Privacy Policy

Last updated: October 21, 2026

GrantSherpa ("we", "us") helps nonprofits find grants that fit them, prepare applications, and keep track of what they promised after an award. This policy explains what information we collect, why, and what we do with it. We have tried to write it so you do not need a lawyer to understand it.

1. Information about our customers

When you sign up we collect what you type into the form: your organization's name, your email address, and the profile that describes your organization (focus areas, states served, organization type, and, if you give them, your mission, programs, project types, preferred award sizes, capacity answers, topics to exclude and preferred agencies). If you choose a password we store only a salted hash of it, never the password itself; if you sign in with Google, Google shares only your name and email address with us.

As you use the dashboard we store what you put in it: the matches you save, dismiss or mark useful or irrelevant; documents you upload (grant notices, past applications, reports, award letters, agency correspondence) and the facts, drafts, budgets, submission records, awards, obligations and evidence entries you create from them; and, if you use the consultant edition, which other organizations you have invited or been invited to work in.

We keep server logs and basic request records (such as IP address and time) for security, rate limiting and troubleshooting. We do not use advertising trackers or third-party analytics scripts on our pages.

2. Information about funders and grant programs

Grant opportunities come from public sources: Grants.gov, state and local government websites, USAspending, IRS public filings and funders' own published pages. Contact details we show for a funder (a program officer named in a notice, a funder's website, phone number or email) are only what the funder or agency published itself. We do not look up or store personal details about individuals beyond what appears in those public records.

3. How we use information

• To run the service: screen opportunities against your profile, show matches with the evidence behind them, email you digests and reminders, and build briefs, packets, budgets and reports from your own documents and approved facts.
• To improve matching for you: your saves, dismissals and useful/irrelevant marks shape what you see. We do not use them to build profiles of other customers.
• To bill you, once you choose the paid plan.
• To answer your support requests and to tell you about important changes to the service.
• To keep the service secure and to enforce our Terms.

We do not sell your information. Your documents, facts and drafts are visible only to your organization and to people you explicitly invite. They are never combined with or shown to any other customer.

4. Service providers we rely on

We use a small number of providers to run GrantSherpa. Each receives only what it needs to do its job:

• Anthropic (Claude) reads grant notices, your uploaded documents and your profile to produce eligibility analyses, briefs, draft sections, budget rules and document summaries. The text of those documents and your profile are sent to Anthropic's API for that purpose. We do not send your password, email address or payment details.
• Resend delivers our email: sign-in and confirmation links, password resets, digests and reminders. It receives your email address and the content of those messages.
• Stripe handles payments. Card details go directly to Stripe; we never see or store them. We keep Stripe's customer and subscription identifiers so we know what you have paid for.
• Cloudflare hosts the application, database and uploaded files.
• Brave Search and Google (Places) are used, on the paid plan, to find a funder's own published website, phone number and email. They receive the funder's name and state, never your information.
• Google also provides "Continue with Google" sign-in, if you choose it.

We may disclose information if the law requires it, to protect the rights or safety of our customers or others, or as part of a sale or merger of the business (in which case this policy continues to apply to the information transferred).

5. Email

Confirmation and sign-in links, the weekly digest, deadline reminders and account notices are part of the service. You can pause digests and reminders in your dashboard or with the unsubscribe link in any of those emails. We do not send marketing email without asking first.

6. Cookies

We do not use tracking cookies. The dashboard sets one session cookie so you stay signed in; it is not readable by page scripts and is removed when you sign out. Changing your password signs out every other device.

7. Keeping and deleting information

We keep your account information for as long as you have an account. You can download everything we hold about your organization from the dashboard at any time ("Download all my data"). You can also delete your organization's account yourself from the dashboard; that removes your profile, matches, documents, facts, drafts, budgets, submissions, awards and reports immediately, except for records we must keep for tax, accounting or legal reasons. Public grant notices and funder records stay in our database because they are public.

8. Security

You sign in with your email and password, with Google, or with a one-time emailed link. Passwords and session tokens are stored hashed on our side. Traffic is encrypted in transit. Uploaded files are stored in a private bucket that only the application can read. No system is perfectly secure; if we learn of a breach affecting your information we will tell you as the law requires.

9. Your choices and rights

You can view and change your profile and delivery settings in the dashboard, export your data, and delete your account. Depending on where you live you may have additional rights (for example to access, correct or delete personal information, or to object to certain processing). To exercise them, email us at the address below. We will respond within the time the applicable law allows.

10. Children

GrantSherpa is a tool for organizations and is not intended for anyone under 18. We do not knowingly collect information from children.

11. Changes

If we change this policy in a way that matters, we will update the date above and, for significant changes, email account holders. Continuing to use the service after a change means you accept the updated policy.

12. Contact

Questions about privacy go to our support address. We are based in New York, United States.