Short version: we don't sell your personal data.

What we collect

We collect — and may retain — the information you provide through the site and data about how the site is used:

• Your inputs and the AI's outputs. The answers you select and the free text you type into the eligibility chat, the security self-assessment, and the AI grant-writing assistant — including any facility or vulnerability details you choose to share — plus the categorical answers derived from them (state, 501(c)(3) status, risk profile, etc.), the AI's responses, and the drafts generated for you.
• Your email when you register or unlock the AI grant-writing assistant, so we can give you access and send what you asked for.
• Contact details (name, title, organization, email) when you submit a form that asks for them — for example the "tell us about your nonprofit" follow-up or the vendor directory signup.
• Purchase records. Payments are processed by Stripe; your card number goes to Stripe, not to our servers. We keep a record of the purchase — what you bought, when, and the email it's tied to.
• Usage and analytics data. How the site and the AI tools are used — which tool, token counts, cost, and interaction patterns — plus page-view counts, traffic sources, and country-level location via Vercel Analytics and, if you accept the banner, Google Analytics.
• Abuse prevention. To rate-limit automated abuse of our tools, we keep a one-way hashed (not reversible) form of your IP address as an anonymous counter — it isn't linked to your identity or anything else you submit. We never store your raw IP address.

How we use it

• To provide the services — run your eligibility check, write your self-assessment summary, generate your drafts, and give you access to what you unlocked.
• To communicate with you — send what you asked for and service-related updates.
• To secure the site — prevent abuse and fraud, enforce rate limits, and troubleshoot problems.
• To improve and develop the services — including training and evaluating the models and features that power them, using data in de-identified and/or aggregated form. Before we use data this way, we remove or mask the details that identify you or your organization, and we don't attempt to re-identify it.

Who we share with

We don't sell your personal data. We don't sell or rent your email address or your answers to advertisers, and we don't hand your details to security vendors. The third parties that touch your data are the service providers that run the site, each processing data on our behalf: Supabase (database), Vercel (hosting + analytics), Resend (email delivery), Anthropic (AI), Tavily (web search), Stripe (payments), and, if enabled, Google Analytics. Each is bound by its own privacy commitments.

Data that has been de-identified or aggregated — so it no longer identifies you or your organization — may be used and shared, for example as statistics about grant programs, for research, or to improve and develop our services. We may also disclose information if the law requires it.

We're building a vendor directory to help awarded nonprofits find security installers. If and when it launches, any contact with a vendor is something you choose to start — a vendor never receives your identity or details unless you reach out. We'll update this policy before that changes.

AI features

When you use the AI grant-writing assistant or the AI-written self-assessment summary, the answers you type — including any vulnerability details — are sent to our AI provider, Anthropic, to generate your result. For the grant-writing assistant, a short research query — limited to your state and the grant program, and deliberately not including your mission, your “why we're a target” details, or any vulnerability findings — may also be sent to our web-search provider, Tavily. Anthropic states it does not use commercial API inputs or outputs to train its models (see Anthropic's commercial terms); third-party policies can change. Tavily may retain and use the search queries it receives, which is why we keep those queries limited to your state and the grant program. As a general rule, and especially with anything sensitive, share only what you're comfortable sending — and avoid putting exact street addresses or individuals' names in the free-text fields.

How long we keep it

We keep data for as long as we need it for the purposes above — to provide the services, keep the site secure, improve and develop our tools, and meet legal, tax, and accounting obligations (purchase records, for example, have to be kept for a period set by law). When we no longer need data in a form that identifies you, we delete it or de-identify it.

Your choices & how to delete your data

You can ask us for a copy of the personal data we hold about you, or ask us to delete it, by emailing hello@securitygrants.com from the address you used on the site. We'll remove the personal data associated with it within 30 days, except records we're legally required to keep (such as purchase records). There's no automated self-service deletion yet because we want to confirm requests are legitimate — automation is on the roadmap.

One honest caveat: data that has already been de-identified or aggregated — and folded into our analytics or used to improve our models — is no longer linked to you, so we can't trace it back to delete it. Deletion covers everything that still identifies you. And as the short version says: we don't sell your personal data, so there's nothing to opt out of on that front. You can also decline analytics cookies via the banner (see Cookies below).

Cookies

We don't use advertising cookies and we don't run cross-site ad tracking. Vercel Analytics is cookieless — it counts page views using a privacy-preserving hash of each request that is automatically discarded after 24 hours, so visitors can't be tracked from one day to the next. If Google Analytics is enabled, we ask first: a banner lets you accept or decline, and we only load Google Analytics — and its first-party analytics cookies — if you accept. Decline and it never loads; the cookieless page-view count still works either way.

Changes

If we update this policy, we'll change the date at the top and note material changes here. For material changes, if you gave us your email, we'll make reasonable efforts to let you know directly.