Privacy Policy

What we collect

When you use WinAGrant, we collect your name, email address, business information you enter into the eligibility quiz and grant writer or add from your own documents, and payment information (processed by Stripe; we never store raw card numbers). We also collect standard server logs (IP address, browser type, pages visited).

How we use it

We use your information to provide the grant-matching and AI grant-writing service, send you the grant alerts and emails you've requested, process your payment via Stripe, and improve the accuracy of our matching algorithm. We never sell or rent our email list, and no one pays us for your information. We do use an advertising tool from Meta that measures visits from its ads (see "Cookies, analytics & advertising" below). Some state privacy laws count that as "selling" or "sharing" personal information, so you can turn it off.

We share the business information you provide with Anthropic, our AI service provider, only as needed to write your drafts. Under Anthropic's commercial terms, that information is not used to train its models, and Anthropic's standard practice is to delete it within 30 days. We keep our copy in your account, as described in this policy.

If you upload a document (like a business plan or a past grant application), paste text, or share a link to your website, we send its contents to Anthropic to find facts about your business. We do not keep the file or the full text. We keep only the facts you choose to save, and you can see, edit, or delete each one on your profile page at any time. Please do not upload tax returns, bank statements, or documents with Social Security, tax ID, or account numbers.

If you use Draft Check, we send the draft you paste to Anthropic to check it. We don't save the draft, and we delete the report from our servers as soon as we email it, or after an hour if it isn't sent.

Data storage

Your account data is stored in Supabase (hosted on AWS). Our website runs on Railway. Payment data is stored and processed by Stripe. Emails are sent via Resend, and our own mailboxes (like privacy@winagrant.com) are hosted by Microsoft 365. Our providers maintain industry security certifications such as SOC 2.

Your rights

You can request a copy of your data, correction of inaccurate data, or deletion of your account at any time by emailing privacy@winagrant.com. We delete your personal data within 30 days of verifying your request, except for records we are legally or contractually required to keep. Those exceptions include:

• billing and payment records, for tax, accounting, and chargeback purposes;
• records of your consent to a paid subscription and the terms shown to you when you enrolled, which subscription and consumer-protection laws require us to keep for a set period, generally at least three years;
• security and fraud-prevention logs; and
• records we must preserve for a legal hold, a dispute, or to comply with the law.

We keep these records only as long as the applicable obligation requires, and we delete them when that obligation ends. Closing your account cancels future Scout renewals, but by itself it does not erase records we are required to retain. If you unsubscribed from our emails, we keep your email address on our do-not-email list even after you delete your account, so we never email you again by mistake.

Cookies, analytics & advertising

We use session cookies to keep you signed in. We also use three third-party tools to understand how the site is used and whether our advertising works. Each sets its own cookies.

• Meta Pixel (Meta Platforms) receives the address of the page you are on, the page you came from, your browser and device details, your IP address, and a short list of actions: viewing a page, finishing the quiz, starting checkout, completing a purchase, and starting Scout.
• Google Analytics 4 (Google) receives the same kind of page, device and action information, plus how you move through the quiz (for example, "question 2 answered"). It gets your approximate location from your IP address.
• Microsoft Clarity (Microsoft) records how you use our pages: clicks, scrolling, mouse movement and the page as it appears on your screen, which Microsoft calls session replay. We hide the parts that show your quiz answers, your business details and your grant matches from these recordings, and Clarity hides anything you type into a form.

None of these tools receives your name, your email address, your business name, the answers you give in the quiz, or your payment details.

Some of our pages are reached from links in our emails or carry one-time codes: unsubscribing, confirming your email, resetting your password, signing in, cancelling Scout, turning on Scout alerts, and any billing pages. None of the tools above load on those pages, and those pages tell your browser not to share their address with any other site.

You can opt out of this tracking: use Meta's ad settings, Google's Analytics opt-out, and Google's My Ad Center, or block these cookies in your browser. Blocking cookies from clarity.ms stops Clarity recording you. The site works fine without any of them. You can read how Microsoft handles Clarity data in Microsoft's privacy statement.

If your browser sends a Global Privacy Control (GPC) signal, we treat it as your request to opt out of the sale of your personal information and its sharing for cross-context behavioral advertising, as California and some other state laws define those terms. On that browser we do not load the Meta Pixel or Microsoft Clarity, and Google Analytics runs with its advertising features turned off. This happens automatically. Nothing else about the site changes for you. Browsers such as Firefox, Brave and DuckDuckGo can send GPC, and extensions can add it to others. We do not respond to the older Do Not Track signal; GPC is the one we honor.

Our emails may use link-click and open tracking through our email provider, Resend, so we can see whether emails arrive and which links are useful. Turning off images in your email app stops open tracking. Some links in our emails also pass through our own address (winagrant.com/r/...) on the way to the page. When you click one, we record which email and which link it was, the time, your browser's user agent, and scrambled versions of your email address and IP address. We store the scrambled versions, never the address or IP itself. We also set a small cookie called wag_ck that lasts 10 minutes, so the page you land on can tell us a real person arrived, not an automated link scanner. We use this only to learn which emails help people, and we delete these records after 180 days or when you delete your account.

Children

WinAGrant is for adults running a business or nonprofit. It is not meant for anyone under 18, and we do not knowingly collect information from children. If you think a child has given us information, email privacy@winagrant.com and we will delete it.

Contact

WinAGrant is operated by WinAGrant LLC, a Virginia limited liability company, which is responsible for your information under this policy.

Questions about privacy? Email privacy@winagrant.com.