Privacy Policy

• Account & profile data — your name, email address, organisation, and role.
• Content you upload — award letters and other documents, and the grant, obligation, financial, and reporting records you create. These may contain personal data about your staff, contacts, or funders.
• Usage & technical data — log data, device and browser information, and how you interact with the Service, used to operate and improve it.
• Billing data — subscription and payment information. Card details are handled by our payment processor (Stripe); we do not store full card numbers.

• to provide, maintain, and secure the Service, and to extract and organise information from your documents;
• to send service communications — reminders, invitations, verification, and account notices;
• to process payments and manage subscriptions;
• to provide support and to improve and develop the Service; and
• to comply with legal obligations and enforce our terms.

We rely on the following lawful bases under the UK GDPR:

• Performance of a contract — to provide the Service you have signed up for.
• Legitimate interests — to secure, support, and improve the Service, where not overridden by your rights.
• Legal obligation — to meet our legal and regulatory duties.
• Consent — where we ask for it (you can withdraw consent at any time).

To extract obligations and draft records, documents you upload are processed by a third-party AI provider (Anthropic) acting as our processor. Documents are sent for processing on your instruction and are not used to train third-party models under our arrangement. You should avoid uploading personal data that is not necessary for grant management.

We do not sell your personal data. We share it only with service providers who help us run the Service:

• our cloud hosting and database provider (infrastructure and storage);
• Anthropic (AI document processing);
• Stripe (payment processing);
• our email delivery provider (transactional emails); and
• professional advisers or authorities where required by law.

Each provider processes personal data under a contract that requires appropriate safeguards. We may also disclose data if required by law or to protect our rights.

Some of our providers are located outside the UK, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

We keep personal data for as long as your account is active and as needed to provide the Service, then for a reasonable period afterwards to meet legal, accounting, and dispute-resolution requirements. You can ask us to delete your data as described below.

We use technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and strict tenant isolation so one organisation can never access another’s data. No system is perfectly secure, but we work to protect your information and to respond promptly to any incident.

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to processing;
• data portability — receive your data in a portable format; and
• withdraw consent where processing is based on consent.

To exercise these rights, contact us at [email protected]. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

We use essential cookies needed to sign you in and keep the Service secure. We do not use any cookie for advertising, and we do not sell or share your data with advertisers. Your browser theme preference is stored locally in your browser.

We also use Google Analytics to understand which parts of the Service are used, so we know what to improve. Analytics cookies are off by default. Nothing is stored on your device for analytics until you choose “Accept” on the banner shown when you first sign in, and you can decline with equal prominence. If you decline, the Service works exactly the same.

What we send to Google is deliberately limited. Page addresses are stripped of record identifiers before they leave your browser — a visit to a specific grant is recorded as /grants/[id], never the real identifier — and query strings, which can contain search terms and filters, are removed entirely. We do not send your name, your email address, your organisation, or any content from your grants, documents, budgets or reports. Your IP address is anonymised.

You can change your mind at any time by clearing this site’s data in your browser, which resets the choice and shows the banner again.

The Service is intended for organisations and their staff, and is not directed to children under 18.

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you and will update the “last updated” date above.

For any privacy question or request, contact [email protected]. Our registered office is PO Box 4385, Cardiff, CF14 8LH, United Kingdom.