Privacy Policy

1. Information We Collect

We collect information you provide directly to us when you create an account, including your name, email address, and organization name. We also collect the content you store in your Grant Shifter account (content library sections, grant templates, and application responses) in order to provide our service.

We automatically collect certain technical information when you use our service, including IP address, browser type, pages visited, and usage patterns. This helps us improve Grant Shifter and diagnose issues.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Grant Shifter service
• Process your grant application content using AI (Anthropic Claude API)
• Send transactional emails such as password resets and team invitations
• Process subscription payments via Stripe
• Respond to support requests
• Monitor usage to enforce plan limits

3. AI Processing

Grant Shifter uses Anthropic's Claude models to power its AI features: matching and scoring grants against your organization, drafting and refining application answers, AI chat, extracting questions from funder templates, building your organization profile from uploaded documents, compliance checks, reviewer simulation, and specialized drafting tools (SR&ED, letters of intent, budgets).

When you use these features, the relevant content is sent from our servers to Anthropic for processing in the United States. Depending on the feature, this can include your organization profile, content library text, text extracted from documents you upload, grant question text, and your chat messages. Your data at rest remains in our Canadian database. Anthropic's use of this data is governed by their commercial terms; we do not use your content to train AI models. All AI calls are made server-side, and outputs are presented to you for review and editing. See How Grant Shifter Uses AI for a plain-language explanation.

4. Data Sharing

We do not sell your personal information. We share your data only with the third-party service providers necessary to operate Grant Shifter:

• Supabase — database hosting (Canada region)
• Anthropic — AI processing of organization and application content (United States)
• Stripe — subscription billing and payment processing
• Resend — transactional email delivery
• Vercel — application hosting and deployment
• PostHog — product analytics (usage patterns, not application content)
• Sentry — error monitoring and diagnostics

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal information and organization data within 30 days, except where we are required to retain it for legal or financial record-keeping purposes.

6. Security

We protect your data using industry-standard practices: passwords are hashed using bcrypt, sessions are managed with signed JWT tokens stored in secure httpOnly cookies, and all data in transit is encrypted using TLS. Access to your organization's data is restricted to authenticated members of your organization.

7. Your Rights

You may request a copy of your personal data, ask us to correct inaccurate data, or request deletion of your account and associated data at any time by contacting us at the email below.

8. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or by posting a notice in the app. Continued use of Grant Shifter after changes take effect constitutes your acceptance of the updated policy.

9. Contact

Questions about this privacy policy? Contact us at privacy@grantshifter.com