Privacy Policy

Last updated: March 2026 (v3)

CharityGrantWriter is built for small nonprofits. We collect only what's needed to match you with grants and generate proposals. This policy explains exactly what we collect, why, and your rights over your data.

1. Who We Are

CharityGrantWriter ("we", "us", or "our") is a smart grant discovery and proposal tool for nonprofits and charities. Our website is charitygrantwriter.com. For privacy questions, contact us at privacy@charitygrantwriter.com.

2. Information We Collect

Information you provide directly:

• Organization details: Your nonprofit's name, mission, focus area, budget range, and geographic location — entered during the intake process to match grants.
• Contact information: Your name and email address, used to deliver results and communicate about your grant matches.
• Grant proposal content: Mission statements, program descriptions, and impact data you enter when generating proposal drafts.
• Account credentials: Email and password if you create an account (passwords are stored hashed, never in plain text).
• Billing information: If you subscribe, payments are processed by Stripe. We receive a billing reference, your subscription plan, and billing cycle — we do not store your full card number, CVV, or bank details.
• Communication preferences: Whether you've opted in to grant deadline alerts and product updates.

Information collected automatically:

• Usage data: Pages visited, features used, and time spent — collected via server logs and analytics to improve the product.
• Technical data: Browser type, operating system, IP address, and referral source.
• Cookies: Session cookies (required for login), analytics cookies, and optional preference cookies. See Section 7 for details.

3. How We Use Your Data

• Matching your nonprofit profile against our grant database to surface relevant funding opportunities.
• Generating first-draft grant proposals tailored to your organization and the funder's requirements.
• Sending you results, grant deadline reminders, and product updates (you can unsubscribe at any time).
• Improving accuracy of grant matching and proposal generation through aggregated, anonymized analysis.
• Complying with legal obligations.

4. AI Processing Disclosure (GDPR Article 22)

Grant proposals are generated using AI technology. Specifically, we send relevant portions of your intake data (organisation mission, focus area, program descriptions, grant details) to Anthropic's Claude AI API to generate proposal drafts. Anthropic processes this data as a sub-processor on our behalf under a Data Processing Agreement (GDPR Article 28).

Before any AI-generated proposal is produced, we obtain your explicit consent via a checkbox disclosure (GDPR Article 22). You can withdraw this consent at any time by emailing privacy@charitygrantwriter.com; withdrawing consent means you will no longer be able to generate proposals.

What is sent to the AI: organisation mission statement, focus area, program descriptions, budget range, geographic region, and the specific grant requirements. What is NOT sent: your name, email address, or any other personally identifiable information.

AI training: Anthropic's API Terms of Service prohibit using API inputs to train their models. Data you submit through our API integration is not used to train Anthropic's models.

Limitation of AI outputs: AI-generated proposals are first drafts. They may contain inaccuracies. You are responsible for reviewing and verifying all content before submission to any funder.

5. Data Sharing & Sub-Processors (GDPR Article 28)

We share data only with the following trusted service providers who help us operate the platform. Each is bound by a Data Processing Agreement (DPA) where required by GDPR Article 28:

• Anthropic (US) — AI model API (Claude) for proposal generation. Receives: organization mission data, program descriptions, grant details. Does not receive: your name or email. Purpose: generating grant proposal drafts.
• Neon (US) — PostgreSQL database hosting. Receives: all data stored in our database (encrypted at rest). Purpose: data persistence.
• Render.com (US) — Application hosting and server infrastructure. Purpose: running our web application.
• Cloudflare R2 (US) — Media and file storage. Purpose: storing any uploaded files or generated documents.
• Postmark (US) — Transactional and marketing email delivery. Receives: your email address and name. Purpose: sending results, grant alerts, password resets, billing receipts.
• Stripe (US) — Payment processing for Pro subscriptions. Stripe handles all payment card data directly and is PCI-DSS compliant. We receive only subscription status and a billing reference — never your raw card details.
• Google Analytics (US) — Aggregated, anonymized usage analytics. Configured with IP anonymization. See Section 7 for cookie details.

We do not share your data with grant funders without your explicit consent. We do not sell your data. All US-based sub-processors handle EEA/UK data under Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA).

Current sub-processor list version: v3 (March 2026). We will notify you of material changes to this list.

5a. Subscription & Billing

When you subscribe to CharityGrantWriter Pro:

• Your payment is processed directly by Stripe. We do not see or store your card number, CVV, or bank account details — only Stripe does.
• We store: your subscription status (active/inactive), subscription plan, and the date your subscription started or renewed.
• Subscriptions auto-renew monthly unless you cancel before your renewal date. You'll receive an email reminder before renewal.
• To cancel, email support@charitygrantwriter.com. You retain Pro access until the end of your current billing period.
• Refund requests within 14 days of a charge are handled case-by-case. Email support@charitygrantwriter.com.

Stripe's privacy policy governs how Stripe processes your payment data: stripe.com/privacy.

5b. Email Communications & Consent (CASL / CAN-SPAM / GDPR)

We send two types of email:

• Transactional emails (always sent regardless of marketing preference): Grant match results, password reset links, subscription confirmations, billing receipts, and important account notices. These are exempt from unsubscribe requirements under CAN-SPAM and CASL as they are necessary to deliver the service.
• Marketing emails (only sent with your explicit consent): Grant deadline alerts, new grant opportunities matching your profile, and product updates. We collect express consent at signup via a clearly labelled, unchecked opt-in checkbox (compliant with CASL).

For Canadian users (CASL): We comply with Canada's Anti-Spam Legislation (CASL). Marketing emails are sent only to users who have provided express consent. We record the consent timestamp, method, and policy version for each user. Transactional emails (service notifications, billing) are sent under the implied consent provision of CASL for existing business relationships.

Unsubscribe: You can opt out of all marketing emails at any time by:

• Clicking the "Unsubscribe" link in any marketing email (processed immediately)
• Visiting your Email Preferences page
• Emailing privacy@charitygrantwriter.com

Unsubscribe requests are processed immediately. We maintain suppression records indefinitely to ensure you are not re-added without your consent.

We use Postmark to send emails. Your email address is shared with Postmark solely for delivery purposes. We do not send emails on behalf of third parties. All marketing emails include a physical mailing address as required by CAN-SPAM.

5c. Admin Data Access

In limited circumstances, authorized CharityGrantWriter staff ("admins") may access your account data to:

• Respond to support requests you initiate
• Investigate suspected fraud or abuse
• Comply with legal obligations
• Diagnose and fix technical issues

Admins can see: your email address, name, organization intake data, generated proposals, and subscription status. Admins cannot see your password (it's hashed) or your payment card details (held by Stripe). Admin access is logged and subject to internal access controls. We do not access your account for marketing profiling or data analysis beyond aggregate, anonymized analytics.

5d. Voice Data

CharityGrantWriter does not currently collect voice or audio data. We have no voice recording, speech-to-text, or audio capture features. If this changes, we will update this policy and notify you before any such feature is enabled.

6. Data Retention

• Account data (email, name, password hash): Retained while your account is active, plus 30 days after deletion request.
• Grant intake submissions: Retained for 12 months from last activity so you can revisit your matches and proposals. After 12 months, stale records are automatically deleted.
• Generated proposals: Retained for 12 months then automatically deleted, unless you download or export them first.
• Billing records (subscription status, Stripe reference): Retained for 7 years as required by financial regulations.
• Email consent records (CASL compliance): Retained indefinitely or until you request deletion. Consent timestamp, method, and version are stored per user. Suppression records (unsubscribes) are retained indefinitely to ensure you are not re-added without consent.
• Email unsubscribe records: Retained indefinitely to honour your preferences (as required by CAN-SPAM and CASL).
• Server logs and analytics: Retained for 90 days.

You can request early deletion of any of your data by emailing privacy@charitygrantwriter.com.

7. Cookies

We use three categories of cookies:

• Essential cookies: Required for login sessions and basic functionality. Cannot be disabled.
• Analytics cookies: Help us understand which features are useful. You can opt out via our cookie banner.
• Preference cookies: Remember your settings. Optional.

You can manage cookie preferences using the banner shown on your first visit, or by contacting us to reset your preferences.

8. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate data.
• Deletion ("right to be forgotten"): Request deletion of your personal data.
• Portability: Receive your data in a machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent for analytics or marketing at any time.

To exercise any right, email privacy@charitygrantwriter.com. We respond within 30 days.

9. CASL (Canadian Users)

If you are in Canada, CharityGrantWriter complies with Canada's Anti-Spam Legislation (CASL) (S.C. 2010, c. 23).

• Express consent required: We only send commercial/marketing emails to Canadian recipients who have provided express consent. Consent is collected via an unchecked opt-in checkbox at signup, clearly separate from our Terms of Service acceptance.
• Consent record: We record the timestamp, method, and policy version for every consent given. This is your proof of consent and our compliance record.
• Consent language: "I agree to receive grant deadline alerts and product updates from CharityGrantWriter. I can unsubscribe at any time."
• Transactional emails: Service notification emails (billing receipts, password resets, grant match results) are sent under the implied consent provision for existing business relationships, as permitted by CASL.
• Unsubscribe: Every marketing email includes an easy one-click unsubscribe link that is processed immediately. You can also manage preferences at email-preferences or email privacy@charitygrantwriter.com.
• Identification: All emails identify CharityGrantWriter as the sender with our contact information.
• Existing users: Users who signed up before this consent policy was implemented may receive a one-time re-consent email. If consent is not confirmed within 30 days, marketing emails will be suppressed.

Questions about CASL compliance? Email privacy@charitygrantwriter.com.

9a. GDPR (EEA & UK)

If you're accessing CharityGrantWriter from the EEA or UK, you have rights under the General Data Protection Regulation (GDPR) and, for UK users, the UK GDPR. Our legal bases for processing are:

• Contract performance: Processing your organization profile, generating proposals, and delivering grant matches — necessary to fulfill our service to you.
• Contract performance (billing): Processing subscription data and communicating with Stripe — necessary to manage your paid subscription.
• Legitimate interests: Analytics, product improvement, security monitoring, and admin support access — you can object to legitimate interest processing by emailing privacy@charitygrantwriter.com.
• Consent: Marketing emails (grant alerts, product updates) and optional analytics cookies. You can withdraw consent at any time without affecting lawfulness of prior processing.
• Legal obligation: Retaining billing records and responding to lawful data subject requests.

Data transfers outside the EEA/UK (e.g., to Anthropic, Render, Postmark, Stripe, Google — all US-based) are covered by Standard Contractual Clauses or the UK International Data Transfer Agreement as applicable.

You have the right to lodge a complaint with your local data protection authority: the ICO in the UK (ico.org.uk), or your national DPA in the EEA.

10. Children's Privacy

CharityGrantWriter is designed for nonprofit organizations and their staff. We do not knowingly collect data from individuals under 16.

11. Security

We protect your data with encryption at rest, TLS in transit, hashed passwords, and access controls. No system is 100% secure — please use a strong, unique password.

12. Changes to This Policy

We may update this policy as the product evolves. Material changes will be communicated by email and by updating the "Last updated" date above.

13. Contact

Questions or requests? Email privacy@charitygrantwriter.com. We aim to respond within 2 business days.

14. Delete Your Account & Data

You have the right to delete your account and all associated personal data at any time. To do this:

• Self-service: Log in and visit Account Settings → scroll to "Danger Zone" → click "Delete My Account & Data".
• By email: Email privacy@charitygrantwriter.com with the subject "Delete my account" and we will action it within 30 days.

Account deletion is permanent. All your organizations, grant matches, proposals, and personal data will be erased within 30 days of the deletion request. A confirmation email will be sent to you when your request is received.