Privacy Policy

1. Introduction

SeeGrant ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our grant discovery and application management platform ("Service").

This Privacy Policy applies to all users of our Service and complies with applicable federal laws including the Children's Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and state privacy laws. We also adhere to principles consistent with the General Data Protection Regulation (GDPR) for international users.

By using the Service, you consent to the data practices described in this Privacy Policy. If you do not agree with these practices, please do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Name, email address, password, and profile details when you create an account
• Organization Profile: Business name, EIN/tax ID, organization type, industry, founding date, employee count, annual revenue, and location
• Grant Application Data: Application drafts, supporting documents, financial information, and project descriptions you upload or enter
• Communication Data: Messages, feedback, and correspondence with our support team
• Payment Information: Billing address and payment method details (processed securely through third-party payment processors)
• API Keys: When you create API keys for integrations (e.g., Zapier), we store a secure hash of the key, key name, creation date, and associated scopes

2.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, search queries, grants viewed, time spent on pages
• Log Data: Access times, error logs, referring URLs
• Cookies and Similar Technologies: Session cookies, persistent cookies, and analytics tools (see Section 8)

2.3 Information from Third Parties

• Authentication Providers: Information from single sign-on services (e.g., Google, Replit) you use to log in
• Public Grant Databases: Information from government sources (Grants.gov, IRS, state portals) to provide grant listings
• Business Verification Services: Publicly available information to verify organization details

3. How We Use Your Information

We use your information for the following purposes:

• Provide and Improve Services: Deliver the Service, process transactions, and enhance features
• Grant Matching: Analyze your profile to recommend relevant grant opportunities
• AI-Powered Features: Generate eligibility assessments, application drafts, and success probability scores
• Communications: Send service updates, deadline reminders, security alerts, and (with consent) marketing messages
• Customer Support: Respond to inquiries and provide technical assistance
• Analytics: Understand usage patterns and improve the Service
• Security: Detect, prevent, and address fraud, abuse, and security threats
• Legal Compliance: Comply with applicable laws, regulations, and legal processes

4. Legal Bases for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and other jurisdictions requiring a legal basis, we process your data based on:

• Contractual Necessity: Processing necessary to provide the Service you requested
• Legitimate Interests: Processing for our legitimate business interests (security, analytics, service improvement) that do not override your rights
• Consent: Processing based on your explicit consent (e.g., marketing communications)
• Legal Obligation: Processing necessary to comply with legal requirements

5. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: Third-party vendors who perform services on our behalf (hosting, payment processing, analytics, customer support)
• AI Processing: OpenAI and similar providers to power AI features (data is processed per their privacy policies and our data processing agreements)
• Integration Partners: Third-party services you connect via API integrations (e.g., Zapier, CRM systems) receive only the data you authorize through webhook subscriptions and API actions
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Legal Requirements: When required by law, court order, or government request
• Protection of Rights: To protect the rights, property, or safety of SeeGrant, our users, or others
• With Your Consent: When you explicitly authorize sharing

We require all third parties to respect the security of your personal data and treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.

6. Data Retention

We retain your personal information for as long as necessary to:

• Provide the Service and maintain your account
• Comply with legal obligations (tax, audit, regulatory requirements)
• Resolve disputes and enforce our agreements
• Fulfill legitimate business purposes

When you delete your account, we will delete or anonymize your personal data within 90 days, except where retention is required by law or for legitimate business purposes. Grant application data may be retained longer if required for compliance with grantor reporting requirements.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication and access controls
• API keys are stored using bcrypt hashing and are only displayed once upon creation
• Webhook signatures use HMAC-SHA256 to verify message authenticity
• Regular security assessments and monitoring
• Employee training on data protection
• Incident response procedures

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to:

• Essential Cookies: Required for the Service to function (authentication, security)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Understand how users interact with the Service
• Performance Cookies: Monitor and improve Service performance

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service. We honor "Do Not Track" signals where technically feasible.

9. Your Privacy Rights

9.1 Rights for All Users

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Portability: Request your data in a portable format
• Opt-Out: Unsubscribe from marketing communications

9.2 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information is collected, used, and disclosed
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt-out of the sale or sharing of personal information (we do not sell personal information)
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising privacy rights

To exercise your rights, contact us at privacy@seegrant.com or use the in-app privacy settings. We will respond within 45 days as required by law.

9.3 EEA/UK Residents (GDPR)

If you are in the European Economic Area or United Kingdom, you have additional rights:

• Right to restrict processing
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

9.4 Other State Privacy Laws

We comply with state privacy laws including the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and other applicable state regulations. Residents of these states may have similar rights to those described above.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 13 (or 16 in certain jurisdictions). If we become aware that we have collected personal information from a child under the applicable age, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@seegrant.com.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our servers and service providers are located. These countries may have different data protection laws than your jurisdiction.

When we transfer personal data internationally, we implement appropriate safeguards such as standard contractual clauses approved by relevant authorities, or rely on other valid legal mechanisms to ensure your data is protected.

12. Third-Party Links and Services

The Service may contain links to third-party websites, including grantor portals and government databases. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party services you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Updating the "Effective Date" at the top of this policy
• Sending you an email notification (for significant changes)

Your continued use of the Service after the effective date of the revised Privacy Policy constitutes your acceptance of the changes.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

SeeGrant Privacy Team
Email: privacy@seegrant.com

For California residents: You may also contact the California Attorney General's office at oag.ca.gov if you have unresolved privacy concerns.

By using SeeGrant, you acknowledge that you have read and understood this Privacy Policy.