Privacy Policy

Introduction

This Privacy Policy describes how SplendidBit LLC ("GrantBeacon," "we," "us," or "our") collects, uses, and discloses your personal information when you use our grant management platform and services (collectively, the "Service").

We are committed to protecting your privacy and complying with applicable privacy laws, including the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), California Online Privacy Protection Act (CalOPPA), California AI Transparency Act (SB 942), and Assembly Bill 2013 (AB 2013).

Information We Collect

Personal Information Categories (CCPA Table)

In the past 12 months, we have collected the following categories of personal information:

Detailed Information Collection

Account Information

When you create an account, we collect:

• Name and email address
• Organization name and details
• Password (encrypted)
• Profile preferences

Grant-Related Data

When you use our platform, we collect:

• Grant application documents and content
• Deadline and milestone information
• Communication with funders
• Budget and financial information
• Progress reports and outcomes data

Usage and Technical Data

• Login timestamps and IP addresses
• Device and browser information
• Feature usage statistics
• Error logs and performance data

Payment Information

Processed through Stripe, we store:

• Subscription plan details
• Billing history
• Payment method references (not full payment details)

How We Use Your Information

We use your personal information to:

• Provide and maintain the Service: Create accounts, process payments, deliver core functionality
• Improve our Service: Analyze usage patterns, develop new features, fix bugs
• Communicate with you: Send service updates, respond to inquiries, provide customer support
• Ensure security: Monitor for fraud, prevent unauthorized access, maintain system integrity
• Comply with legal obligations: Meet regulatory requirements, respond to legal requests
• AI features: Generate grant content suggestions (we do NOT use your data to train AI models)

Information Sharing and Disclosure

We do not sell your personal information. We share information only as described below:

Service Providers

We engage trusted third parties to perform functions and provide services:

• Supabase: Database, authentication, and file storage services
• OpenAI: AI-powered writing assistance (your data is not used for training)
• Stripe: Payment processing and billing management
• Vercel: Hosting and infrastructure services

Legal Compliance

We may disclose your information when required by law or to:

• Comply with legal obligations
• Protect our rights and property
• Prevent fraud or abuse
• Protect the safety of our users or the public

Business Transfers

If GrantBeacon is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights:

Right to Know

You can request information about:

• Categories of personal information we collect
• Specific pieces of personal information we hold
• Categories of sources of personal information
• Business purposes for collecting personal information
• Categories of third parties with whom we share information

Right to Delete

You can request that we delete your personal information, subject to certain exceptions (such as completing transactions, detecting fraud, or complying with legal obligations).

Right to Correct

You can request that we correct inaccurate personal information.

Right to Opt-Out of Sale/Sharing

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

Right to Limit Use of Sensitive Personal Information

You can limit our use of sensitive personal information to what is necessary to provide our services.

Non-Discrimination

We will not discriminate against you for exercising your CCPA rights.

AI Transparency

California AI Transparency Act (SB 942) Disclosure

GrantBeacon uses artificial intelligence to provide certain features, including:

• AI-powered grant writing assistance and content suggestions
• Automated deadline tracking and reminders
• Smart content analysis and recommendations

AB 2013 Compliance

Our AI systems use the following foundation models:

• Model: OpenAI GPT-4o-mini
• Training Data: Publicly available text data, licensed data, and data created by human trainers
• Customer Data Usage: We do NOT use customer data to train AI models

AI-Generated Content Disclaimer

AI-generated content is provided as a starting point for your grant applications. You are responsible for reviewing, editing, and ensuring the accuracy of all AI-generated content before submission. AI output should not be considered professional advice or a guarantee of grant success.

Data Retention

We retain your personal information for as long as necessary to:

• Provide and maintain our Service
• Comply with legal obligations
• Resolve disputes and enforce our agreements
• Detect and prevent fraud

Specific Retention Periods

• Account Information: Retained while account is active, plus 30 days after deletion
• Grant Documents: Retained while account is active, available for download for 30 days after account deletion
• Usage Data: Retained for 24 months for analytics, then anonymized
• Payment Records: Retained for 7 years for tax and accounting purposes
• Communication Records: Retained for 12 months

Security Measures

We implement appropriate technical and organizational security measures to protect your personal information:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access controls and multi-factor authentication
• Regular Audits: Security assessments and penetration testing
• Data Backups: Regular encrypted backups with geographic redundancy
• Employee Training: Privacy and security training for all employees
• Incident Response: 24-hour incident response procedures

International Data Transfers

GrantBeacon is based in the United States. Your information may be processed and stored in the United States or other countries with different data protection laws. We implement appropriate safeguards for international transfers in accordance with applicable law.

Children's Privacy

Our Service is not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately at privacy@grantbeacon.io.

Cookie Policy

We use only essential cookies necessary for the operation of our Service:

• Authentication Cookies: Maintain your login session
• Security Cookies: Prevent fraud and enhance security
• Preference Cookies: Remember your settings and preferences

We do not use tracking or advertising cookies. We honor Do Not Track signals from your browser.

Third-Party Services

We use the following third-party services to provide our Service:

Supabase

Database, authentication, and file storage services. Privacy Policy

OpenAI

AI-powered writing assistance. Privacy Policy

Stripe

Payment processing and billing. Privacy Policy

Vercel

Hosting and infrastructure services. Privacy Policy

ProPublica Nonprofit Explorer

Foundation and nonprofit data from IRS Form 990 filings. Privacy Policy | Data Terms of Use

Your Rights and Choices

Depending on your location, you may have additional rights:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Object to processing of your information
• Opt-out of marketing communications
• Data portability

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Privacy Requests

To exercise your privacy rights, you can:

• Email us at privacy@grantbeacon.io
• Submit a request through your account settings
• Call us at our support number (if available)

We will not discriminate against you for exercising your privacy rights.

Authorized Agents

You may designate an authorized agent to make privacy requests on your behalf. We will require verification of the agent's authority.