Privacy Policy

Last updated: 2026-11-05

1. Data controller

The Grant 360 software suite is operated by Grant 360 SAS, which acts as the data controller for all processing activities described in this Privacy Policy.

Grant 360 SAS
42 Cours Pierre Vasseur
91120 Palaiseau, France
Email: contact@grant360.eu

2. Personal data we collect

All Grant 360 applications rely on a single central users table, shared across all apps. A user is created only once, regardless of how many apps they access.

From this central table, we collect and process:

First name and last name
Email address (required for login and communication)
Role and status (e.g. registered user, invited user, contact)
Notification and communication preferences
Activity history (for example: logins, settings changes, key actions)
Consent and legal basis settings

Additional personal data may be collected by each application where strictly necessary, for example:

Grant Mind: notes content (which may incidentally include personal data if you write it), metadata (status, theme, project, actions, dates), sharing rights between users.
Grant Hub: files and folders you upload, access rights per user, temporary sharing links.
Grant Tracker: history of calls viewed or saved, notification settings, optional scientific profile information for recommendations.
Grant Connect: contact details and preferences provided in service request forms.
Grant Genius: proposal content, co-author information, uploaded scientific files (PDF, TXT, BibTeX, public data from HAL / ORCID), and a history of interactions with the AI assistant.
Grant Planner: information on projects, participants, roles, deliverables, deadlines and KPIs.

Authentication is provided by Hanko (Germany). Hanko manages your passwordless authentication and authentication. We never see or store your password; we only receive confirmation that your login is valid.

For paid plans, Mollie processes payment data. We do not have access to your card or bank details. We only receive payment status information (e.g. “payment successful”) to activate or renew your subscription.

For invoicing, we collect billing information (organisation name, address, VAT number if applicable) and transmit it securely to Pennylane (France), which generates and stores the invoices.

3. Purposes and legal bases

We process personal data only when it is necessary and on the basis of one of the legal grounds provided by the GDPR.

The main purposes and legal bases are:

Provision of the services (user account, access to apps, collaboration features, exports, etc.) – processing is necessary for the performance of a contract (Article 6(1)(b) GDPR).
User support, security and fraud prevention (activity logs, access control, incident resolution) – based on our legitimate interest in ensuring the security and proper functioning of Grant 360 (Article 6(1)(f) GDPR).
Billing and accounting (invoicing data, payment status, mandatory records) – necessary for compliance with legal obligations, in particular accounting and tax laws (Article 6(1)(c) GDPR).
Notifications and functional communications (deadlines, system alerts, important changes) – necessary for the performance of the contract and, in some cases, our legitimate interest in ensuring that you are informed about the proper use of the apps.
Analytics strictly necessary to improve the service – where used, based on our legitimate interest and, when required, your prior consent.
Marketing communications (newsletters, product updates) – sent only with your explicit consent (Article 6(1)(a) GDPR). You can withdraw this consent at any time.
Use of AI features (for example in Grant Genius or Grant Tracker) – performed only after explicit opt-in and a clear explanation of what is processed. The legal basis is your consent (Article 6(1)(a) GDPR).

We do not sell, rent or exploit your data for advertising or unrelated profiling, and we do not use your content to train AI models.

4. Data retention

We keep personal data only for as long as it is necessary for the purposes described above, or to comply with legal obligations.

Your account data and content are stored for the duration of your active use of Grant 360.
When you request deletion of your account from your account page, the deletion takes effect after a notice period of 1 year. During that period you can still sign in, export your data, download your files and cancel the request. The people you share content with are informed, so that they can save a copy of what you shared with them, and everyone is reminded one month before the date. If you need your personal data erased sooner, write to us and we will do it without waiting.
At the end of the notice period we permanently erase your profile and your content (proposals, projects, notes, files, searches, support tickets), including content you shared with others, and we remove the stored files from our object storage. A project you share with other members is kept for them; only your access to it is removed. Posts you made in community spaces stay visible without your name.
When a subscription ends without the account being deleted, the Grant Planner projects and Grant Genius proposals it covered are kept for one year after the end of the last active member's subscription. During that year you can still export them. We send a reminder e-mail one month before they are deleted; renewing a subscription cancels the deletion.
Data that must be retained to comply with legal obligations (for example, invoices kept for accounting or tax purposes, and proof of consent) is not erased.
Technical logs and security records are kept for the limited periods listed below, and are then deleted automatically every night.

Retention schedule

Data	What it contains	Kept for	What happens then
Account content after a deletion request	Proposals, projects, notes, files, searches, AI usage records, support tickets, beta feedback, profile	1 year	Erased at the end of the notice period. The owner can cancel until then; people the content is shared with are warned so they can save a copy, and everyone is reminded one month before.
Planner projects and Genius proposals after the subscription ends	The project or proposal and everything in it, once no member has an active subscription any more	1 year	Deleted one year after the end of the last active member's subscription. Members can still export during that year and are reminded by e-mail one month before deletion. Renewing a subscription cancels the deletion.
Audit trail	Who did what: file access, shares, exports, public links, admin actions; IP address, browser, invited e-mail addresses	12 months	Deleted. IP address and browser are removed earlier if the account is erased.
Sign-in logs	E-mail address, IP address, browser, sign-in result	12 months	Deleted. Also deleted when the account is erased.
Grant Genius guidance history	Product actions used to select guidance and the delivery status of each lifecycle email	12 months	Deleted after 12 months and when the account is erased.
Grant Planner guidance history	Product actions used to select guidance, upcoming deadline digests and lifecycle email delivery status	12 months	Deleted after 12 months and when the account is erased.
Grant Hub and Grant Mind usage history	Product actions (uploads, shares, notes created or edited, and similar) with the folder or note concerned	12 months	Deleted after 12 months and when the account is erased.
Signed-in devices	Device and browser, IP address, sign-in and last-use dates	30 days	Deleted 30 days after the device was signed out or its session expired. Also deleted when the account is erased.
Marketing consent requests never confirmed	A newsletter or contact-form request whose confirmation link was not clicked	30 days	Deleted. The address was never added to the mailing list.
Contact and website form submissions	Message, form answers, IP address, browser, referring page	12 months	Deleted.
Grant Mind notes in the Trash	The note and everything in it: text, attachments, versions, links	30 days	Deleted for good. Until then the note can be restored from the Trash.
Technical data attached to downloads and interest registrations	IP address and browser recorded with freebie downloads, Academy and Grant Connect interest forms	12 months	IP address and browser are cleared. The e-mail address is kept until you unsubscribe or ask for deletion.
Website visit tracking	Random visitor identifier (cookie), traffic source, pages viewed	13 months	Deleted. Matches the lifetime of the visitor cookie.
AI eligibility conversations (Grant Radar)	Questions asked to the assistant and its answers	12 months	Deleted 12 months after the last message. Also deleted when the account is erased.
Conversations with the free assessment tools	Answers typed into a free assessment tool and the assistant's replies; not linked to an account	7 days	Deleted 7 days after the last message, or as soon as the assessment is restarted.
Generated proposal exports (Grant Genius)	DOCX, PDF or LaTeX copy of a proposal	7 days	File deleted; the proposal itself is unaffected and can be exported again.
Stored files no longer attached to anything	Files whose owning record was deleted or whose upload was abandoned	2 days	Deleted from object storage.
Your content while your account is open	Proposals, projects, notes, files, AI suggestions, AI usage records (counts only, no prompt text)	Not time-limited	Kept until you delete the item or your account. Audio transcriptions are not stored separately: the text lives in your note.
Large file transfers sent from Grant Hub	The files sent, the recipients' e-mail addresses, an optional message	30 days	Files are deleted when the transfer ends (at most 7 days after sending, or when the sender cancels it); the record of who it was sent to is deleted 30 days later.
Place kept in a plan by a deleted Genius proposal	The account and a date; nothing of the deleted proposal	Not time-limited	Deleted once the paid period has ended and the place is given back.
Planner projects whose deletion was requested	The project and everything in it	Not time-limited	Deleted at the end of the subscription that pays for the project. The subscriber can cancel the request until then. With no subscription end date, the project is deleted as soon as it is requested.
Invitations to a Planner project	E-mail address of each invited contributor, their role, who invited them	Not time-limited	Kept while the project exists. Deleted with the project, and when the inviter's or the invited person's account is erased. Removing a contributor withdraws their access immediately.
Billing and consent records	Payments, invoices, proof of consent to terms and privacy policy (with IP address and browser)	Not time-limited	Kept after account deletion for as long as accounting, tax and evidence obligations require. Not purged automatically.
Record of erased accounts	One-way hash of the e-mail address (the address itself is not kept)	Not time-limited	Kept so that an erased account is not silently re-created.
Application logs	Technical request logs, including IP address. E-mail addresses are masked	Not time-limited	Held by the hosting provider (Scalingo) for its standard log retention period.

Non-production environments (development, test, staging) use anonymised or synthetic data; only the production environment contains real user data.

5. Your rights (GDPR)

In accordance with the GDPR, you have the following rights regarding your personal data:

Right of access – to obtain confirmation that we process your data and to receive a copy of it.
Right to rectification – to correct inaccurate or incomplete personal data.
Right to erasure (“right to be forgotten”) – in the cases provided by law.
Right to restriction of processing – in certain circumstances, for example during the verification of contested data.
Right to data portability – to receive your data in a structured, commonly used and machine-readable format and to transmit it to another controller. Grant 360 includes an export function (e.g. .zip export).
Right to object – to processing based on our legitimate interest, on grounds relating to your particular situation.
Right to withdraw consent – at any time, for processing based on your consent (for example, marketing emails or AI features).

You can exercise these rights by contacting us at: contact@grant360.eu. You also have the right to lodge a complaint with your local data protection authority if you consider that your rights have not been respected.

6. Security and hosting

We apply a “GDPR-max” approach to security and hosting:

Encryption: all data is protected in transit (HTTPS/TLS) and at rest. Sensitive user and project data is encrypted by default. Certain features may also support end-to-end encryption.
Hosting in the EU: databases are hosted on Scaleway Managed PostgreSQL in France, uploaded files are stored on Scaleway Object Storage in France, and application code runs on Scalingo in France. AI models are provided by Mistral (France). No data is intentionally transferred outside the European Economic Area.
Access control: strict, role-based access control is applied across all apps, with per-project and per-resource permissions (for example, read / edit rights on notes, files, deliverables).
Third-party providers: we only use trusted, EU-based providers – Hanko for authentication, Mollie for payments, Pennylane for invoicing, Brevo for emails – all of whom are contractually bound by GDPR requirements.
AI integration: data sent to Mistral models is processed within the EU, is not used to train the models, and is not retained beyond the time necessary to provide the requested response.

While no system can be guaranteed 100% secure, we continuously improve our technical and organisational measures to protect your data and ensure a high level of confidentiality, integrity and availability.