True Grant Solutions
Get a free assessment
Legal

Privacy policy

Last updated June 15, 2026.

This is the working version of our privacy policy. It describes how the product actually operates today. A version reviewed by counsel will replace it, and material changes will be announced to customers by email.

True Grant Solutions[, Inc.] ("TGS," "we," "us") provides a grant-management platform (the "Service") for nonprofit organizations. This Privacy Policy explains what information we collect, how we use and protect it, and the choices available to you.

This Policy covers the TGS application at [truegrantsolutions.com] and related sites. For customer organizations subject to data-protection laws, our Data Processing Addendum governs our processing of personal data on your behalf and controls in case of conflict.

1. Who controls your data

TGS is a business-to-business tool. When your organization submits content to the Service, your organization is the controller of that content and TGS acts as a processor that handles it only to provide the Service. If you are an individual whose information appears in an organization's content, please direct privacy requests to that organization; we will support them in responding.

2. Information we collect

a. Account information. Name, work email, organization name, and role, managed through our authentication provider (AWS Cognito).

b. Content you submit ("Customer Content"). Funding notices (RFPs/NOFOs) and other documents you upload; grant narratives, budgets, and notes you create; attachments you add (e.g., resumes, letters of commitment, prior narratives); research questions and conversations; and your organization's description and service-area geography (state, counties, towns) used to localize research.

c. Operational data. Audit logs of security-relevant actions; AI-usage metadata (which model ran, token counts, timing, and cost, not the text of prompts or responses); and records that our safety detector flagged potential sensitive data (the types flagged, not the underlying text).

d. Billing data. Subscription and billing status. Payment card details are collected and processed directly by Stripe; TGS does not receive or store full card numbers.

e. Blog email list. If you subscribe to our blog, your email address, the page you signed up from, and when you confirmed or unsubscribed. We use it only to email you when a new post is published. Every email has an unsubscribe link, and unsubscribing takes effect immediately.

f. Website analytics. On our public marketing website (not inside the Service) we use Google Analytics to understand which pages are visited and whether the free assessment form is used. It sets cookies and collects your browser type, approximate location (IP addresses are truncated), the pages you view, and the links you click. It does not receive the content of the assessment form, your documents, or anything you do inside the Service. You can opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout or by blocking cookies for our site.

We do not sell personal information, and we do not use Customer Content for advertising.

3. How we use information

We use information to: (a) provide, secure, and improve the Service for your organization; (b) generate AI-assisted drafts, analysis, and research at your direction; (c) produce aggregate, de-identified usage and cost metrics that do not identify you; (d) provide support; (e) detect and prevent fraud, abuse, and violations of our Acceptable Use Policy; and (f) comply with law.

4. Artificial intelligence and your content

  • AI features are powered by Anthropic Claude models running on Amazon Web Services (AWS Bedrock) in the United States.
  • We do not use your Customer Content to train, fine-tune, or improve any AI model, and your content is submitted to our AI provider under terms that prohibit using it to train their models. [Confirm wording against AWS Bedrock + Anthropic current data-handling terms.]
  • We do not store the text of your AI prompts or the AI's responses in our system logs. Content you choose to save (e.g., a research conversation) is kept in your organization's workspace, under your control.
  • Before sending your text to the AI, we run an automated detector for likely sensitive data (e.g., SSNs, medical identifiers). If it flags something, we warn you and let you edit or knowingly proceed, we never silently remove your text. You stay in control.
  • AI output may be inaccurate and is provided for your review; see our Terms of Use regarding AI-generated content.

5. When information is shared

We share information only as needed to run the Service:

  • Service providers (sub-processors): AWS (hosting/storage/identity), Anthropic via AWS Bedrock (AI inference), and Stripe (payments). [Maintain a current sub-processor list at [trust.truegrantsolutions.com/subprocessors].]
  • Optional web search: If a user turns on the "Search the web" feature in Research (which is off by default), the research query is sent to our search provider [Tavily] and we retrieve public web pages limited to an allowlist (government sites, known public data sources, and the relevant funder's website). If you do not enable web search, no such data is sent.
  • Public government data sources: To populate cited research figures, the Service queries public U.S. government data services (e.g., USAspending.gov, U.S. Census Bureau, CDC, HRSA, SAMHSA). These requests contain only non-personal parameters, a geographic area and a public funding-listing number, and no Customer Content or personal data is sent.
  • Legal and safety: when required by law or to protect rights and safety, with notice to you where permitted.
  • Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

6. Data location and security

  • Your data is stored and processed only in the United States (AWS us-east-1).
  • We protect data with encryption at rest (AWS KMS), encryption in transit (TLS), per-organization tenant isolation, role-based access and multi-factor authentication for our personnel, least-privilege access controls, optional web-application-firewall protection, and audit logging. No method of transmission or storage is 100% secure, but we use commercially reasonable safeguards.
  • If we confirm a security incident affecting your data, we will notify your organization's administrators without undue delay and within 72 hours of confirmation. [Confirm.]

7. Retention and deletion

  • You can edit or delete your content within the Service.
  • When your organization's agreement ends, we will return or delete Customer Content at your choice; by default we purge it from primary systems within [30 days] and from backups within [90 days], except where law requires retention.
  • Audit logs (metadata only) are retained for approximately [180 days].

8. Your choices and rights

  • Access, correction, deletion, export: available within the Service; for anything not self-service, contact us and we will assist your organization.
  • Depending on your jurisdiction (e.g., California/CCPA, EU-UK/GDPR), you or your organization may have rights to access, correct, delete, port, or restrict processing of personal data, and to be free from discrimination for exercising them. We respond consistent with applicable law and our DPA. [Counsel: insert the rights-request mechanism, verification, and timelines.]
  • Blog emails: unsubscribe from any blog email with one click, or email support@truegrantsolutions.com.
  • We do not sell or "share" (as defined by CCPA) personal information for cross-context behavioral advertising.

9. Children's privacy

The Service is a business tool intended for use by adults at nonprofit organizations and is not directed to children under [13/16]. We do not knowingly collect personal information from children. [Confirm.]

10. International users

The Service is operated from and hosted in the United States. If you access it from outside the US, you understand your information is processed in the US. For EU/UK customer organizations, the DPA's Standard Contractual Clauses apply. [Confirm.]

11. Changes to this Policy

We may update this Policy. For material changes we will notify customer administrators at least [30 days] in advance by email and an in-product notice. Continued use after the effective date constitutes acceptance.

12. Contact

Questions or privacy requests: [privacy@truegrantsolutions.com]. Security matters: [security@truegrantsolutions.com]. Mailing address: [address].

[DRAFT v0.1, pending counsel review. Reconcile defined terms, retention periods, jurisdictional rights mechanics, and all third-party representations before publication.]