Privacy Policy
Last updated: 21 October 2026
This notice explains what personal data Grantsium processes, why, on which legal basis, who receives it, how long we keep it and which rights you have under the EU General Data Protection Regulation (GDPR).
Who is responsible
The data controller for grantsium.com is the operator of Grantsium. You can reach us about anything in this notice at hello@grantsium.com.
For the content of a project (work plans, comments, time entries, wiki pages), the organisation that runs the project decides what is stored. Grantsium processes that content on its behalf.
What we collect
- Account: email address, optional name, and a password handled by our authentication provider (we never see it in plain text). If you turn on two-factor sign-in, a one-time-code secret.
- Your content: projects, work plans, comments, time entries and wiki pages you create.
- Invitations: when a project admin invites you, your email address, the project and the role.
- Usage: the calendar days on which you used the app, to count active users. No page-level tracking, device fingerprints or advertising identifiers.
- Security: technical data from the bot check on sign-up, log-in and password reset, and an audit log of staff actions in our internal console, where IP addresses are stored only as irreversible keyed hashes.
An email address is required to create an account; without it we cannot provide the service. Everything else is optional or created by you.
Why we use it and on which legal basis
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Create your account, sign you in and provide the service, including showing your projects to the members you choose | (b) performance of our contract with you |
| Emails about your account, invitations, assignments, comments and due work (work emails can be switched off in Settings) | (b) performance of contract |
| Store an invitee’s email address so they can join a project | (f) legitimate interest of the project team in inviting collaborators |
| Keep the service secure: bot check, session limits, audit logs | (f) legitimate interest in protecting accounts and data |
| Count active days to understand overall usage | (f) legitimate interest in running and improving the service |
| Keep records we are legally required to keep | (c) legal obligation |
We do not sell data, show ads, use advertising or analytics trackers, or make decisions about you by automated means, including profiling.
Who receives your data
- Members of a project see that project’s content. Nobody else does.
- A small number of our staff can access account information to provide support and keep the service safe. Access requires two-factor authentication and is audited. Internal support notes are encrypted.
We use these service providers (processors) under data processing agreements:
- Supabase: Database and sign-in (accounts, projects and all project content). Location: EU (Ireland).
- Vercel: Application hosting. Pages are produced on servers in the EU; requests pass through Vercel's global network. Location: EU (Dublin) for the application; global edge network.
- Resend: Sending emails: sign-in links, invitations, notifications and daily summaries. Location: EU (Ireland).
- Cloudflare: Domain name system, email forwarding for our public address, and Turnstile, the bot check on sign-up, log-in and password reset. Location: Global network.
The bot check processes technical signals such as your IP address and browser characteristics only to tell people from bots, never for advertising. The full list, with any changes, is on the Sub-processors page.
Transfers outside the EU
Some of these providers are companies based in the United States, so personal data may be accessible from outside the European Economic Area. Such transfers are protected by the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards. Grantsium is operated from Türkiye; where we access data from there, the same safeguards apply.
How long we keep it
- Account data and your content: as long as your account exists.
- When you delete your account we remove your profile, memberships, activity records and time entries. Projects where you were the only member are deleted; in shared projects, work you created remains for your team without your personal details.
- Invitations: expire after 14 days and are deleted 90 days after they were sent.
- Session cookies: at most 14 days (see the Cookie Policy).
Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it: export it as JSON on your Account page at any time;
- correct inaccurate data: edit your name and details on your Account page;
- erase your data: delete your account on your Account page;
- receive your data in a portable, machine-readable format (the JSON export);
- restrict processing, or object to processing based on legitimate interest;
- lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.
For any other request, write to hello@grantsium.com. We answer within one month.
Children
Grantsium is a professional tool and is not intended for children under 16.
Changes to this notice
We will update this page when our processing changes and change the date at the top. Material changes are announced in the app before they take effect.
Contact
Questions or requests: hello@grantsium.com