GrantCorral Privacy Policy
Last updated: November 14, 2026
GrantCorral ("GrantCorral", "we", "us") is a software business based in Ontario, Canada, operating the service at grantcorral.com. This policy explains what we collect, why, and your choices. Contact: grantcorral.support@gmail.com.
What we collect
- Account data: your name, email, business name, and a password hash. We never store your password itself.
- Workspace content: client profiles, uploaded documents (PDF/DOCX text), budgets, pipelines and drafts that you or your teammates add.
- Founding-member applications: if you apply on our founding-member page, we store your name, email and answers to the application questions, and when you gave consent. We use them only to review your application and contact you about it and the beta. We delete applications that don't become accounts 12 months after the founding program closes, or sooner if you ask.
- Beta waitlist: if you join the beta list on our home page, we store your email and, if you give them, your role and number of clients. We use these only to contact you about GrantCorral, and every email lets you unsubscribe. Unsubscribing removes you from the list.
- Billing data: plan, billing status, and Stripe customer and subscription IDs. Card details go directly to Stripe and never reach us.
- Technical data:
- a session cookie that keeps you signed in;
- IP address and browser user agent, stored with sessions and used for rate limiting and security;
- server logs;
- AI usage records (token counts and cost per draft).
We do not use advertising or analytics trackers.
How we use it
We use your data to:
- provide the service;
- secure accounts (sign-in, password reset, rate limiting);
- bill you;
- send service emails (email confirmation, password resets, team invites, and digests you turn on);
- answer support requests.
We do not sell your personal information, and we do not train AI models on your content ourselves. See "AI drafts" below for how our AI provider handles content.
Service providers (subprocessors)
| Provider | Purpose | Data |
|---|---|---|
| Fly.io (servers in the United States) | Hosting, database storage and backups | All data stored by the app |
| Stripe | Payments, invoices, billing portal | Email, billing details, card (held by Stripe) |
| Google (Gemini API; paid tier) | Generating drafts when you request one | The client profile, grant history, funder facts, your instructions, and the full text of documents included in that draft (see “AI drafts” below) |
| Resend (once service emails are switched on) | Sending service emails | Email address, email content |
AI drafts
When you ask for an AI draft, we send Google's Gemini API your instructions, the client's profile and grant history, relevant funder facts (from public IRS 990-PF filings or Grants.gov), and the full text of the documents included in that request. For letters and applications, you choose which documents and library blocks to include (they start selected). For a report draft, we also send the award budget and milestones, and we automatically include the award's documents plus the client's profile and program documents. We use Google's paid Gemini API. Under Google's terms for paid services, Google does not use your prompts (including files you send) or generated responses to improve its products, and processes them under its Data Processing Addendum. Google still logs prompts and responses for a limited period, solely to detect and prevent misuse and for any required legal or regulatory disclosures. Even so, don't put confidential information you don't need in the draft, such as tax IDs, bank details or personal data about the people a client serves, into documents or profiles you draft from. You can always write without AI: nothing is sent to Google unless you click a draft button.
Where data is stored
Our Fly.io servers, and the daily backups kept on the same volume as the database, are in the United States. Encrypted daily off-site copies are stored on a separate machine from that volume. Our providers may process data in other countries. That data is then subject to the laws of those countries, and authorities there may be able to access it.
Public data
Funder information comes from public IRS Form 990-PF filings and the IRS Exempt Organizations Business Master File. Federal opportunities come from the public Grants.gov API. These are public records about organizations.
Retention
- We keep account and workspace data while your account is open.
- After you close your account, we delete workspace content within 30 days, and it ages out of our backups within 35 more days.
- We keep billing records as long as tax law requires.
- Expired sessions and reset links are deleted automatically.
Security
- Passwords are hashed with scrypt.
- Sessions are signed, HTTP-only cookies, and only a hash of each session token is stored on our side.
- Connections use HTTPS. The app writes a daily consistent backup of the customer database on the same volume as the database, and we also keep an encrypted daily copy on a separate machine for 30 days.
- Each workspace's data is isolated from other workspaces.
- Sign-in and reset requests are rate-limited.
Your rights
You can export your workspace data yourself at any time (Plan & billing → Export your data, or "Export client data" on any client). You can also access, correct, export or delete your data by emailing grantcorral.support@gmail.com. Depending on where you live, you may have further rights, for example under PIPEDA in Canada, GDPR in the EU/UK, or the CCPA in California. These include the right to complain to your data-protection authority (in Canada, the Office of the Privacy Commissioner of Canada). We'll respond within 30 days.
Teams
If a workspace owner invites you, the owner can see the content you add to that workspace.
Changes
If we change this policy in a material way, we'll email account holders before the change takes effect and update the date above.