Privacy Notice

GrantsOS is operated by Universal Softwares ("we", "us"). For the personal data described in this notice, Universal Softwares acts as the data controller and decides how and why that data is processed. For personal data your organization uploads about its own staff, board members, or beneficiaries, your organization is the controller and we process that data on its behalf.

• Account data (name, email address, login credentials, organization name and role) — to create and secure your account and workspace. Legal basis: performance of our contract with you.
• Workspace content (organizational profile, programs, narratives, budgets, funder records, uploaded documents) — to provide the Service you asked for. Legal basis: contract performance.
• Support messages — to answer your questions and resolve issues. Legal basis: contract performance and our legitimate interest in supporting customers.
• Usage and telemetry, device identifiers, IP address, log data — to keep the Service secure, detect fraud and abuse, diagnose errors, and improve the product. Legal basis: legitimate interests in security and service improvement.
• AI prompts and outputs you generate in GrantsOS — to produce the requested coaching, drafts, and briefings, and to show you your own history. Legal basis: contract performance. We do not use your workspace content to train third-party foundation models.
• Marketing preferences — to send product updates where you have opted in. Legal basis: consent, which you may withdraw at any time.
• Records we must keep (for example transaction and tax records) — legal basis: compliance with legal obligations.

• Service providers and subprocessors — cloud hosting and database providers, AI model providers used to generate GrantsOS outputs, email delivery, error monitoring, and support tooling, each bound by contractual confidentiality and security obligations.
• Merchant of Record — Paddle.com, which sells our products, manages subscriptions and payments, handles tax compliance and invoicing, and processes refunds. Paddle handles payment data directly under its own privacy notice; we never see full card details.
• Professional advisers — legal, accounting, and audit advisers where necessary.
• Authorities — where required by law or to protect our rights, users, or the security of the Service.

We do not sell personal data.

Our providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or an adequacy decision covering the destination country.

We keep workspace and account data for as long as your account is active. After closure we retain it for a limited wind-down period so you can export or restore it, then delete or anonymise it. Security logs are kept for a short rolling period, and financial records for as long as tax and accounting law requires. When data is no longer needed for the purposes above, it is deleted or anonymised.

Depending on where you live, you may have the right to access your personal data, correct it, request erasure, restrict or object to processing, receive a portable copy, and withdraw consent for consent-based processing. If you are in the UK or EEA you also have the right to complain to your supervisory authority. We will respond to requests within one month.

To exercise these rights, contact Universal Softwares through the support channel in your GrantsOS workspace.

We apply appropriate technical and organisational measures, including encryption in transit and at rest, tenant-level access isolation between organizations, role-based access control, audit logging of sensitive actions, and least-privilege access for our staff. No system is perfectly secure, so please tell us promptly if you suspect a problem.

We use strictly necessary cookies and local storage to keep you signed in, maintain your session, and protect against abuse — these are required for GrantsOS to work. Where we use analytics cookies to understand aggregate product usage, or any marketing cookies, we do so only with your consent and you can change or withdraw that choice at any time in your browser settings or via the in-product preferences. Paddle may set cookies during checkout to process your order.

We will update this notice as the Service evolves and will highlight material changes in the product. See also our Terms & Conditions and Refund Policy.