Privacy policy

GrantFlex helps organizations organize documents, research funding opportunities, prepare applications, and manage grant work. This policy explains the information we process, why we process it, and the choices available to you.

GrantFlex is operated by GrantFlex, LLC, at 8 The Green, Suite #8218, Dover, DE 19901. For privacy questions and requests, email contact@grantflex.com. Effective date: October 29, 2026.

Contact us about privacy

We process account and membership details, organization information, public links, funding priorities, uploaded documents, applications, tasks, reports, preferences, and support requests. Authorized AI processing can create extracted text, searchable representations, summaries, organization facts, reports, and citations.

We also process connection and device information, activity dates, event identifiers, usage, status, and errors needed to operate and protect the service. Research uses public organization websites, funder pages, and grant records. Public information can be incomplete or outdated; providing a public link does not grant access to a private account.

Provide ordinary organizational information, aggregate outcomes, and appropriately redacted documents. Do not upload beneficiary case files, medical records, government identity documents, banking credentials, or unnecessary personal details about donors, staff, or other people. You must have authority to provide what you upload.

Google sign-in is optional. When you choose Continue with Google, Google provides Clerk, our authentication provider, with your Google account identifier, email address and verification status, and basic profile information such as your name and profile picture. GrantFlex receives information needed to create or recognize your account and maintain your session. GrantFlex does not receive your Google password.

The connection requests only identity, email, and basic profile permissions: openid, userinfo.email, and userinfo.profile. These permissions do not provide access to Gmail messages, Google Drive files, contacts, or calendars. Any future integration needing additional data would require a separate permission request.

We use Google account information for authentication, account management, and security. Clerk processes identity information and authentication credentials. GrantFlex stores the associated account identifier, email, name, and workspace memberships in its database. Basic profile information may appear in account and workspace interfaces.

We do not sell Google user data, use it for advertising, or use it to train generalized AI models. GrantFlex’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable.

You can revoke GrantFlex’s Google access in your Google Account connections settings. Revocation stops future authorized Google access; it does not automatically delete your GrantFlex account or workspace. Use account controls or contact our privacy contact to request deletion. Shared workspace work is handled separately.

Google API Services User Data Policy

Manage your Google Account connections

We use information to maintain accounts and workspace access; store and organize work; provide the features you choose; deliver and recover reports; provide support; manage usage; and prevent abuse. Joining a shared workspace makes your permitted contributions available to its authorized members.

We share information with service providers as needed for these purposes and with people you authorize through workspace sharing. Information may also be disclosed to meet legal obligations, address security incidents, or protect rights. Support access to workspace content requires an appropriate purpose and authorization, with a controlled exception for security investigations.

If you choose text delivery and check the separate consent box, GrantFlex sends one automated text when your introductory research is ready. A phone number used for sign-in does not by itself authorize research notifications. You can choose email when available or view results in GrantFlex without opting into texts.

We process your verified phone number, consent record, notification content and delivery status to provide this service. Twilio and telecommunications providers process the number, message and related delivery information to deliver texts and handle opt-outs. Mobile information and SMS opt-in consent are not sold or shared with third parties or affiliates for their marketing or promotional purposes.

Reply STOP to stop research texts or HELP for help. Message and data rates may apply. Consent is optional and is not a condition of purchase. Your results remain available in GrantFlex if you opt out or a text cannot be delivered.

SMS notification terms

An owner or administrator enables AI for a workspace. Document analysis and report inclusion are separate choices. Storage-only uploads do not trigger AI analysis. Authorized analysis sends extracted text to OpenAI for searchable representations, summaries, and suggested organization facts.

Before launching a report, review the displayed public research information, selected documents, and permitted organization facts. Public research uses the displayed organization name, the legal name as public IRS records list it, public links, broad location and causes, including the confirmed main office as city, county, and state, and any research focus you expressly choose to make public. Keep private information, access tokens, and restricted links out of those public fields.

OpenAI separately processes selected private briefs, document summaries, and permitted organization facts for synthesis with web tools disabled. Private means excluded from public web research, not excluded from OpenAI processing. GrantFlex saves completed results and limited recovery records.

GrantFlex does not use customer documents or reports for model training or evaluation datasets by default. Such reuse requires separate permission with a purpose, covered information, and expiry. Processing, storage, and training are different uses. Review AI output and cited sources before relying on them.

The services below process information for GrantFlex as needed to provide their functions. Processing may occur in the United States and other countries where these providers operate. Provider retention and legal requirements can differ from GrantFlex’s application controls.

Clerk

Identity, authentication, sessions, and sign-in security.

Stripe

Hosted payment collection, subscriptions, invoices, and payment security. GrantFlex stores payment references, plan status, and usage records, not full card details.

Vercel and Vercel Private Blob

Hosting, request delivery, operational diagnostics, and original file storage.

Neon

Database storage for accounts, workspace content, and processing records.

OpenAI

Authorized analysis, embeddings, public research, and synthesis.

Inngest

Background workflow execution, retries, and recovery state.

Resend

Service email delivery and related delivery records.

Twilio

Optional research SMS delivery, delivery records, and opt-out handling.

OpenAI distinguishes processing state from abuse-monitoring logs and prompt caching. Background research requires temporary provider storage. Retention depends on the endpoint, model, account settings, and applicable terms. GrantFlex does not promise Zero Data Retention for this workflow.

Deletion from GrantFlex does not establish immediate erasure from every provider-held backup or record. Provider records can remain under their retention policies and applicable legal or security requirements. Contact us for questions about the processing of your information.

OpenAI API data controls

We retain information to provide the service, maintain security, resolve requests and disputes, and meet legal obligations. The period depends on the kind of information, workspace choices, and provider settings.

Workspace content and completed reports

Retained while your workspace keeps them, subject to deletion requests and applicable legal requirements.

Processing and recovery records

Automated application cleanup is configured to remove eligible raw processing records after a run ends. Failed cleanup may require retry or operator intervention.

Operational, security, and support records

Retained for the operational or legal purpose they serve, with periods depending on the record and the provider’s settings.

Exports and downloaded copies

Access through GrantFlex checks current permissions and content visibility. Copies you or another authorized member download remain under the recipient’s control.

Backups, storage versions, and provider records

May persist after removal from the active application. We do not promise a uniform physical-erasure deadline across all providers or backups.

Stopping research cancels the current job and attempts to stop provider work already underway. Information already sent cannot be unsent. Withdrawing a source’s AI permission prevents future processing for that purpose; it does not by itself erase earlier completed reports. Deletion is a separate action.

Deleted documents and reports are hidden from normal access and can be restored for 30 days. Deleted workspaces lose normal access and have a 14-day owner restoration window. Automated cleanup processes eligible records after the applicable restoration period. Related content may require a reviewed deletion scope; provider records and backups have separate retention. Contact us if deletion or cleanup needs assistance.

Account deletion removes identity and membership; it does not delete collaborators’ shared work. Transfer ownership or delete a solely owned workspace before deleting its only owner. Downloaded exports cannot be recalled by GrantFlex.

Email contact@grantflex.com to request access, correction, export, or deletion, or raise a privacy concern. We verify identity and authority before releasing or changing information. Rights and complaint options depend on applicable law. Necessary legal preservation requires restricted access and a documented purpose.

GrantFlex uses workspace access controls and tenant boundaries to restrict access. No service can guarantee absolute security. Report suspected unauthorized access to contact@grantflex.com.

Sign-in uses cookies and related browser storage for sessions and authentication security. GrantFlex also stores interface preferences. Blocking required cookies may prevent sign-in. Clerk manages authentication cookies and session lifetimes. The gc_sidebar_ preference cookie lasts up to one year; notification-dismissal preferences and unfinished opportunity plans use browser session storage. Opportunity drafts are scoped to your account and workspace and are restored in the same tab for up to 24 hours after editing. You can reset them on the setup page or clear browser storage through your browser settings.

When optional analytics is offered, it stays disabled until you allow it. You can change your choice through Analytics preferences in the website footer. A browser Do Not Track or Global Privacy Control signal keeps this optional measurement disabled.

With permission, GrantFlex uses PostHog to measure public page visits, template downloads, signup steps, and a small set of product milestones. A random browser identifier connects these events with the initial public landing page and a broad source category, such as organic search. We do not send email addresses, account or workspace identifiers, private URLs, document contents, prompts, grant narratives, or report text in these events. This integration does not enable session replay or automatic interaction capture.

The analytics choice cookie lasts up to 180 days. If you allow analytics, the random acquisition identifier and public landing-page context last up to 30 days. An additional random analytics session cookie expires after 30 minutes without measured activity, with a maximum session of 24 hours. Turning analytics off clears both analytics identifier cookies and stops new optional events; it does not automatically erase already received provider events. Contact contact@grantflex.com about earlier records.

PostHog privacy information

GrantFlex is intended for organizational and professional grant work, not for children under 13. Contact our privacy contact if you believe a child has provided personal information.

We may update this policy as the service changes. The published policy will show its effective date. Material changes will be explained before a new use requires your choice. Updates do not silently authorize document analysis, report inclusion, or reuse for model training.