Privacy Policy

Product Tools LLC (“we,” “us,” “our”) operates Grantlas (grantlas.com), a grant- and funder-discovery service for nonprofits. This policy explains what information we collect, how we use it, and the choices you have. By using Grantlas you agree to this policy.

Information we collect

We collect only what we need to run the service:

• Account information. Your email address, which we use to sign you in with a one-time code and link (we do not store passwords) and to send you service email.
• Organization profile. Details about your nonprofit that you provide or that we draft from your public website or EIN — organization name, EIN, website, sector, location, budget range, program areas, and populations served. You can edit or remove these at any time.
• Usage of the service. Your saved searches, pipeline entries, notification settings, and team membership.
• Billing information. Subscriptions are handled by a third-party payment processor. We store only a customer and subscription reference and your plan status — your card details go directly to the processor, and we never see or store your full card number.
• Log and device data. Like most sites, our servers and our CDN automatically record standard technical data such as IP address, browser type, pages requested, and timestamps, for security and reliability.
• Cookies and analytics. Strictly necessary cookies keep you signed in and the app working. On our public pages we also use analytics cookies and a first-party cookie that remembers how you first found us — see “Analytics” below and our Cookie Policy.

How we use your information

• To provide the service — authenticate you, build your organization profile, and match and score grants and funders for you.
• To send transactional email — sign-in links, team invitations, and the weekly digest and deadline reminders you opt into.
• To process your subscription and manage billing through our payment processor.
• To secure, maintain, debug, and improve the service.
• To comply with legal obligations and enforce our Terms of Service.

Analytics

We use Google Analytics on our public pages — the homepage, the blog, and these policy pages — to understand which pages and sources lead people to sign up. It does not run inside the signed-in app.

What it collects. Pages viewed, interactions such as button clicks and scrolling, the site that referred you, campaign parameters in the link you followed (such as utm_source), your device and browser type, and an approximate location that Google derives from your IP address. When you sign up, start a trial, or make your first payment, we send Google a record of that event linked to the same pseudonymous analytics identifier. We never send your name, email address, or organization.

How it is limited. Google processes this data on our behalf and may not use it for its own advertising. We have turned off Google signals and ad personalization, we do not use analytics for advertising, and Google deletes this analytics data after 14 months.

First-touch attribution. When you create an account, we store with it how you first found Grantlas — the page you arrived on, the referring site, and any campaign parameters — so we can tell which channels work. This record stays in our own database.

Your choices. We honor the Global Privacy Control (GPC) signal: if your browser sends it, Google Analytics does not load. If your browser sends a GPC signal when you create your account, we don’t link your signup, trial, or payment events to Google Analytics either. You can also turn analytics off on our Cookie Policy page, or install Google’s opt-out browser add-on. Each of these applies to the browser you are using, so you would need to repeat it on another device, and opting out stops future collection rather than deleting what was already measured. If you would like the earlier data removed as well, email us and we will ask Google to delete it.

AI processing

Grantlas uses third-party AI language models to generate fit scores, fit reasoning, and eligibility reads. We send these models the minimum needed to answer the question and nothing more.

What we send. A short, fixed set of descriptive facts about your organization — things like sector, city and state, budget range, 501(c)(3) status, program areas, and populations served — together with the public grant or funder record being assessed. These are details you gave us, or that we drafted from your public website or EIN for you to review.

What we don’t send. We do not send your account or user information. Your email address, sign-in details, billing information, team membership, saved searches, and pipeline never leave Grantlas for this purpose. We don’t send your organization’s name, EIN, or website address either — the model sees an unlabeled profile, not an identified organization.

These outputs are generated automatically, may contain errors, and are not legal, financial, or professional advice — always verify before you rely on them.

Service providers

We share information with a small set of third-party vendors who process it on our behalf, only as needed to run Grantlas. They are bound by contract to protect it and to use it solely to provide their service to us. They fall into these categories:

• Payment processing — subscription billing and card handling.
• Transactional email — sign-in codes, team invitations, alerts and digests.
• AI model providers — the models that generate scores, reasoning and eligibility reads.
• Analytics — measuring which of our public pages and traffic sources lead to signups (Google Analytics).
• Hosting and infrastructure — application and database hosting. Grantlas is hosted and operated entirely in the United States.
• Content delivery, DNS, and security — keeping the service fast and protecting it from malicious traffic.

The exact providers we use change from time to time. If you need to know the specific vendors — for a due-diligence or board review — please email us and we can provide the most current list.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising — the terms California law uses for handing your information to advertisers. We do not use advertising networks or third-party ad tracking. We may disclose information when required by law, to comply with legal process, or to protect the rights, safety, and security of our users and our service.

Data retention

Cancelling is not deleting. If you cancel a subscription or let a trial lapse, we keep your organization profile, saved searches and pipeline so you can pick up where you left off if you come back. We do not delete anything automatically.

Deleting is a separate request. When you ask us to delete your account, we delete your personal information within 30 days, except where we must retain limited records to meet legal, tax, or accounting obligations. Tell us at team@grantlas.com and we will confirm when it is done.

Your rights

You may access, correct, or request deletion of the personal information we hold about you. Much of it you can edit directly in the app — your organization profile, saved searches, pipeline, and team. For anything else, email us at team@grantlas.com. We aim to respond within 30 days.

Several US states — California and others — give their residents these same rights by law, including the right to know what we hold, to have it corrected or deleted, and to opt out of the sale or sharing of personal information. We do not sell or share personal information, and we offer every one of these rights to everyone who uses Grantlas, wherever you live. We will never charge you more or give you a worse service for exercising them. If we turn a request down, reply to our answer and we will review the decision.

Security

We use reasonable technical and organizational measures to protect your information, including passwordless sign-in and encrypted connections. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

International users

Grantlas is operated in the United States and your information is processed and stored there. If you access the service from outside the United States, you understand that your information will be transferred to and processed in a jurisdiction whose data-protection laws may differ from those of your own.

Children

Grantlas is a business tool for adults. Our Terms require account holders to be at least 18, the service is not directed to children, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy from time to time. We’ll post the revised version here with a new effective date; continued use of Grantlas after a change means you accept the updated policy.

Contact

Product Tools LLC — team@grantlas.com