Privacy Policy

Last updated: 17 September 2026

GrantFinder Pro helps small businesses find grants they qualify for, draft applications with AI, and keep track of deadlines. This policy explains what we collect, where it goes, how long we keep it, and what you can ask us to do about it.

We have written it in plain English and we have tried hard to make every sentence true of the product as it actually works today. Where something is a decision we have not finished making, we say so rather than dressing it up.

"GrantFinder Pro", "we" and "us" mean Foxxception LLC, of 2125 Biscayne Blvd, Ste 204 #15879, Miami, FL 33137. "You" means the person using the service, and the business they use it for.

Questions about anything here: support@grantfinder.io.

The short version

• We collect what you tell us about your business, what you do in the app, the documents you upload, and the drafts we help you write.
• We do not run advertising, analytics, session replay or email open-tracking. There are no tracking pixels in our product or our emails.
• We do not sell your information, and we do not share it with anyone for advertising.
• Your business profile and your uploaded documents are sent to AI models so they can explain matches and write drafts. We tell you exactly which text goes where, below.
• We do not see or store your card details. Payment happens on Stripe's own checkout page.
• There is currently no "delete my account" button in the app. Email us and we will do it by hand. See Deleting your data for the honest detail, including two records that survive today.

What we collect and why

Account and sign-in

Sign-in runs on Clerk. We store the identifier Clerk gives us, your name, your primary email address, the time you last signed in and last used the app, your timezone, and whether your account has admin rights.

We only store an email address that Clerk reports as verified. That address is what deadline reminders, weekly digests, "add a teammate by email" and our internal admin check all key off, so an unverified claim is not good enough.

Your business profile

This is the heart of the product, and it is the most detailed thing we hold. Depending on how much you fill in, it can include:

• Legal name, trading name, entity type, EIN, UEI, and whether you are registered on SAM.gov
• Your address, city, county, state and ZIP, and whether you are in a rural area, a HUBZone or an Opportunity Zone
• Founding date, employee count, revenue band, NAICS codes and industry tags
• Ownership demographics you choose to tell us: woman-, minority-, veteran-, service-disabled-veteran-, LGBTQ- or disability-owned, or "prefer not to say"
• Certifications: 8(a), HUBZone, WOSB, EDWOSB, SDVOSB, MBE, WBE, DBE
• What you want funding for, your mission, your project ideas, and your past awards

We use it to filter out grants you cannot win, to score the ones you can, and to give the AI writer real facts instead of guesses.

About the ownership and certification fields. These say something personal about the people who own the business, so they are always optional and "prefer not to say" is a real choice. We ask because a large share of grant programmes are restricted to businesses with these characteristics, and without the answer we cannot tell you that you qualify. If you pick "prefer not to say", that choice is never included in an AI prompt.

If you use the quick search wizard instead of the full profile, we keep a lighter set of answers — industry, state, business size, what you need funding for, revenue, and any of these you tick: minority-, women-, veteran- or disability-owned, economically disadvantaged, rural, HUBZone, Native American or tribal. The wizard's list is shorter than the profile's and has no "prefer not to say" box; ticking nothing is how you tell us nothing.

Grant activity

• Saved grants: the grant's title, agency, source, link, deadline, award size, your match score, whether you won or lost it, and any notes you write.
• Tracked applications: the same details plus the stage you are at, your own estimate of your chances, the amount you are asking for, your notes, and submission and decision dates.
• Roadmap steps: the step-by-step plan for an application, including the names, roles, organisations, email addresses and phone numbers of programme officers and local advisers. Those contact details are copied from the grant notice as the agency published it.
• Tasks: titles, descriptions, due dates, priority, who it is assigned to, and how many days before the deadline you want reminding.
• Search history: every search you run while signed in is saved automatically, not only when you ask. That means the full answer set — industry, state, size, funding needs, ownership characteristics, keywords, year founded, employee count and revenue — plus how many results came back.

Documents you upload

You can upload business plans, capability statements, financials, budgets, prior applications and similar material: PDF, DOCX, XLSX, CSV, TXT, PNG or JPG, up to 25 MB each.

We read text out of PDFs only, and only up to 10 MB of PDF; we keep up to 200,000 characters of it. A Word file, spreadsheet, image, or a PDF larger than that, is stored and available to download, but no text is pulled out of it and none of it reaches an AI model.

We store the file itself in Cloudflare R2 storage, under a path scoped to your account and workspace. We also store its name, type and size in our database, along with up to 200,000 characters of text pulled out of PDFs so the AI writer can quote your own material.

Downloads always go through a signed-in route that checks you are a member of the workspace the file belongs to. The storage bucket is not public and files do not have public URLs.

AI drafts, reviews and exports

For each drafting run we keep the questionnaire we generated, every answer you typed into it (up to 20,000 characters each), a summary of the funding notice, the full text of every section the AI wrote, and every revision as a separate version — marked as either an AI or a human edit, so you can restore an earlier one.

We also keep the AI reviewer's critique: an overall score out of 100, scores and comments per criterion, a prioritised list of fixes, and a compliance checklist.

Word and PDF exports of a finished draft are generated on request and stored in R2 alongside your uploads, behind the same signed-in download check.

If you used the older one-step writer, those drafts are still here as a read-only archive, including the snapshot of your business profile taken at the time. We no longer create new ones.

Billing

We store your plan, its status, the billing period, seat count, and the Stripe identifiers for your customer and subscription records. We also keep a ledger of application credits — granted, purchased, spent on a draft, or refunded when a run fails.

We never see, receive or store your card number, expiry date or security code. Payment happens entirely on Stripe's hosted checkout page.

Email and notification preferences

We store which kinds of email you want, how often you want the digest, and your quiet hours. We also store two secret tokens:

• An unsubscribe token, which is printed in the footer of every email we send you.
• A calendar token, which is the address of your private deadline feed. Anyone who has that URL can read the feed, so treat it like a password. You can reset it from the calendar page, and the old link stops working immediately.

Neither token appears in your notification settings. The calendar token is shown to you in exactly one place — the "Subscribe (ICS)" link on the calendar page, so you can copy it into your calendar app. The unsubscribe token is never shown in the app at all; it only travels in the emails we send you.

We also keep a log of every email we attempt to send: the recipient's address, the subject line, the provider's message id, whether it succeeded, and the first 500 characters of any error. This is for working out why a message did not arrive.

Notifications in the app

Each notification stores its own text plus supporting detail: the opportunity, your match score and tier, the agency, the closing date, the AI summary, up to ten reasons you match and ten warnings, the related application or task, and how many days are left.

Technical and usage data

• Server logs. Both parts of GrantFinder Pro run on Cloudflare Workers, with logging turned on for every single request. Our own log lines deliberately leave out recipient email addresses, prompt text and email bodies, but they do include account, workspace, draft and notification identifiers, provider names, status codes and error messages. Cloudflare's platform logs every request that reaches us, which includes IP address, user agent and URL.
• AI usage counters. We cap AI match explanations at 20 a day for signed-out visitors, 40 for free accounts and 200 on paid plans, so a script cannot run up our bill. For signed-in people the counter is keyed to your account id. For signed-out visitors it is keyed to the IP address, and that IP address is stored in our database as part of the counter.
• Rate limiting. We also read your IP address from the Cloudflare request header to apply a 30-requests-per-minute limit on AI explanations. That one is held in memory only and is not written down.

People who are not our customers

Two kinds of information here are about someone other than you.

Programme staff. Every grant in our index carries the contact its agency published: usually a programme officer's name, work email address and phone number. We copy it from the public notice, show it on the grant page and in your roadmap, and keep it as long as we keep the grant. If you are one of those officers and want your details removed from our copy, email legal@grantfinder.io and we will remove them, though the agency's own notice is outside our control.

Teammates and advisers you add. A roadmap step or a task can name a person and hold their email address or phone number because you put it there. You are responsible for what you enter about other people.

Where your information goes

We do not sell your information and we do not share it for advertising. We do use a small number of companies to run the service. Here is each one and exactly what it gets.

Clerk — sign-in and accounts. Receives your sign-up and sign-in details and everything that goes with your session: your email addresses and whether they are verified, your name or username, any social account you choose to sign in with, and session tokens. We read your name, verified primary address and account identifier back from Clerk. We also ask Clerk for a plain count of how many people have signed up, which is the number shown on our home page.

Neon — our database (Amazon's US East region). Holds everything described above: profiles, EIN and UEI, document text, drafts and notes, email addresses in the delivery log, and the IP-keyed usage counters.

Cloudflare — hosting, file storage, background jobs and logging. Because the whole service runs on Cloudflare, every request to us passes through it, including your IP address, browser and the page you asked for. Cloudflare also holds your uploaded files and generated exports in R2, carries the background job messages that reference your account, workspace and draft, and keeps our server logs.

Anthropic (Claude) — writing and critiquing drafts. For each drafting run, Anthropic receives the funding notice, your full business profile block, every questionnaire answer you typed, and up to 30,000 characters of text from your uploaded documents (at most 6,000 characters from any one document). When the AI reviews or rewrites a draft, it receives the draft text too. These calls go through Cloudflare's AI Gateway, and every one of them carries an explicit instruction not to log the contents of the request or the response, so the gateway records the call itself — timing, token counts, cost — and a tag naming the draft, rather than your text.

Cloudflare Workers AI — match explanations, search and tagging. Receives the grant's public text plus your profile when it explains why you match; a fixed summary of your profile when it turns a search into a semantic query; and public grant text when it tags new opportunities or reads the structure of a funding notice. It also generates the drafting questionnaire, which includes your profile block.

For both AI services, your EIN and your street address are never put into a prompt. The profile block sent to a model stops at city, state, ZIP and county.

Cloudflare Browser Rendering. Receives the finished draft as a rendered page, in order to turn it into a PDF.

Cloudflare Turnstile — the bot check. Receives the challenge token and your IP address when a signed-out visitor runs a search.

Stripe — payments. At checkout Stripe receives your account's email address, a display name, and identifiers linking the payment to your account and workspace. Card details are typed into Stripe's own page and never reach our servers.

Resend — sending email. Receives the recipient's address and name, the subject, and the complete message. That message contains grant titles, agencies, deadlines, match scores, AI summaries, your tracked application titles and stages, task titles and due dates, your first name, and your unsubscribe link.

Cloudflare Email Sending — backup email. Receives the same message, and is used only when Resend is unavailable or failing.

Grants.gov. Receives search keywords derived from your profile — and, on the live fallback path, the free-text keywords you typed, exactly as you typed them — plus filter codes and opportunity ids. No names, email addresses or account identifiers are sent.

USASpending.gov. Our server sends up to two keywords from your profile to build the "recent awards like yours" tab. Separately, our home page asks USASpending for live federal spending figures directly from your browser, so USASpending sees your IP address and browser headers when you visit that page. The result is cached in your browser for 24 hours, so for most visitors this happens at most once a day. If your browser blocks storage — private mode, for example — it happens on every visit to that page.

Beyond this list, we will only hand your information to someone else if the law requires it, or if the business is sold or merged — in which case we will tell you.

How we use AI, honestly

Three things are worth being blunt about.

1. Your own words leave our platform. Your profile, your questionnaire answers and extracts from your uploaded documents are sent to Anthropic and to Cloudflare Workers AI. There is no way to use the drafting feature without that happening.
2. AI output is a first draft, not a submission. It can be wrong, it can miss a requirement, and it marks gaps it could not fill with [NEEDS INPUT] tags. A person has to read, correct and approve every draft before it goes to a funder. We instruct the models not to invent facts, but instruction is not a guarantee.
3. What the AI gateway keeps. Every AI call passes through our own Cloudflare AI Gateway, which records metrics such as model, token counts, latency and cost. Calls to Anthropic are sent with content logging switched off, so the gateway keeps those numbers and not your text. Calls to Cloudflare Workers AI, which carry match explanations and tagging rather than your drafts, do not carry that instruction, so the gateway may retain their contents under our account settings. What Anthropic and Cloudflare themselves keep, and whether they use content to train models, is governed by their own published terms rather than by us.

Cookies, the bot check, and your browser

We set two cookies of our own. Our sign-in provider sets up to five more to keep you signed in, and the bot-check widget may use storage of its own. None of them are for advertising or analytics.

Ours:

• gf_human — set after you pass the bot check on a signed-out search, so reloading the page does not challenge you again. It lasts one hour, is only sent to our API, cannot be read by JavaScript, and contains no identifier — just a timestamp and a signature.
• sidebar_state — remembers whether you collapsed the dashboard sidebar. Lasts seven days. Its value is "true" or "false".

Set by others, and necessary for the service to work:

• Clerk's session cookies (__session, __client_uat, __clerk_db_jwt, __clerk_handshake, __refresh). These keep you signed in. Clerk sets and expires them; we only check whether they exist, so that a visitor who is not signed in is never dragged into a sign-in handshake.
• Cloudflare Turnstile. Its widget loads from Cloudflare on the last step of the search wizard and on the results page, and only for signed-out visitors. Any storage it uses is Cloudflare's own.

We also keep three things in your browser that never leave it, except where noted:

• Your wizard answers, so the results page survives a reload.
• Your active workspace, which is sent with each request so the app shows the right data. Our server ignores it unless you are actually a member of that workspace.
• A 24-hour cache of the public federal spending figures on the home page.

No analytics, no advertising, no tracking

To be completely clear about what is not here:

• No analytics product, no page-view tracking, no session replay.
• No advertising tags, no ad networks, no data sold or shared for advertising.
• No tracking pixels or open-tracking in our emails. Our email templates contain no beacon images, and we do not ask our email provider to track opens or clicks.

Our code does contain a hook for a cookie-less, privacy-friendly analytics tool, but it only activates if two build settings are filled in, and neither is filled in. Nothing is being collected. If we ever turn it on, we will update this policy first.

How long we keep things

We should be straight with you: we have not yet set fixed retention periods, and nothing in the service deletes itself on a timetable. The records described in this policy stay for as long as your account exists, until you delete them or ask us to.

The retention periods we settle on will be published here: [RETENTION PERIODS — per data category and after account closure].

A few specifics that are true today:

• Your notifications, search history, draft version history, email delivery log and AI usage counters all accumulate. Nothing prunes them.
• Public grant data and the records of our nightly data crawl are kept indefinitely by design. When we retire an old opportunity we hide it rather than remove it, because people have applications and saved grants pointing at it.
• Cached copies of funding notices, and every export you generate, are written to storage and are not currently cleaned up.

Deleting your data, and what deletion actually does

Things you can delete yourself, right now, from the app:

• A saved grant. The record is removed.
• A document. The database record is removed and the stored file is deleted. If the storage deletion fails, we log it and the record still goes — which means a file can occasionally outlive its record. If that matters to you, tell us and we will check.
• An application. Its roadmap steps, tasks and drafts are removed with it.
• A task. Drafts cannot be deleted on their own — a draft goes when you delete the application it belongs to.
• Your calendar feed link. Resetting it issues a new one and kills the old URL immediately.
• Leaving a workspace. That stops its reminders and calendar entries for you and unassigns your tasks, but it does not delete the workspace's data — it still belongs to the workspace.

Deleting your whole account. There is no self-service account deletion in the app today. Email support@grantfinder.io from the address on your account and we will do it manually, within [DELETION RESPONSE WINDOW, e.g. 30 days].

When we delete your account, the connected records go with it: your profile, business profiles, saved grants, applications, roadmaps, tasks, drafts, sections, versions, reviews, credits, notifications, preferences, subscriptions, search history and your workspaces.

Two things are not reached by that automatic cascade today, and we remove them by hand as part of the same request:

• The email delivery log, which holds the address and subject line of every message we attempted to send you.
• The daily AI usage counters. We can find and remove the rows keyed to your account id. Rows keyed to an IP address — written when someone asks for an explanation without being signed in — are not linked to any account, so we cannot tell which ones were yours. Each one holds only an IP address, a date and a count.

We also have to remove your stored files, cached funding notices and generated exports from storage by hand. We will confirm to you when it is done.

One more thing worth knowing: deleting your account with our sign-in provider does not delete it here. There is no automatic link between the two, so please email us as well.

Unsubscribing is not deletion

Unsubscribing stops us emailing you. It does not delete anything, and your account keeps working. You can resubscribe at any time, and the one-click unsubscribe link in every email works without you having to sign in.

Your rights, and how to use them

Whatever privacy law applies where you live, you can ask us to:

• See what we hold about you
• Correct anything wrong — most of it you can edit yourself in the app
• Delete your account and your data
• Export your data in a portable form. As with deletion, there is no button for this yet: we put the copy together by hand when you ask.
• Stop emailing you — use the unsubscribe link, or the notification settings page

Email support@grantfinder.io and say which one you want. We will ask you to confirm you control the account's email address, and we will answer within [RIGHTS REQUEST RESPONSE WINDOW, e.g. 30 days]. We will not charge you or treat you worse for asking.

We do not sell personal information, and we do not share it with anyone for cross-context behavioural advertising. Depending on where you live, laws such as the California Consumer Privacy Act or the GDPR may give you specific rights. Rather than argue about which law reaches us, we answer access, correction, deletion and export requests from anyone who asks, whatever their address.

Formal requests can also be sent by post to Foxxception LLC, 2125 Biscayne Blvd, Ste 204 #15879, Miami, FL 33137.

If you were moved over from the earlier version

Accounts from the previous version of GrantFinder Pro were carried across, with their data. The first time you sign in to the new site, your old record is matched to your new sign-in — but only if the verified email address on your new sign-in matches the one stored on the old record. If it does not match, we do not connect them: the old record is left alone, still holding that person's data, and you get a fresh empty account. If your history looks missing, email us and we will sort it out by hand rather than guessing.

Children

GrantFinder Pro is a tool for running a business and is not meant for children. You must be at least [MINIMUM AGE, e.g. 18] to use it. We do not ask for anyone's age and we do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.

Server logs and the search index

Both halves of the service log every request they handle, and those logs sit with Cloudflare under its own retention. Our own log lines leave out email addresses, prompt text and message bodies, but they do contain account, workspace and draft identifiers, so an entry can be traced back to an account.

Grant text is turned into numeric vectors and stored in a Cloudflare Vectorize index so we can match by meaning rather than keywords. That index holds grant information, not your profile. When you search, your profile is turned into a vector to compare against it, and that vector is used for the search and not stored.

Where your data is processed

GrantFinder Pro is hosted in the United States. Our database runs in Amazon's US East region. Our hosting, storage and AI processing run on Cloudflare's network, and our sign-in and email providers run their own infrastructure. If you are outside the United States, using the service means your information is processed there. [INTERNATIONAL TRANSFER MECHANISM — e.g. Standard Contractual Clauses, UK Addendum, Data Privacy Framework — confirm which, if any, apply.]

Who on our side can see your data

Administrator rights are granted by email address: an address on our internal admin list gets them automatically on every request. An administrator can read the opportunity index and the admin tools, and carries the entitlements of our largest plan. We keep that list as short as the work allows. Beyond that, the people who operate the service can reach the database and the file storage, as anyone running a service must in order to fix it.

Security

Here is what we actually do, without dressing it up:

• Everything travels over encrypted connections.
• Your files are held in private storage with no public URLs. Every download goes through a route that checks you are signed in and are a member of the workspace that owns the file.
• Your business records — business profiles, applications, roadmaps, tasks, documents and drafts — are scoped to a workspace, and a request for another workspace's data is refused. The rest, such as your saved grants, search history and notification settings, is scoped to your account and is only ever read back for the signed-in person.
• Your calendar feed and unsubscribe links use long random tokens, which are never returned to the browser in your settings, and the calendar one can be reset by you at any time.
• We do not store card details at all.
• Our own log lines deliberately leave out email addresses, prompt text and message bodies.
• We turn off content logging at the AI gateway for the calls that carry your drafts.

We do not hold SOC 2, ISO 27001 or any other security certification, and we have not had an independent audit. No service can promise it will never be breached, and we are not going to pretend otherwise. If a breach affects your information, we will tell you and the relevant regulator as required, without undue delay, and within 72 hours of confirming it where the law requires notice.

What we do not promise

• We cannot get you a grant. We do not guarantee that you will be eligible for anything, that you will be funded, or that anything we surface is still open. Grant competitions are decided by funders, not by us.
• We are not your lawyer, accountant or grant consultant. Nothing in the product is legal, tax, accounting or professional advice.
• AI drafts need a human. Read everything before you submit it. You are responsible for what you send to a funder.
• Eligibility rules change. Our grant information comes from public sources — Grants.gov and curated state and private programme lists — and those sources change, go stale and contain errors. Always check the funder's own notice before you rely on a deadline or a rule.

Changes to this policy

If we change how we handle your information, we will update this page and change the "Last updated" date at the top. For anything significant — a new category of data, a new company receiving your information, or turning on analytics — we will tell you by email before it takes effect.

Contact us

Email support@grantfinder.io, or write to Foxxception LLC, 2125 Biscayne Blvd, Ste 204 #15879, Miami, FL 33137.

We read every message.