Privacy Policy

Last updated: 27 October 2026 (v4)

CharityGrantWriter is built for small nonprofit teams. This policy explains what we collect, why, who helps us run the service, how long we keep your data, and your rights over it.

1. Who We Are

CharityGrantWriter ("we", "us" or "our") helps nonprofits find the foundations that have funded work like theirs, and drafts concept notes and introduction emails with Sam, our writing assistant. Our website is charitygrantwriter.com. Our mailing address is CharityGrantWriter, 214-50 Joe Shuster Way, Toronto, ON M6K 1Y8, Canada. For privacy questions, email privacy@charitygrantwriter.com.

2. Information We Collect

What you give us:

• Contact details: your name, email address and job title.
• Organization details: your organization's name, location, mission, budget, staff size, focus areas, year founded and how it's governed.
• Program details: what each program does and for whom, where it runs, how much you're asking for, and your answers to Sam's questions (the need, activities, expected outcomes, what the money pays for, your track record).
• Documents you upload: past proposals, program documents and impact reports. We keep the file and the text read from it.
• Your writing voice: the tone, words you use and words you avoid that you set under "How you write", any writing sample you add, and what Sam learns about your style from past proposals.
• Drafts and your work: drafts Sam writes, your edits, your messages to Sam, your grant tracker, and any feedback you give us after a draft.
• Account details: your email and password (stored only as a secure hash), or your name, email and Google account ID if you sign in with Google.
• Billing details: if you subscribe, Stripe processes your payment. We receive your plan, subscription status, billing dates and a Stripe reference. We never see or store your full card number.
• Sign-ups and email choices: when you request access to the beta, your name, email, job title, organization, its website, head office city and state and, if you give it, its EIN (we use these to confirm that you work for a US nonprofit); when you join the early release list, your name, email, organization, country and what you'd like to fund; and whether you've agreed to receive product updates and funding tips, with the date and how you agreed.

Speaking to Sam: when you use the microphone, your browser's own speech recognition turns your speech into text. Depending on your browser, the audio may be processed by the browser's maker (for example Google for Chrome or Apple for Safari). We receive only the text. We never receive or store audio.

Collected automatically: the pages you visit and features you use, your browser and device type, and your referral source. Our own page counts store a one-way hash of your IP address, not the address itself. If you accept analytics cookies, Google Analytics also collects usage data (see section 8).

3. How We Use Your Data

• To find foundations for your programs: we compare your program details with public grant records that US private foundations report to the IRS.
• To write drafts for you in your organization's voice, using only the facts you've given us.
• To run your account: your dashboard, document library, grant tracker, billing and support.
• To send you account emails and, only if you've opted in, product updates and funding tips.
• To improve CharityGrantWriter, using usage counts and the feedback you choose to give. We only quote your feedback publicly with your permission.
• To meet our legal obligations and keep the service secure.

We don't sell your data. We don't sell, rent or trade your personal information or your organization's data, and we never share it with funders. A draft only reaches a funder if you send it.

4. Sam and AI Processing

Sam uses Anthropic's Claude model through Anthropic's commercial API. Our own code ranks the foundations from the public grant records; Claude helps turn your program description into search terms, writes the short summary for each match, reads documents you upload, and writes your drafts.

What Anthropic receives: your program details and answers, your organization details, the text of documents you upload, your writing-voice settings, your messages to Sam, and the funder's public grant records. Drafts end with a sign-off, so Anthropic also receives the contact name, job title and email address you've given for your organization.

No training: your data is never used to train AI models. Anthropic's commercial terms don't allow it to train its models on what we send, and it keeps that data only for a limited period to run and secure its service.

You stay in control: Sam's drafts are first drafts and may contain mistakes. Anything Sam doesn't know is marked for you to fill in. You review every draft and decide what, if anything, is sent. Sam doesn't make decisions about you or your organization.

5. Service Providers (Sub-processors)

These companies help us run CharityGrantWriter. Each one receives only what it needs for its job, under a data processing agreement where the law requires one:

• Render (US): hosts the CharityGrantWriter application, so all data passes through its servers.
• Neon (US): our database. Stores everything in your account, including uploaded documents, encrypted at rest.
• Anthropic (US): the AI model behind Sam. Receives what's listed in section 4.
• Google (US): sends our account emails (Google Workspace); handles sign-in if you choose "Sign in with Google"; provides Google Analytics if you accept analytics cookies; and serves the fonts on our pages.
• Brevo (France): delivers email when Google can't, and holds our mailing lists for the beta, the early release and product updates. Receives your name, email, organization, country, sign-up stage and email choices.
• Stripe (US): processes payments and holds your card details. We receive only your plan, status, billing dates and a Stripe reference.

Providers outside your country handle your data under Standard Contractual Clauses or the UK International Data Transfer Agreement where these apply. Sub-processor list version: v4 (October 2026). We'll tell you about material changes to this list.

5a. Subscriptions and Billing

• The US Beta is free for 4 weeks with no card needed. If you choose a plan during your beta, Stripe saves your card and takes the first payment when your beta ends.
• Plans renew monthly or yearly until you cancel. Cancel any time with Manage billing on your account page; your plan stays active until the end of the period you've paid for.
• Deleting your account cancels your subscription straight away.
• If you think a charge was made in error, email hello@charitygrantwriter.com within 14 days. We look at refund requests case by case.

Stripe's privacy policy covers how Stripe handles your payment details: stripe.com/privacy.

5b. Emails

• Account emails are sent because you need them to use the service: your beta approval or decision, messages about your beta and your matches, password resets, billing messages and account notices.
• Marketing emails (product updates and funding tips) are sent only if you tick the box to receive them. We record when and how you agreed.

Every marketing email has an unsubscribe link that works right away. You can also change your choices on your email preferences page or by emailing privacy@charitygrantwriter.com. Every marketing email shows our mailing address.

5c. Our Team's Access

A small number of CharityGrantWriter staff can access account data, and only to answer a support request you make, fix a technical problem, investigate fraud or abuse, or meet a legal obligation. They can see your contact details, organization and program details, documents, drafts and subscription status. They can't see your password or card details. We don't look through accounts for marketing.

6. How Long We Keep Your Data

• Your account and everything in it (contact and organization details, programs, matches, drafts, documents, writing voice, grant tracker): kept while your account is open, so you can come back to it, and deleted within 30 days of closing your account.
• A search started without an account: deleted after 12 months without activity.
• Mailing lists: when your account is deleted, we remove you from our Brevo mailing lists too.
• Payment records: Stripe keeps payment and invoice records for as long as the law requires.
• Deletion records: we keep an anonymous record that an account was deleted, with no name or email.

To have anything deleted sooner, email privacy@charitygrantwriter.com.

7. Cookies and Browser Storage

• Essential: your browser stores a sign-in token so you stay logged in, and remembers your cookie choice. These can't be turned off while you use your account.
• Analytics (optional): Google Analytics cookies, which help us see which pages and features are used. They're only set if you choose "Accept all" on our cookie banner. To change your choice, clear this site's data in your browser and choose again.

8. Your Rights

Depending on where you live, you can ask us to:

• Access the personal data we hold about you.
• Correct anything that's wrong.
• Delete your personal data.
• Export your data in a machine-readable format.
• Object to processing based on our legitimate interests.
• Withdraw consent for marketing emails or analytics at any time.

Email privacy@charitygrantwriter.com to use any of these rights. We respond within 30 days.

9. Canada (CASL and PIPEDA)

• We only send marketing emails to people who have given express consent, using an unticked box that's separate from accepting our Terms. We record the date, method and wording of your consent.
• Account emails are sent because you have an account with us.
• Every email identifies CharityGrantWriter and our contact details, and every marketing email has an unsubscribe link that works right away.

9a. EEA and UK (GDPR)

If you use CharityGrantWriter from the EEA or the UK, we process your data on these legal bases:

• Contract: to run your account, find foundations, write drafts and manage your subscription.
• Legitimate interests: to keep the service secure, provide support and improve the product. You can object by emailing privacy@charitygrantwriter.com.
• Consent: for marketing emails and analytics cookies. You can withdraw it at any time.
• Legal obligation: for billing records and answering requests about your data.

You can complain to your data protection authority: the ICO in the UK (ico.org.uk), or your national authority in the EEA.

10. Children

CharityGrantWriter is for nonprofit organizations and their staff. We don't knowingly collect data from anyone under 16.

11. Security

Every connection uses HTTPS, passwords are stored only as secure hashes, our database is encrypted at rest, and staff access is limited. No system is perfectly secure, so please use a strong password you don't use anywhere else.

12. Changes to This Policy

We'll update this policy as CharityGrantWriter changes. We'll tell account holders about material changes by email and update the date at the top of this page.

13. Delete Your Account and Data

• Yourself: on your account page, choose Delete My Account. You can't log in from that moment, any subscription is cancelled, and all your data is permanently deleted within 30 days.
• By email: email privacy@charitygrantwriter.com with the subject "Delete my account" and we'll do it for you.

Changed your mind? Email us within 30 days and we can restore your account.

14. Contact

Questions or requests? Email privacy@charitygrantwriter.com. We aim to reply within 2 business days.