foundation's EIN. The AI app decides what to send from your conversation. The connector does not receive the conversation itself.
• The IP address the request comes from. For Claude and ChatGPT this is normally the AI provider's server, not your own device.
• It does not read cookies or sign-in headers, and it never asks for a name, an email address or any other account detail.

What the connector returns

Only what GrantCue's public pages show anyone: open grant listings, and public foundation profiles built from IRS filings. A profile can include the recipients a foundation's filings report and the application contact (name, address, phone or email) the foundation published in its own filing. The connector never returns anything from a GrantCue account, organization or My grants, and it cannot create, change or delete anything.

What we log

• Each tool call writes one line to our server logs: the tool used, whether it worked, a count of results (for example "10 of 41 grants") and a random request ID. The search words and other details of the request are not written to that line.
• To apply the per-minute limits, the connector counts requests by IP address. It stores a keyed one-way hash of the address with the times of its recent requests, not the address itself.
• If a request fails because of an error on our side, the error is reported to Sentry with the tool name and the request ID. Request bodies are not attached (see Section 5).
• Other log data is handled as described in Sections 2 and 7.

Your AI app

Your conversation with Claude, ChatGPT or another AI app is handled by that app’s provider under its own privacy policy. Questions about the connector and your privacy: privacy@grantcue.com. Help with setting it up: support@grantcue.com.

• Set up the GrantCue connector in Claude
• Set up the GrantCue connector in ChatGPT

17. Client Status Report Links

An organization admin, or another member whose role allows creating reports, can make a link to the organization's status report, for example to send to a client. They choose which sections of the report the link shows and when it expires: after 7, 30 or 90 days.

What a link shows

• A snapshot: the chosen sections as they were when the link was made. Later changes never appear, and nothing outside those sections is included.
• Depending on the sections chosen, the snapshot holds the organization's name and logo, grant titles, funders, amounts, deadlines and stages, counts of open and overdue tasks, and recent changes to grants. It does not include notes, task names or the names of team members.
• Anyone who has the link can read the snapshot without signing in, until the link expires or someone in the organization revokes it. Send it only to people who should see the report.

What we store and log

• The link itself is shown once, when it is made. We store a SHA-256 hash of its secret part, not the link, so the link cannot be rebuilt from our database.
• With the hash we store the organization, the person who made the link, the chosen sections, the snapshot, the dates it was made and expires, a count of views and the time of the last view. We do not record who opened a link.
• Making and revoking a link are recorded in our audit log with the IP address and browser of the person who did it.
• To limit how often a link can be opened, we count requests by a one-way hash of the IP address they come from. The report page asks search engines not to index it and tells the browser not to send its address to other sites.
• An expired or revoked link shows only a notice that it is no longer available. An expired or revoked link and its snapshot are deleted 30 days after it expires or is revoked.

Appendix A: Data Sub-processors

• Hosting/Infrastructure: Vercel (including Vercel Web Analytics and Speed Insights, which measure page views and page speed), Supabase
• Email/Support: Resend (transactional email), PurelyMail (mailbox hosting)
• Analytics and diagnostics: Google Analytics 4, Microsoft Clarity, Sentry
• Payments: Stripe
• AI Processing: Anthropic (Claude models for proposal drafting and editing, summaries, scoring and recommendations, and extracting details from documents you choose to analyze)
• Text Embeddings: OpenAI (turns grant listings and organization profiles into text embeddings used for grant matching and recommendations; an AI feature that GrantCue sets to an OpenAI model instead of a Claude model sends OpenAI the text it would otherwise send to Anthropic)
• Malware Checks: VirusTotal (for files you upload, we send only a fingerprint, a SHA-256 hash, to look the file up in VirusTotal's records; the files themselves are not uploaded. PDFs submitted for public posting on GrantCue are uploaded to VirusTotal for a full malware scan.)
• Bot Checks: Cloudflare Turnstile, on the sign-up and sign-in forms when the check is turned on (it receives the browser and connection details its challenge reads, and returns a pass token that Supabase checks)
• Password Checks: Have I Been Pwned's Pwned Passwords service (when you choose a new password, your browser sends only the first five characters of a SHA-1 hash of it, never the password, to warn you if it appears in known data breaches)
• Sign-in and Connected Services: Google and Microsoft, for sign-in and for Google Calendar, Google Drive and OneDrive when an organization connects them (see Section 10)
• Team Notifications: Slack and Microsoft Teams, when an organization connects them (grant titles, funders and deadlines, task titles, the names of the people tasks are assigned to, alert names and links back to GrantCue)
• Read-only Imports: Intuit QuickBooks Online, Salesforce, Blackbaud Raiser's Edge NXT and Virtuous, when an organization connects them (GrantCue reads records from these services and sends them only the requests and credentials needed to read them; nothing is written back)

This list is maintained and updated regularly to reflect our current service providers.