Privacy Policy
Version 2026-10-03 · Previous version
Effective October 3, 2026 for accounts created on or after that date. For existing accounts, effective 30 days after we notify you by email.
What changed in this version
- A table of every type of service provider we use, what each does and what it receives, and a list of the specific providers on request (Section 4).
- New sections on artificial intelligence (Section 5), usage information (Section 6) and Teams (Section 7).
- We honor Global Privacy Control as an opt-out of marketing cookies and advertising measurement (Section 8.1).
- A breach-notification commitment and a security contact (Section 10).
- Material changes are now emailed at least 30 days ahead, instead of taking effect when you keep using the Service (Section 14).
- A full mailing address (Section 15).
1. Introduction#
This Privacy Policy explains how GrantEater.ai LLC ("GrantEater.ai," "we," "us," or "our") collects, uses, shares and protects personal information when you use the GrantEater.ai website and services (the "Service"), and the choices you have. GrantEater.ai LLC is based in Portland, Oregon, USA.
We offer access, correction, deletion and export to every user, wherever they live. Terms such as Workspace, Owner, Admin, Member and Content have the meanings given in our Terms of Service.
2. Information we collect#
- Account information: your name, email address and password, and the information about your organization you give us during onboarding.
- Payment information: when you subscribe or make a purchase, your payment details are collected and held by our payment processor. We keep limited details such as the last four digits of your card, its type and expiry, and your transaction history.
- Content: what you put into the Service, such as grant drafts, letters of inquiry, reports, notes and uploaded documents, and what the Service generates for you. If your Content includes personal information about other people, such as project staff, it is stored as part of your Content.
- Communications: messages you send us, for example to [email protected], or through the feedback and bug-report forms.
- Device and usage data: your IP address, browser and device type, and how you use the Service (pages visited, features used, times), collected automatically, including through cookies (see Section 8).
- Error logs: technical details recorded when something goes wrong. Our logs record an internal account identifier rather than your email address, and never the text of your Content.
We do not ask for sensitive personal data such as Social Security numbers, health information or government identifiers. Please do not enter them unless your work truly requires it.
3. How we use information#
- To provide the Service: to run your account, keep your work, and generate drafts and summaries from your Content.
- To process payments: to bill your subscription and purchases and keep the records tax law requires.
- To communicate with you: account and billing emails (for example, receipts, trial reminders and important changes), support replies, and, only if you subscribe, our newsletter, which you can leave at any time with its unsubscribe link.
- To keep the Service safe and working: to prevent abuse, enforce usage limits, and diagnose and fix problems.
For people in the European Economic Area and the United Kingdom, we rely on these legal bases: performing our contract with you; our legitimate interests in running, securing and improving the Service; complying with the law; and, where we ask for it, your consent.
4. Service providers#
We do not sell or rent personal information. We share it only with the providers below, who process it on our behalf to run the Service, and as required by law or in a business transfer such as a merger (in which case this Policy continues to apply to your information).
| Type of provider | Purpose | Data shared |
|---|---|---|
| Artificial intelligence provider | Generating drafts and summaries, and searching your documents | The content of each request. Under terms that prohibit using it to train models and keep it for at most 30 days for abuse monitoring. |
| Payment processor | Subscriptions and purchases | Name, email and billing address. Card details are held by the processor; we never store full card numbers. |
| Cloud hosting, database and storage providers | Running the Service, storing your account, your Content and the files you upload, and delivering and protecting our website | Account data, Content, uploaded files, and the IP address and request details of each visit. Encrypted in transit. |
| Email delivery providers | Account, billing, security and team emails; the newsletter and product updates, only if you subscribe | Name, email address and the content of the email. |
| Support and feedback tools | Handling the bug reports and feedback you send us | What you write and attach, plus your name, email address, IP address, browser and the page you were on. |
| Analytics and advertising-measurement tools | Understanding how the Service is used, and measuring sign-ups that came from our ads | Usage events and device data linked to a pseudonymous identifier. Full analytics and ads measurement only with your consent (see Section 8). We do not send your email address. |
We use Google Analytics and Google Ads conversion measurement, only as described in Section 8. To learn how Google uses this information, see How Google uses information from sites or apps that use our services.
We can provide a list of the specific service providers that process your personal data on request at [email protected].
5. Artificial intelligence#
When you use drafting features, the relevant parts of your Content are sent to our artificial intelligence provider to generate a response. Its terms prohibit using this data to train its models and let it keep the data for at most 30 days to detect abuse, after which it is deleted unless the law requires otherwise. GrantEater.ai does not use your Content to train models.
Please avoid entering identifying details about the people your organization serves, such as client names or case information, unless your draft truly requires them.
6. Usage information#
We record how much artificial intelligence processing each request uses, along with the time and the feature used, to show your usage, enforce limits and process purchases. We keep these records while your account is active and for up to 24 months after, for billing and tax purposes.
7. Teams#
If you join a Workspace, its Owner and Admins can see your name, email address and role. Members can see the Workspace’s Content according to their role. Content you create in a Workspace stays with that Workspace if you leave it.
8. Cookies, analytics and advertising#
- Essential: keep you signed in, remember your choices, and protect the site and payments from bots and fraud (some are set by our network and payment providers). Always on.
- Analytics: help us understand how the Service is used (Google Analytics). Only with your consent.
- Marketing: let us measure sign-ups that came from our ads (Google Ads). Only with your consent.
You can change your choices at any time from the cookie banner or your browser settings. Until you consent, Google tools receive only cookieless, consent-denied signals.
8.1 Global Privacy Control#
If your browser sends a Global Privacy Control signal, we treat it as an opt-out of marketing cookies and advertising measurement, whatever the cookie banner says.
9. How long we keep information#
| Data | How long we keep it | What happens then | Why |
|---|---|---|---|
| Account profile: your name, email address and organization details | While your account exists | Deleted 14 days after you ask us to delete your account, or right away if you choose | To run your account |
| Your work: applications, letters of inquiry, reports, notes, drafts and uploaded files | While your account exists, including after you cancel | Deleted 14 days after you ask us to delete your account, or right away if you choose | So your work is there when you come back |
| Usage records: how much artificial intelligence drafting each request used, and when | While your account exists | Deleted 14 days after you ask us to delete your account, or right away if you choose | To show your usage and apply your monthly allowance |
| Billing records: invoice number, amount, date, billing name and address, and tax ID. Never your work. | For the period tax law requires where you are billed | A minimized copy is kept after your account is deleted, then deleted when that period ends | Tax and accounting law |
| Consent records: when you accepted the Terms and Privacy Policy, and your cookie choices | Acceptance: while your account exists. Cookie choices: 12 months, in your browser | Deleted with your account; the cookie expires on its own | To show what you agreed to |
| Server logs: technical request details. Never your work or your email address. | Briefly, by our hosting provider, for troubleshooting | Overwritten by the hosting provider | To keep the Service running and secure |
| Bug reports and feedback you send us | While your account exists | Deleted with your account. Copies in our support tool are deleted on request. | To fix problems and improve the Service |
| Newsletter and product updates (only if you subscribed) | Until you unsubscribe | Removed from the list | To send what you asked for |
| Data exports you request (Settings, Download your data) | 24 hours | Deleted automatically; the download link stops working | So you can download a copy of your data |
| Records of privacy requests: the type of request and the dates. Never what you wrote. | 3 years | Deleted automatically | To show we answered requests on time |
| Database backups | 7 days, on a rolling basis | Overwritten by newer backups. A deleted account is never brought back from a backup. | To recover from failures |
Cancelling your subscription does not delete anything. You can download your data or delete your account at any time in Settings. We may keep specific data longer when the law requires it.
10. Security#
We protect information with encryption in transit, access controls that keep each Workspace’s data separate, and logging. No system is perfectly secure, so we cannot guarantee absolute security.
If a breach affects your personal information, we will notify you and any authorities as the law requires, without undue delay, and tell you what happened and what we are doing about it.
To report a security problem, email [email protected] with "Security" in the subject line.
11. Your rights and choices#
We offer access, correction, deletion and export to every user, wherever they live. You can also object to or ask us to limit certain processing, and withdraw consent where we rely on it.
In the app: update your profile in My Profile; download a copy of your data in Settings, under Download your data (a ZIP of your records and uploaded files, emailed as a link that works for 24 hours, once a day); and delete your account in Settings, under Delete your account (after 14 days, or right away). For anything else, or if you cannot sign in, email [email protected] with "Privacy request" in the subject line. We confirm the request comes from the account holder and answer within 30 days.
12. Where information is processed#
The Service is operated from the United States. If you use it from elsewhere, your information is transferred to and processed in the United States and other countries where our providers operate, with safeguards in line with this Policy and applicable law.
13. Children#
The Service is for adults (18+). We do not knowingly collect information from anyone under 18; if we learn we have, we delete it.
14. Changes to this Policy#
We will email you at least 30 days before any material change takes effect, with a summary of what changed, and post the new version here with its effective date. Earlier versions stay available, for example the April 26, 2025 version.
15. Contact#
Questions or requests: [email protected]. Security reports: [email protected] (subject "Security"). Our mailing address is:
GrantEater.ai LLC455 Market St Ste 1940PMB 721955San Francisco, California 94105-2448United StatesGrantEater.ai LLC is based in Portland, Oregon; the address above is a mailing address.