Privacy Policy

1. Who is responsible for your data

[LEGAL ENTITY NAME], [REGISTERED ADDRESS], is the controller for personal data processed through GrantTeam. For privacy questions or to exercise your rights, contact [CONTACT EMAIL].

2. What we collect

• Account data: first and last name, email address, country, optional job title, newsletter preference. Passwords are stored hashed by our authentication provider — we never see them.
• Organisation data: everything you enter in your organisation profile, including description, thematic areas, programme experience, reference projects and legal identifiers such as registration number, VAT, PIC or OID.
• Marketplace activity: partner requests you publish, applications you send or receive, coordinator notes, shortlisting decisions and status changes.
• Messages: the content of conversations tied to an application, and read status.
• Verification documents: files you upload to prove your organisation's identity or track record.
• Technical and usage data: pages visited, actions taken, approximate location derived from IP, browser and device information, and error diagnostics.

3. Why we process it, and on what basis

• To provide the service you signed up for — performance of our contract with you.
• To verify organisations and prevent fraud, spam and scraping — our legitimate interest in a trustworthy marketplace.
• To send transactional email such as email confirmation, password reset, application and message notifications — performance of our contract.
• To send the newsletter and product updates — your consent, withdrawable at any time.
• To measure product usage and diagnose errors — our legitimate interest, or your consent where required for non-essential cookies.
• To meet legal, accounting and tax obligations — legal obligation.

4. Who can see what

Visibility is deliberately layered. Publishing an organisation profile does not publish everything in it.

• Public: your organisation name, country, city, type, short and long description, website, logo, working languages, availability and verification level.
• Registered users: partner requests set to 'registered only', and profile detail that requires an account.
• Only you and your organisation members: private profile notes, capacity detail and draft content.
• Only participants in an application: the application itself, its messages and its attachments. Coordinator notes are visible only to the coordinating organisation.
• Only administrators with a verification role: uploaded verification documents, and only through short-lived signed links.

Contact details are exchanged after an application is accepted or both sides agree to an introduction — not by browsing the directory.

5. Service providers we use

We use a small number of processors to run the platform. Each is bound by a data processing agreement and only processes data on our instructions.

• Supabase — database, authentication and file storage.
• Vercel — application hosting and delivery.
• Resend — transactional email delivery.
• PostHog — product analytics, where enabled.
• Sentry — error monitoring, where enabled.
• A payment provider will be added before paid plans go live, and named here at that point.

6. International transfers

Some providers listed above may process data outside the European Economic Area. Where that happens we rely on an adequacy decision or on Standard Contractual Clauses together with the provider's supplementary safeguards.

7. How long we keep it

• Account and organisation data: while your account is active, and for a limited period afterwards so that ongoing applications and obligations can be resolved.
• Applications and messages: kept while relevant to the organisations involved, because both sides have an interest in the record.
• Verification documents: kept only as long as needed to support the verification decision, then deleted.
• Billing records: kept for the period required by accounting and tax law.
• Analytics and error data: kept in aggregated or short-retention form.

8. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or transfer it elsewhere. You can withdraw consent for the newsletter or analytics at any time without affecting the rest of the service.

Write to [CONTACT EMAIL] and we will respond within one month. If you are not satisfied, you may complain to your local data protection authority.

Note that deleting your organisation may affect records that other organisations legitimately rely on, such as an application they received. Where that applies we will explain what can be deleted and what must be retained.

9. How we protect it

• Every database table with private data is protected by row-level security, enforced by the database itself rather than only by the application.
• Verification documents live in private storage and are reachable only through short-lived signed links.
• All traffic is served over HTTPS. Data is encrypted at rest by our infrastructure providers.
• Administrative access to user records is limited by role and recorded in an audit log.

10. Children

GrantTeam is not intended for anyone under 18 and we do not knowingly collect their data.

11. Changes

We will update this policy as the platform grows. The version and date at the top of this page always reflect the current text, and we will notify you of material changes.