Privacy Policy
This version replaces the July 2026 version. The English text is the binding version; translations are provided for convenience only.
1. Who we are
Grants To Go (grantstogo.app) is operated by Alena Bairak PR Beograd, registered in Belgrade, Republic of Serbia (business activity code 70.22). We are the data controller for personal data processed through the platform. Contact: privacy@grantstogo.app.
Representative
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
- United Kingdom (UK)
- European Union (EU)
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/19288497414
2. What data we collect
Account data: email address, password (see section 7), account type (business or consultant), company name, language preference, the version of our terms you accepted with the date and time of acceptance, and the confirmations described in section 5 with their dates.
Profile data you provide: information you enter in your workspace — contact details, company information, application drafts, notes.
Uploaded documents: files you upload to your workspace (business plans, budgets, financial statements and similar); we extract text from these files solely to provide the services described below.
Subscription and billing data: plan, validity dates, invoice details and, for legal entities paying by invoice, the company registration details you provide for the invoice. We do not store card numbers or payment credentials.
Usage counters: the number of re-checks used, applications in progress and similar allowance data, recorded per user in order to apply the limits of your plan.
Consultation and contact requests: the information you submit through our forms.
Technical data: we use Plausible, a privacy-friendly, cookie-free, EU-hosted analytics service, for aggregate usage statistics — it does not use cookies and does not collect personal data.
Cookies: we use cookies only where strictly necessary — to keep you signed in and to remember your language preference. Because we do not use tracking or analytics cookies, no cookie-consent banner is required under applicable law.
3. Why we process your data (legal bases)
To provide the service (contract): account access, matching calls to your company, the application workspace, downloads, submission to a funder's portal, subscription management and the application of plan limits.
Automated drafting (contract): when you use the drafting tools, the text extracted from your uploaded files and your form inputs is processed to produce a draft of your application.
Email communications (contract / consent): transactional emails (confirmations, invoices, deadline reminders, password reset) are sent as part of the service; any newsletter is sent only with your separate consent and every such email contains an unsubscribe link.
Legal obligations: accounting and tax records for invoices.
Legitimate interest: service security, abuse prevention, aggregate analytics.
4. Access by consultants and consortium partners
Where you invite a consultant to work on your application, or accept an invitation from one, that person gains access to the parts of your workspace you have opened to them — the application in question and the documents needed to prepare it. They do not gain access to your other applications or to data you have not opened.
Where a call requires a consortium, each invited partner gains access only to the parts of the shared application opened to them; each organisation's own data remains closed to the others.
In both cases:
- access is granted by you and can be withdrawn by you at any time in one action;
- no application is submitted to a funder without your own explicit confirmation;
- who did what inside the workspace is recorded in an activity log available to you;
- the consultant or partner is a separate controller for the data they receive, and is bound by our terms not to use it beyond preparing and submitting your application.
5. Personal data of other people that you give us
The documents you upload — statutes, certificates, contracts, financial statements, CVs — normally contain personal data of people other than you: directors, employees, partners. We process that data only to prepare and submit your application, and for no other purpose.
Your part. You are the controller of the data of your own people. Before you upload documents containing their personal data, you must be entitled to provide it and they must have been informed how it will be used. We ask you to confirm this once, at the moment of your first upload, and we record that confirmation with its date and the version of this policy.
When you open your application to someone else. Where you grant access to a consultant or to a consortium partner, that company sees the documents and data you have opened to them, including the personal data of your people they contain. Because each recipient is different, we ask you to confirm this each time you grant access, naming the company you are opening it to. The confirmation, the recipient and the moment are recorded. You can withdraw the access at any time, in one action; withdrawal stops further access but does not undo what has already been seen.
Our part. We keep this data inside your workspace, we show it only to those you have opened it to, we log who did what, and we do not use it for any other client, for training, or for any purpose beyond your application.
If you are one of those people — an employee or a director whose data reached us through a company — write to privacy@grantstogo.app or use our representative (section 1), and we will tell you what we hold and act on your request. In such cases the company that provided your data is the controller, and we will refer you to it where the law requires.
6. Processors we use
We share data only with service providers necessary to run the platform, under their data processing terms:
- Vercel — hosting of the application;
- Supabase — database and authentication (passwords are stored by Supabase in hashed form; we never see or store your plain-text password);
- Anthropic (Claude API) — processes text extracted from your documents and your inputs when a draft or a check is produced;
- Paddle — payment processing; acts as merchant of record for card transactions;
- Brevo — transactional and newsletter email delivery;
- Plausible — aggregate usage statistics (privacy-friendly, cookie-free, EU-hosted);
- Telegram — internal operational notifications to the operator, with the minimum necessary data.
We never sell your data and never share it with third parties for their own marketing.
7. Security and confidentiality
Your uploaded documents and drafts are visible only to you, to those you have explicitly granted access to (section 4), and to the operator strictly for support and service administration. Passwords are handled by our authentication provider and stored in hashed form — we do not store passwords ourselves. Data is transmitted over encrypted connections (HTTPS).
8. Retention
Account and profile data: for the lifetime of your account and a limited period after a deletion request. Invoices and accounting records: as required by Serbian law. Uploaded files: until you delete them or your account. Newsletter data: until you unsubscribe. Records of terms acceptance: for as long as needed to evidence the contract.
9. Your rights
Under the GDPR and the Serbian Law on Personal Data Protection (ZZPL), you have the right to access, rectify, delete, restrict or object to the processing of your data, the right to data portability, and the right to withdraw consent at any time (without affecting processing carried out before withdrawal). To exercise these rights, contact privacy@grantstogo.app or use our representative (section 1).
You may also lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Poverenik) or with your local supervisory authority.
10. International transfers
Some processors may process data outside Serbia and the EEA; we rely on their standard contractual clauses and equivalent safeguards. Our analytics processor, Plausible, is EU-hosted and does not transfer data outside the EEA.
11. Children
The service is intended for businesses and for persons aged 18 and over. We do not knowingly process children's data.
12. Languages
The English version of this policy is the binding one; translations are provided for convenience. Where a translation differs from the English text, the English text prevails.
13. Changes
We may update this policy; material changes will be announced on the site or by email. Each version carries a version number and date. The current version is always available at grantstogo.app/privacy.