Privacy Policy

Last updated 17 August 2026 (replaces the version of 11 August 2026; the service operator is Viresta AS, a Norwegian company)

1. What we process

• Your email, programme, call/topic and optional acronym.
• The proposal and optional call or annex files during the review.
• The generated report, payment confirmation, feedback or professional-team enquiry information you submit.
• Basic technical logs and anonymous funnel event counts needed to operate and secure the service.
• If you separately opt in, anonymous benchmark statistics described below and optional organisation type and country.

2. Proposal processing and retention

Proposal and supporting files are transmitted securely to Google Cloud/Vertex AI and processed transiently in the EU solely to produce the requested review. GrantWise does not write the uploaded files or their extracted text to its document database and discards them after processing. They are not used by GrantWise or its AI provider to train models.

The generated report, email, selected product and expiry time may be stored in protected Google Cloud Firestore for up to seven days so you can unlock and receive it. A minimal version registry can retain scores, non-reversible document fingerprints and short GrantWise-authored finding summaries; it contains no proposal text or evidence quotations.

3. Revision comparison

Non-reversible fingerprints and similarity signatures may identify a revised version of the same proposal. This supports consistent scoring and resolved/persisting/new comparisons without retaining the source document.

3a. When you are the controller and we are your processor

If you use GrantWise in the course of your business — for example as a consultant, accelerator or university office — and the proposal you upload contains personal data of other people, you are the controller of that personal data and we process it on your instructions as your processor. Our Data Processing Agreement governs that processing and lists our subprocessors, the retention periods and the transfer safeguards. It is available to read and to sign at grantwise360.com/dpa.html.

3b. Automated processing

Your proposal text is sent to a large language model to generate the review. This is automated processing, but it does not produce a legal or similarly significant effect on you within the meaning of Article 22 GDPR: the output is advisory quality-assurance material, it decides nothing, and no funding, eligibility or credit decision is made by us or on our behalf. You may ask us about the logic involved by contacting us at the address above.

4. Legal bases

We process service data to take requested pre-contractual steps and perform the contract, payment and accounting data to meet contractual and legal obligations, security and minimal service metrics for legitimate interests, and newsletter and anonymous-benchmark contributions only with separate optional consent.

5. Providers and international transfers

• Cloudflare: website delivery and security.
• Google Cloud/Vertex AI: EU-region AI inference and Firestore temporary storage.
• Resend: review email and optional newsletter delivery.
• Stripe: payment processing; GrantWise does not receive card details.
• PostHog (PostHog Cloud EU, Frankfurt, Germany): website product analytics, cookieless by default, described in section 6. PostHog receives page and step events from this website. It never receives your proposal, your report, your uploaded files or their contents.

Viresta AS is established in Norway, inside the EEA, and personal data is processed here. AI inference and temporary report storage take place in EU regions. Some providers above nevertheless involve transfer to or access from outside the EEA — principally email delivery and parts of payment processing in the United States. Where that happens we rely on applicable safeguards, such as an adequacy decision, the EU–US Data Privacy Framework where the recipient is certified, or the Standard Contractual Clauses adopted by the European Commission, which apply in Norway through the EEA Agreement.

6. Analytics and browser storage

GrantWise uses no advertising networks, no ad tracking and no cross-site tracking, and never sells data. Analytics comes in two layers, and they are treated differently.

Essential, always on. A small set of first-party funnel counts — page viewed, review started, checkout started, review completed — is sent to our own server. They are counts. They carry no identifier, no cookie, no proposal text, no filename and no email address, and they cannot be traced to you. They are strictly necessary to operate the service and to know it is working, so they do not require consent and cannot be switched off. Local storage remembers your cookie choice and your selected funding region.

Product analytics, cookieless by default. We use PostHog, hosted on PostHog Cloud EU in Frankfurt, Germany, to understand which pages and steps people use. By default it runs in memory-only mode: it writes nothing at all to your device — no cookie, no local storage, no identifier — and the record ends when you close the tab. Your IP address is discarded and no profile is built across visits. Because nothing is stored on or read from your device, this does not require consent under Article 5(3) of the ePrivacy Directive; our legal basis for the processing is legitimate interests under Article 6(1)(f) GDPR in understanding whether our own website works.

What accepting changes. Choosing "Accept" in the banner upgrades PostHog to persistent storage, so a return visit can be recognised as the same visit. That is the only thing consent changes, and it is the only part that stores anything on your device. Legal basis: consent, Article 6(1)(a) GDPR and Article 5(3) ePrivacy.

What is recorded either way. Pages viewed, the named steps above, clicks and page interactions, referring page, approximate device and browser type. What is never recorded: your proposal, your report, any uploaded file, any file name, the contents of any form field, or your email address. Text you type is masked, file names and email-shaped values are stripped before anything leaves your browser, and screen recording is disabled entirely — we never replay your session.

Declining. Choosing "Don't measure me" stops PostHog completely, in every mode. Use "Cookie settings" in the site footer to change your mind at any time. The essential operational counts described above continue in either case.

7. Anonymous proposal benchmarks

If you select the optional benchmark checkbox, GrantWise keeps a separate anonymous statistics record to improve review quality and develop aggregated programme, call and peer insights. It may contain programme and public call ID, optional organisation type and country, criterion scores, finding counts, severity and weakness-category labels, grounding level, model/engine version and date. It never contains proposal or report text, evidence quotations, recommendations, names, email, acronym, filename, organisation name or document fingerprint. The record is not linked back to your report or contact details. GrantWise may use sufficiently aggregated results in future analytics, benchmarking, research, sponsorship and business-to-business products; individual proposal records will not be sold or disclosed. Because the record is irreversibly separated from identity, we cannot later identify a particular contribution for access or deletion. Declining has no effect on the review or price.

8. Newsletter

Newsletter signup is optional and separate from the review. It may include practical proposal guidance, funding-call insights and GrantWise offers. You may unsubscribe at any time using the email link or by contacting us.

9. Your rights

Depending on where you live, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. Contact us at [email protected]. We respond within one month.

EEA residents may complain to the supervisory authority in their country of residence or work. Our lead supervisory authority is Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no), Postboks 458 Sentrum, 0105 Oslo, Norway.

Two limits worth stating plainly. First, uploaded proposals are not stored, so after processing there is nothing left for us to retrieve or delete — a deletion request for a proposal will be answered with confirmation that no copy exists. Second, anonymous benchmark records (section 7) are irreversibly separated from your identity by design, so we cannot locate or delete an individual contribution.

10. Retention at a glance

11. Security and changes

We use encrypted transport, access-controlled cloud services, short report retention and data minimisation. No internet service is risk-free. Material policy changes will be published here with a new "last updated" date.