Data Processing Agreement
The processor terms most institutions require before a tool may touch an unsubmitted proposal. Available countersigned on request.
01 Roles of the parties
This agreement is between you and GrantPanel LLC, a Texas limited liability company (“GrantPanel”). For personal data contained in materials you submit, you are the controller and GrantPanel is the processor. For your account record, billing history, and operational logs, GrantPanel is the controller. This agreement governs the first category.
02 Scope and instructions
GrantPanel processes submitted materials solely to deliver the review you requested and solely on your documented instructions, which are given by your use of the service. We will tell you if an instruction appears to conflict with applicable data protection law.
03 Categories of data and subjects
Data subjects are the investigators, collaborators, and personnel named in a submitted package. Categories are limited to what appears in a proposal: names, affiliations, roles, biographical sketches, and contact details. Do not upload special-category data, human-subject records, or identifiable clinical data.
04 Security measures
Encryption in transit and at rest, access to production data limited to the operators who run the service, an append-only audit log of every time staff open a report, separation of each account's runs, and short retention with automated deletion. The full technical and organisational measures schedule is available on request.
05 Subprocessors
You give general authorisation for the subprocessors listed on the Subprocessors page. We remain liable for their performance and will give 30 days' notice before adding a new one that processes customer content, during which you may object and terminate.
06 Breach notification
We will notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your materials, with the facts known at the time and the measures taken.
07 Assistance and data subject rights
We will assist you in responding to data subject requests, and in your data protection impact assessments and consultations, taking into account the nature of processing and the information available to us.
08 Return and deletion
Submitted files are deleted automatically when each run ends, whether it succeeded or failed. The one exception is the solicitation: a copy is kept with the proposal so its revision runs need not upload it again, and it is deleted when the proposal's 60-day window closes, along with any text fetched from its web address. GrantPanel suggests revisions in the report and never modifies the proposal. Reports remain available to the account holder until they delete them; a deleted review keeps only a record that the run took place, with the credit it used and its processing cost. On termination, we delete your remaining account data and generated reports within 30 days, except billing records we must retain for accounting or legal compliance.
09 Audits
We will make available the information necessary to demonstrate compliance and will respond to reasonable audit requests, ordinarily by providing our security documentation and completed questionnaires rather than an on-site inspection.
10 Signing the DPA
Request the countersignable version at hello@grantpanel.ai. Where your institution requires its own paper, send it and we will review; a negotiated institutional agreement controls where it conflicts with this document.