Privacy Policy

Product Tools LLC (“we,” “us,” “our”) operates Grantlas (grantlas.com), a grant- and funder-discovery service for nonprofits. This policy explains what information we collect, how we use it, and the choices you have. By using Grantlas you agree to this policy.

Information we collect

We collect only what we need to run the service:

• Account information. Your email address, which we use to sign you in with a one-time code and link (we do not store passwords) and to send you service email.
• Organization profile. Details about your nonprofit that you provide or that we draft from your public website or EIN — organization name, EIN, website, sector, location, budget range, program areas, and populations served. You can edit or remove these at any time.
• Usage of the service. Your saved searches, pipeline entries, notification settings, and team membership.
• Billing information. Subscriptions are handled by a third-party payment processor. We store only a customer and subscription reference and your plan status — your card details go directly to the processor, and we never see or store your full card number.
• Log and device data. Like most sites, our servers and our CDN automatically record standard technical data such as IP address, browser type, pages requested, and timestamps, for security and reliability.
• Cookies and analytics. Strictly necessary cookies keep you signed in and the app working. On our public pages we also use analytics cookies and a first-party cookie that remembers how you first found us — see “Analytics” below and our Cookie Policy.
• Affiliate referrals. If you arrive through a link shared by a Grantlas affiliate, we save that referral on your account when you sign up and pass it to our payment processor at checkout, so the affiliate who sent you is credited. See “Affiliate program” below.

How we use your information

• To provide the service — authenticate you, build your organization profile, and match and score grants and funders for you.
• To send transactional email — sign-in links, team invitations, and the weekly digest and deadline reminders, which you can turn off.
• To send getting-started emails during your first week, which you can unsubscribe from.
• To see which of our emails are useful. Our emails contain a small image that tells us whether an email was opened and whether a link in it was clicked. We use this only to see which emails are useful.
• To process your subscription and manage billing through our payment processor.
• To secure, maintain, debug, and improve the service.
• To comply with legal obligations and enforce our Terms of Service.

Analytics

We use Google Analytics on our public pages — the homepage, the blog, and these policy pages — to understand which pages and sources lead people to sign up. It does not run inside the signed-in app.

What it collects. Pages viewed, interactions such as button clicks and scrolling, the site that referred you, campaign parameters in the link you followed (such as utm_source), your device and browser type, and an approximate location that Google derives from your IP address. When you sign up, start a trial, or make your first payment, we send Google a record of that event linked to the same pseudonymous analytics identifier. We never send your name, email address, or organization.

How it is limited. Google processes this data on our behalf and may not use it for its own advertising. We have turned off Google signals and ad personalization, we do not use analytics for advertising, and Google deletes this analytics data after 14 months.

First-touch attribution. When you create an account, we store with it how you first found Grantlas — the page you arrived on, the referring site, and any campaign parameters — so we can tell which channels work. This record stays in our own database.

Your choices. We honor the Global Privacy Control (GPC) signal: if your browser sends it, Google Analytics does not load. If your browser sends a GPC signal when you create your account, we don’t link your signup, trial, or payment events to Google Analytics either. You can also turn analytics off on our Cookie Policy page, or install Google’s opt-out browser add-on. Each of these applies to the browser you are using, so you would need to repeat it on another device, and opting out stops future collection rather than deleting what was already measured. If you would like the earlier data removed as well, email us and we will ask Google to delete it.

AI processing

Grantlas uses third-party AI language models to generate fit scores, fit reasoning, and eligibility reads. We send these models the minimum needed to answer the question and nothing more.

What we send. A short, fixed set of descriptive facts about your organization — things like sector, city and state, budget range, 501(c)(3) status, program areas, and populations served — together with the public grant or funder record being assessed. These are details you gave us, or that we drafted from your public website or EIN for you to review.

What we don’t send. We do not send your account or user information. Your email address, sign-in details, billing information, team membership, saved searches, and pipeline never leave Grantlas for this purpose. We don’t send your organization’s name, EIN, or website address either — the model sees an unlabeled profile, not an identified organization.

These outputs are generated automatically, may contain errors, and are not legal, financial, or professional advice — always verify before you rely on them.

AI apps you connect

You can connect Grantlas to an AI app such as Claude or ChatGPT. The app can then look up funders and grants for the organization you connect and, when you ask, save, track or change items there.

What the app receives. The funders, grants, fits and lists it looks up for you, and your organization’s profile only while profile sharing is on. It never receives your billing details.

An AI app you connect isn’t one of our service providers: its own provider (Anthropic for Claude, OpenAI for ChatGPT) handles what you type and what Grantlas returns, under that provider’s own terms and privacy policy.

You can turn profile sharing off or disconnect at any time in Settings → Integrations. Disconnecting ends access immediately.

Service providers

We share information with a small set of third-party vendors who process it on our behalf, only as needed to run Grantlas. They are bound by contract to protect it and to use it solely to provide their service to us. They fall into these categories:

• Payment processing — subscription billing and card handling.
• Email delivery — sign-in codes, team invitations, alerts, digests and getting-started emails, including whether they were opened or clicked.
• AI model providers — the models that generate scores, reasoning and eligibility reads.
• Analytics — measuring which of our public pages and traffic sources lead to signups (Google Analytics).
• Affiliate program — tracking referrals from our affiliates and paying their commissions (PromoteKit, with payouts through Stripe).
• Hosting and infrastructure — application and database hosting. Grantlas is hosted and operated entirely in the United States.
• Content delivery, DNS, and security — keeping the service fast and protecting it from malicious traffic.

The exact providers we use change from time to time. If you need to know the specific vendors — for a due-diligence or board review — please email us and we can provide the most current list.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising — the terms California law uses for handing your information to advertisers. We do not use advertising networks or third-party ad tracking. We may disclose information when required by law, to comply with legal process, or to protect the rights, safety, and security of our users and our service.

Affiliate program

Our affiliate program is open to US residents and US businesses (see the Affiliate Terms). PromoteKit runs it for us.

• If you were referred. PromoteKit records the visit when you arrive through an affiliate’s link, and receives your email address and payment amounts from our payment processor so the affiliate’s commission can be worked out. The affiliate sees that a referral signed up and paid, but not your email address: their affiliate portal hides it. If you open an affiliate’s invite link, we also set our own cookie, gl_referral_banner, for about 60 days. It holds the affiliate’s code and name, so we can show you a reminder and apply the discount at checkout, and it isn’t shared with PromoteKit or anyone else. It is set even if you’ve turned analytics off or use the GPC signal. PromoteKit then doesn’t load: you still get the discount, but the affiliate isn’t credited.
• If you’re an affiliate. We and PromoteKit use your name, email address, referral activity and commissions to run the program. If you’re a Grantlas customer and join from Settings, we create your affiliate account from your account email. To get paid, you connect a Stripe account, and Stripe collects and holds your identity, bank and tax information (SSN or EIN). We don’t see or store it. PromoteKit files 1099 tax forms with the IRS using what Stripe holds.

Data retention

Cancelling is not deleting. If you cancel a subscription or let a trial lapse, we keep your organization profile, saved searches and pipeline so you can pick up where you left off if you come back. We do not delete anything automatically.

Deleting is a separate request. When you ask us to delete your account, we delete your personal information within 30 days, except where we must retain limited records to meet legal, tax, or accounting obligations. Tell us at team@grantlas.com and we will confirm when it is done.

Your rights

You may access, correct, or request deletion of the personal information we hold about you. Much of it you can edit directly in the app — your organization profile, saved searches, pipeline, and team. For anything else, email us at team@grantlas.com. We aim to respond within 30 days.

Several US states — California and others — give their residents these same rights by law, including the right to know what we hold, to have it corrected or deleted, and to opt out of the sale or sharing of personal information. We do not sell or share personal information, and we offer every one of these rights to everyone who uses Grantlas, wherever you live. We will never charge you more or give you a worse service for exercising them. If we turn a request down, reply to our answer and we will review the decision.

Security

We use reasonable technical and organizational measures to protect your information, including passwordless sign-in and encrypted connections. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

International users

Grantlas is operated in the United States and your information is processed and stored there. If you access the service from outside the United States, you understand that your information will be transferred to and processed in a jurisdiction whose data-protection laws may differ from those of your own.

Children

Grantlas is a business tool for adults. Our Terms require account holders to be at least 18, the service is not directed to children, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy from time to time. We’ll post the revised version here with a new effective date; continued use of Grantlas after a change means you accept the updated policy.

Contact

Product Tools LLC — team@grantlas.com