Privacy Policy

The controller is the operator of GrantShip: [OPERATING ENTITY, ADDRESS] (“GrantShip”, “we”, “us”). For anything about your personal data, write to cynthia@grantship.com.

Visiting the website. Our hosting provider necessarily processes your IP address, browser and device details, the pages requested and the time, to deliver the site, keep it secure and diagnose faults. We use your IP address’s country (supplied by our host) to show the version of the homepage for your country; we do not store your IP address in our own database.

Free account and grant alerts. When you sign up or sign in we process your email address and, if you give them, your name and company. You sign in with a one-time link sent by email (no password); we keep a record of issued links to make them single-use and to prevent abuse. In onboarding you can describe your company: country of incorporation and activity, founding year, headcount and revenue band, stage, sectors, technology readiness level (TRL), applicant type, academic partner and funding types of interest. We use this profile to rank open calls for you and, unless you switch it off, to send a weekly grant-alert email. We also store the calls you save, the applications, tasks and documents in your workspace, the colleagues you invite, and a log of which alerts we sent you.

Newsletter and announcements. If you subscribe to our newsletter we process your email address and, if given, your name. We usually ask you to confirm by clicking a link first. When you confirm your account email for the first time, we also add you to our newsletter list. Every newsletter, announcement and grant-alert email contains an unsubscribe link, and unsubscribing from one kind of email does not affect your account.

Enquiries, bookings and orders. When you use one of our forms (ask a question, book a call, request a guide, check a discount, enquire about a plan or partnership, or apply for a specific programme) we process the details you enter, typically name, email, company, role, phone, website and your message. When you order a plan we also process billing details: company legal name, billing address, VAT/UID number, purchase-order reference, preferred start and notes. We store these in our database and our email provider’s contact list, and forward them to our team by email, to answer you, prepare an offer or contract, and follow up.

Coaching and your workspace. If you work with a GrantShip coach, we process the messages you exchange, the documents you upload (for example draft proposals and budgets, stored privately) and the status of your applications, to deliver the coaching. New messages trigger an email notification that contains the message text.

Coach applications. If you apply to coach with us we process your name, email, LinkedIn profile, location, languages, programmes, evaluator or jury experience, sectors, availability and message, to assess your application and contact you about it.

Information from other sources. We collect information about funding programmes and calls from funders’ public websites and the EU Funding & Tenders portal, and publicly announced funding results from the Rockstar Feed (feed.rockstar.jobs). This is mostly information about organisations, but it can include names of companies, founders or event speakers. We may also record business contacts introduced to us by partners.

Where the GDPR applies, we rely on:

• Contract and pre-contractual steps (Art. 6(1)(b)) — running your account, alerts you asked for, answering enquiries, offers and coaching.
• Consent (Art. 6(1)(a)) — the newsletter where we asked for it. You can withdraw consent at any time with effect for the future.
• Legitimate interests (Art. 6(1)(f)) — securing the Service and preventing abuse, measuring usage in aggregate, informing existing users about related services and events, following up on business enquiries, and maintaining our grant database.
• Legal obligations (Art. 6(1)(c)) — for example keeping accounting records.

Under the FADP we process personal data in line with its principles; where we rely on consent, we ask for it.

We compare your company profile with the criteria of each call and rank calls by how well they appear to fit, with the reasons shown. This is a sorting aid only. It does not decide whether you are eligible, does not decide anything about you that has legal or similarly significant effects, and funders never see it. Only the funder decides on eligibility and funding.

We use an AI model from Anthropic to read funders’ public call pages and turn them into structured call information (deadlines, amounts, eligibility). We send it only the content of those public pages. We do not send it your profile, enquiries, messages or documents.

Within GrantShip, your data is accessible to the team members and coaches who need it: your assigned coach sees your workspace, and colleagues you invite see the workspace you share with them. Coaches may be independent contractors working for GrantShip under a duty of confidentiality. We also use these service providers (processors), only as needed to run the Service:

• Vercel Inc. (USA) — hosting, delivery, server logs, private file storage for uploads (Vercel Blob), bot protection (BotID) and privacy-friendly usage statistics (Vercel Web Analytics and Speed Insights).
• Neon Inc. (USA) — our Postgres database, which holds account, profile, workspace and enquiry data.
• Resend (Plus Five Five, Inc., USA) — sending email and managing contact and newsletter lists.
• Anthropic PBC (USA) — extraction of public funder pages only; no personal data of yours (section 5).
• Google (Google Ireland Ltd. / Google LLC, USA) — our booking calendar is a Google Calendar appointment schedule shown inside our pages. When it loads, Google receives your IP address and browser details and may set its own cookies; what you enter to book (name, email, note) goes to Google under Google’s own terms and privacy policy.

We disclose data to authorities or others where the law requires it, or to protect our rights. If GrantShip or its business is transferred, data may pass to the acquirer under this policy. We do not sell personal data and do not share it with advertisers.

Several providers above are based in the USA or may process data there or in other countries. Where a country does not offer adequate protection under Swiss or EU law, we rely on recognised safeguards: the provider’s certification under the Swiss-US or EU-US Data Privacy Framework where it holds one, or otherwise the European Commission’s Standard Contractual Clauses (as adapted for Switzerland), or another exception permitted by law. You can ask us for details.

• Account, profile and workspace data — while your account is active; after you ask us to close it, we delete or anonymise it within a reasonable period, unless we must keep it.
• Enquiries and leads — as long as needed to handle the enquiry and follow up, generally no longer than 24 months after our last contact, unless a contract follows.
• Contracts, orders and invoices — for the statutory retention period, usually 10 years (Art. 958f Swiss Code of Obligations).
• Newsletter — until you unsubscribe; we keep a record of the unsubscription so we can respect it.
• Sign-in links, email logs and server logs — only as long as needed for security, abuse prevention and troubleshooting.

We use no advertising or cross-site tracking cookies. We use only the following:

• gs_member (strictly necessary, 30 days) — keeps you signed in to your account. Set only after you sign in.
• gs_country (preference, 1 year) — remembers the country you picked for the site.
• gs_geo (functional, 1 day) — caches the country of your IP address so the country picker shows the right flag. It holds a country code, not your IP address. (Older visitors may still carry gs_market, which we replace with gs_country.)
• gs_admin, gs_view_as (strictly necessary, staff only) — sign-in and preview for GrantShip staff.
• gs-theme (local storage, preference) — your light/dark choice, if you change it.
• gs-announcement-dismissed:… (local storage, preference) — remembers that you closed an announcement bar.

Vercel Web Analytics and Speed Insights measure page views, a few anonymous events (such as that a form was submitted, without its contents) and loading performance in aggregate and, according to Vercel, without cookies. Vercel BotID runs a short check in your browser on our forms and sign-in to tell people from bots. Embedded Google booking calendars may set Google cookies (see section 6). You can delete cookies and local storage in your browser at any time; the site still works, but you will be signed out and your preferences reset.

Our pages link to other websites, for example event pages on Luma, funder websites, and our partners Rockstar Recruiting (rockstar.jobs), techxecutive (techx.jobs) and hackevents (hackevents.net). Company logos in our funding feed may load directly from those companies’ own websites, which then receive your IP address. Those sites are responsible for their own data processing. Partner links carry a campaign tag so partners can see the visit came from GrantShip; they do not carry your personal data.

We use appropriate technical and organisational measures, including encrypted connections (HTTPS), single-use, short-lived sign-in links, signed session cookies, private storage for uploaded documents with access checks on every download, and access limited to people who need it. No system is completely secure, and we cannot guarantee the security of data sent over the internet.

Subject to the applicable law, you can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interests, including direct marketing, and withdraw consent at any time. Email cynthia@grantship.com. We may need to verify your identity, and we may refuse or limit a request where the law allows, for example where we must keep records.

You can also complain to a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC / EDÖB, edoeb.admin.ch); in the EU/EEA, the authority of your place of residence or work. We would appreciate the chance to resolve your concern first.

The Service is meant for businesses and professionals. It is not directed at children under 16, and we do not knowingly collect their data. If you think a child has given us data, tell us and we will delete it.

We may update this policy when the Service or the law changes. The version published here applies, and the date at the top shows when it last changed. If a change materially affects how we use data we already hold, we will tell account holders by email. See also our Terms of Use.