Privacy policy
1. What we collect
Account info (name, email, organization name). Content you create (org profile, evidence, drafts, applications). Billing info via Stripe (we don't see card numbers). Usage logs (which API endpoints, how often, latency) for operational health.
2. What we don't collect
Your IP address is logged for security but not sold or shared with marketing partners. We don't track you across the web. We don't use analytics SDKs that fingerprint browsers.
3. Where data goes
Your data lives in our Postgres database in the United States (Render Oregon region today). The only external systems your content reaches:
- Anthropic — drafting prompts + retrieved evidence. Anthropic retains per their API policy; not used for model training under standard API terms.
- Voyage AI — text snippets for semantic embedding. Same retention posture.
- Stripe — billing data only (no application content).
4. Data retention
Active accounts: indefinite. Canceled accounts: 90 days then deletion. You can request immediate deletion at any time via account settings or by emailing us.
5. Data export
One-click export of everything you've created, in JSON + Word formats, anytime.
6. Cookies
We use one session cookie for login. No third-party tracking cookies. No advertising trackers.
7. Children
Grantifly isn't for users under 18. We don't knowingly collect data from minors.
8. California / EU
Residents of California or the EU can request data access, correction, or deletion. Email [email protected].
9. Changes
Material updates emailed to account owners 30 days before effect.