Privacy Policy

01 The short version

Your proposal is never kept. Your proposal and supporting files are held in encrypted storage only while the review runs, and are deleted automatically as soon as it finishes. What we keep is narrow: the panel's written report, the solicitation for your proposal's revision runs (up to 60 days), your account and purchase records, and minimal operational logs. We do not sell your information, we do not show ads, and nothing you submit is used to train AI models.

02 What we collect

• Account: your name, email address, institution, and sign-in method. If you sign in with Google, Google shares your name and email with us.
• Purchases: what you bought, when, and the amount. Card details go directly to Stripe and never reach GrantPanel.
• What you submit: the proposal, the solicitation or its web address, supporting documents, any review guidance you type, and the name you give a run.
• What the service produces: reports, the deliberation, the revision plan, and a technical record of each model call: which provider and model ran, how long it took, and what it cost.
• What you send us: feedback, report ratings, and messages through the support or contact forms.
• Operational logs: sign-in and security events, and a record of the email we send you.

03 How we use it

To run the reviews you ask for, keep your reports in your account, process payments and refunds, send the email described below, answer support requests, prevent abuse and fraud, and keep the service secure. We use aggregate figures, such as run times and costs, to operate the service. We do not sell or rent personal information, and we do not use it for advertising.

04 Where your proposal goes during a review

Your files are sent to our AI model providers, Anthropic and OpenAI, to produce the review. They receive the documents as you submitted them, including any names or institutions printed in them, and nothing from your account record. Under their commercial API terms they do not train on this content; they may keep it for a limited period, typically up to 30 days, for abuse and safety monitoring.

Two other things leave during a run. The titles and DOIs in your reference list are looked up in the Semantic Scholar database to check that the cited works exist; the rest of the proposal is not sent. When web search is on for a stage, the model provider runs searches whose terms may come from your proposal. Every third party is listed on the Subprocessors page.

05 Who at GrantPanel can see it

A small number of GrantPanel staff operate the service. They can see account and billing records to provide support. They open one of your reports only to answer a request from you or to investigate a fault or misuse, and every opening is recorded in an append-only audit log with who opened it and when. Once your uploaded files are deleted, nobody at GrantPanel can retrieve them.

06 How long we keep it

• Your proposal and supporting files: deleted automatically as soon as the review finishes, whether it succeeded or failed. The suggested revisions in your report are prepared before they go; GrantPanel never edits your proposal.
• The solicitation kept for revision runs: held with the proposal so later runs need not re-upload it, and deleted when the proposal's 60-day window closes, including any text fetched from its web address.
• Solicitations fetched from a public web address: the agency's published call is cached for up to 60 days, so another run citing the same address need not fetch it again. It contains nothing you uploaded.
• Reports: kept in your account until you delete them. Deleting a review erases its report, deliberation, revision plan, name, and files at once. A record that the run took place, with the credit it used and its processing cost, stays with your purchase history.
• Account and purchase records: kept while your account is open, and afterwards only as long as accounting, tax, and legal obligations require.
• Support messages and feedback: kept to answer you and improve the service. Feedback about a review you delete loses its text. Messages you send us, and the email we send you, also sit in our Google Workspace mailbox, which keeps them under its own retention, apart from your account.
• When you close your account: your reviews, files, profile, and messages to us are deleted. What stays is what the law and security need: purchase and refund records, the security audit log (which refers to the account by an internal id, not your email), and your address on our do-not-email list if you unsubscribed.
• Backups: the database is backed up by our hosting provider for disaster recovery, and each backup is overwritten on its fixed schedule. If a backup is ever restored, every deletion made since it was taken is applied again automatically.

07 Email

We send account email: sign-in codes, receipts, notices that a report is ready or a run failed, and reminders before a proposal's window closes. You can turn off report notifications in your account settings. Product announcements are occasional and each carries an unsubscribe link; unsubscribing stops announcements, not account email.

08 Service providers

We use selected hosting, storage, model, authentication, email, and payment providers to operate GrantPanel. Each processes data only to provide its service to us, under contractual and technical controls appropriate to its role. The full list, and what each receives, is on the Subprocessors page.

09 Your choices and rights

You can export any report as HTML or PDF from the report itself, delete any review from your Reviews page, change your notification settings, and sign out from Account settings. To get a copy of the data we hold about you, correct it, or close your account and delete it, write to hello@grantpanel.ai from your account address and we will confirm once it is done. Records we must keep for accounting, tax, or legal reasons are kept only as long as those reasons last.

Depending on where you live, you may have further rights, such as to object to or restrict processing, or to complain to a data protection authority. California residents have the right to know, delete, and correct personal information. We do not sell or share personal information as California law defines those terms, and we will not treat you differently for exercising any of these rights.

10 Where data is processed

GrantPanel is operated from the United States, and your information is processed and stored in the United States. If you use GrantPanel from elsewhere, your information is transferred to the United States. Institutions that need transfer terms can request our Data Processing Agreement.

11 Age

GrantPanel is for adults preparing grant proposals. It is not directed to children, and we do not knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

12 Security

No system is risk-free. We use access controls, encryption in transit and at rest, short retention, and audit logging designed for sensitive, unpublished research materials. The Security page describes each control. If you believe you have found a vulnerability, report it to hello@grantpanel.ai and we will respond.

13 If there is a security breach

If we learn that someone has gained unauthorized access to personal information we hold, we will act to contain it, investigate what was affected, and email the affected account holders without undue delay and within the time the law requires. The notice will say what happened, what information was involved, what we have done about it, and what you can do. Where the law requires it, we will also notify the relevant authorities. Institutions under our Data Processing Agreement are notified within 72 hours, as it provides.

Short retention limits what a breach could reach: uploaded files are gone once their deletion window closes, we never hold your password, and card details stay with Stripe.

14 Institutional review

Research-development offices and IT security teams evaluating GrantPanel can request our data-flow summary, subprocessor list, and retention schedule. We will complete standard vendor security questionnaires.

15 Changes to this policy

We will note changes on this page with a new effective date, and email account holders before a change to how submitted materials are handled takes effect.

16 Contact

GrantPanel is operated by GrantPanel LLC, a Texas limited liability company, which is responsible for the personal information described in this policy. Privacy questions, deletion requests, and data-access requests can be sent to hello@grantpanel.ai. We aim to respond within five business days.