Privacy Policy

Version 2026-10-28.2 · Effective Oct 28, 2026

1. Who we are

GrantAssembly is built and run by Altivica, a sole proprietorship based in California ("Altivica", "we", "us"). This policy explains what information we collect through the portal at portal.grantassembly.com, our website at grantassembly.com and our emails (together, "GrantAssembly"), how we use it, who helps us, how long we keep it and the choices you have. It also serves as our notice at collection under California law. For questions or requests, email support@grantassembly.com.

2. What we collect

Account details: your email address, your first and last name if you give them, your organization's name, and a sign-in ID from Amazon Cognito. Cognito handles your password; we never see or store it. We also record when you agreed to our Terms of Service and this policy, and which versions.
Billing details: your plan, your trial and subscription status, a customer ID from Stripe, and the payment method's type, its last four digits and whether payments succeed. Stripe collects your full card or bank details directly; we never receive them.
What you enter: the clients you add and their details (including names and email addresses of contacts at those clients, if you add them), the grants you track, notes, tasks, checklists, watches and settings.
Documents: files you upload, plus the previews we make so you can view them in the portal.
Messages: what you send us when you email us for support.
Technical information: basic logs our cloud providers keep when you use GrantAssembly, such as IP address, browser type and the time of a request. We use them to keep the service secure and fix problems.

We collect this information from you, from the people you work with who use your account, from Amazon Cognito and Stripe when you sign in or pay, and automatically from your browser.

Cookies and browser storage. Your browser keeps your sign-in session and a few display preferences (such as list or grid view) so the portal works and remembers your choices. We don't use advertising cookies, and we don't use third-party analytics or tracking. When you add a payment method, Stripe's payment form may set its own cookies to help prevent fraud.

3. How we use it

to run GrantAssembly: sign you in, store your work and show it back to you;
to match grants to your clients and send you account emails, and the daily grant update unless you turn it off;
to bill you, and to manage your trial and subscription;
to answer support requests and tell you about important changes, such as changes to our terms, prices or this policy;
to keep the service secure, prevent fraud and abuse, and fix problems;
to count totals across all accounts, such as how many grants our customers have won, so we can understand and improve the service (see section 6);
to keep records and meet our legal, tax and accounting obligations, and to enforce our terms.

We don't use your information for any other purpose without telling you first.

4. AI features

Some features use artificial intelligence. When an AI feature is turned on, such as a fit summary for a grant, we send the information it needs (for example, the client's profile, the grant's details and your notes on that grant) to an AI model provider listed in section 5, which returns the result to us. We use providers that do not use this information to train their models. AI features don't make decisions about you; their output is shown to you to check.

Features that help you copy a prompt for an AI tool of your choice build the prompt in your browser. Nothing is sent to that tool unless you paste it there yourself, and that tool's own privacy policy then applies.

5. Who helps us (service providers)

We use a small number of service providers, all processing data in the United States. They process information only on our behalf, to provide their services to us, under their contracts with us:

Amazon Web Services: Amazon Cognito for sign-in, and Amazon SES to send sign-in and verification emails.
Microsoft Azure: runs the portal and stores your account data, grant records and uploaded documents.
Microsoft 365: sends the daily grant update and welcome emails from our grantassembly.com addresses, and handles email with our team.
Stripe: processes subscription payments and helps prevent payment fraud.
AI model providers, for AI features only: Anthropic's Claude models, used directly from Anthropic or through Microsoft Azure or Amazon Web Services.
Hostinger: hosts our domain names (DNS).

Grant and funder information in GrantAssembly comes from public sources such as Grants.gov, IRS Form 990 filings, the California Grants Portal and funders' own websites. It is about funders, not about you.

6. When we share information

We don't sell your information or your clients' information, and we don't share it for cross-context behavioral advertising (targeted ads). We haven't done either in the past 12 months. We share information only:

with the service providers listed in section 5, to run GrantAssembly;
with the people you give access to your account;
when the law requires it, such as a valid court order, or when we believe in good faith it is needed to protect the rights, property or safety of our users, the public or Altivica;
if Altivica or GrantAssembly is sold, merged or reorganized, in which case this policy still applies to your information, and we'll tell you before it becomes subject to a different policy.

We may also share combined totals, such as the number and dollar value of grants awarded to GrantAssembly customers. These totals never name you, your organization or your clients, or show any one account's numbers, and we don't try to re-identify anyone from them.

7. How long we keep it

While your account is open: we keep your information while your account is open. Deleting a grant, client or document in the portal deletes it. Deleted documents can be restored for 30 days, then they're removed permanently.
Paused or canceled accounts: if your trial ends or your subscription stops, your account is paused and your information is kept, so you can pick up where you left off. We keep a paused account's information until you ask us to delete it. If an account stays paused for more than 24 months, we may delete it after telling you by email at least 30 days in advance.
When you ask us to close your account: we delete your account data and documents within 30 days.
What we keep longer: billing and payment records, as long as tax and accounting law requires (generally up to 7 years); the record of which terms you agreed to, for as long as it may be needed to show what was agreed; and support emails, for up to 3 years. Our providers' technical logs are deleted on their normal schedules, generally within 90 days.

8. Security

Information travels over encrypted connections (HTTPS) and is encrypted at rest by our cloud providers. Documents are kept in private storage, and uploads and downloads use short-lived links. Access to production systems is limited to the people who run GrantAssembly. No system is perfectly secure. If we learn of a breach that affects your information, we'll tell you without unreasonable delay, as the law requires. We also keep a record of who opens your account: each time someone on it opens the portal, opens or downloads a document, or downloads the account's data, and any change GrantAssembly staff make to it. You can see this record in Account settings, under Your data. We keep it for a year, and it's deleted with your account.

9. Your rights and choices

You can see and edit most of your information in the portal, and download your documents at any time. In Account settings, under Your data, you can also download a copy of everything in your account in one file, and delete your account yourself. A deletion you ask for in the portal is scheduled 14 days ahead so you can change your mind, and then everything is deleted as section 7 describes, within 30 days of your request. You can also make these requests by email, as described below.

California residents have the right to:

know what personal information we collect, use and disclose, and get a copy of it in a portable form;
ask us to delete it;
ask us to correct it;
opt out of the sale or sharing of personal information (we don't sell or share it, so there is nothing to opt out of);
limit the use of sensitive personal information (we use your sign-in details only to sign you in and keep your account secure, so there is nothing to limit);
not be treated differently for using any of these rights.

To make a request, email support@grantassembly.com from the email address on your account, or tell us that address. We'll confirm we received it within 10 business days and respond within 45 days (or tell you if we need up to 45 more). To protect you, we'll verify your request by confirming it with you at your account's email address. You can use an authorized agent; we'll ask for proof that you authorized them and may ask you to confirm your identity with us. We may keep information where the law allows, for example to finish a transaction, meet a legal obligation or keep billing records. We honor Global Privacy Control signals as an opt-out request, though we don't sell or share information. We'll consider requests from people outside California too.

Emails. You can turn off the daily grant update email at any time, with the Unsubscribe link at the bottom of any daily update (no sign-in needed), or with the Daily grant update switch under Email preferences in Account settings. You can turn it back on the same way. Sign-in emails (verification codes and password resets), billing emails and important notices about your account or our terms are part of the service and can't be turned off while you have an account.

California "Shine the Light". We don't share personal information with others for their own direct marketing.

10. Information about your clients

When you add information about your clients and the people at them, we process it on your behalf, as your service provider, only to provide GrantAssembly to you. You decide what to add. If someone asks us about information an account holder entered about them, we'll pass the request to that account holder and help them respond.

11. Children

GrantAssembly is for organizations and the adults who work with them. It isn't meant for anyone under 18, and we don't knowingly collect information from children under 16. If you think a child has given us information, email us and we'll delete it.

12. Changes to this policy

If we change this policy in a way that matters, we'll tell you by email or in the portal before the change takes effect, and we may ask you to agree again when you next sign in. Each version has a version date at the top.

13. Contact

Questions or requests about your information? Email support@grantassembly.com.