Privacy Policy

Legal Basis

We collect and process personal data based on the following legal bases:

• Consent pursuant to Art. 6 para. 1 s. 1 lit. a GDPR. Consent is any voluntary, specific, informed and unambiguous expression of will in the form of a statement or other unambiguous affirmative act by which the data subject indicates his or her agreement to the processing of personal data relating to him or her.
• Necessity for the performance of the contract or the implementation of preparatory measures in accordance with Art. 6 para. 1 s. 1 lit. b GDPR, i.e. the data is necessary for us to be able to fulfill our contractual obligations towards you or we need the data to prepare for the conclusion of a contract with you.
• Processing for the fulfilment of a legal obligation pursuant to Art. 6 para. 1 s. 1 lit. c GDPR, i.e. that processing of the data is required, e.g. due to a law or other regulations.
• Processing for the protection of legitimate interests pursuant to Art. 6 para. 1 s. 1 lit. f GDPR, i.e. that the processing is necessary to protect legitimate interests on our part or on the part of third parties, unless such interests are overridden by the interests or fundamental rights and freedoms of you which require the protection of personal data.

Collection and Storage of Personal Data

When you visit our website, information is automatically sent to our website server by the browser used on your end device. The following information is collected without your intervention and stored until automatic deletion:

• IP address of your device
• Date and time of your visit
• Name and URL of the file accessed
• Website from which you visit us
• Information about your browser used and, if applicable, the operating system of your computer as well as the name of your access provider
• Status information such as error messages
• Transferred data volume and the access status (file transferred, file not found, etc.)

The aforementioned data is processed by us for the following purposes:

• Ensuring a smooth connection of the website
• Ensuring a comfortable use of our website
• Evaluating system security and stability
• Further administrative purposes

The legal basis depends on the specific processing activity, for example performing our contract or our legitimate interest in secure operation. Technical data is not automatically anonymous; it can be linked to a device or account.

GrantHive application sessions are cleaned up daily: sessions whose sign-in and last activity were both more than seven days ago are removed. IP addresses stored with current application sessions are shortened (IPv4 /24, IPv6 /48). This does not state a uniform retention period for hosting, security or provider logs; those records are handled according to their purpose and applicable retention requirements.

When you visit our website, the information specified as well as the information from the cookies classified as strictly necessary is processed automatically. The transfer of this information is voluntary. Without the provision of this personal data, we cannot display the requested page.

If you allow us to use cookies that are not classified as strictly necessary or want to see embedded YouTube videos, the transfer of the information is voluntary.

If you contact us, we cannot answer your inquiry in the chosen way without the provision of the personal data required in the individual case. As far as cookies are concerned, the lack of consent can lead to a restriction of the functionality of the website or parts of it. Embedded videos cannot be played without your consent.

Rights of Data Subjects

You have certain rights under the General Data Protection Regulation including the right to request a copy of the personal information we hold about you, if you request it from us in writing:

• Right of access: You have the right to request confirmation as to whether personal data concerning you is being processed and, where that is the case, access to the personal data and information.
• Right of rectification: You have the right to request the correction of inaccurate personal data concerning you.
• Right of erasure ('right to be forgotten'): You have the right to request the deletion of personal data concerning you without undue delay under certain conditions.
• Right of restriction of processing: You have the right to request the restriction of processing of your personal data under certain conditions.
• Right of data portability: You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and have the right to transmit those data to another controller without hindrance.
• Right to object: You have the right to object to the processing of personal data concerning you at any time on grounds relating to your particular situation.
• Right to withdraw consent: You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You can exercise these rights without charge. We may ask for information needed to verify your identity before disclosing or changing account data. We review each request against applicable legal requirements.

Write to Iwa Eck c/o GrantHive, Kopernikusstr. 25, 10245 Berlin, Germany, or hello@granthive.app.

Detailed Consent Information

Obtaining Consent

When we require your consent to process your personal data, we will provide you with clear and detailed information about what you are consenting to, including the specific purposes for which the data will be used, the type of data to be processed, and any third parties with whom the data will be shared. Consent will be obtained through an affirmative action, such as ticking a box on our website or through a similar mechanism, ensuring that your consent is freely given, specific, informed, and unambiguous.

Managing and Documenting Consent

We keep records of the consents you have given, including the information you were provided with at the time of consent and the mechanism through which your consent was obtained. This ensures that we can demonstrate compliance with GDPR requirements regarding consent.

Right to Withdraw Consent

You have the right to withdraw your consent at any time. To withdraw your consent, you can contact us at hello@granthive.app. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Upon receiving your request, we will cease processing your personal data for the purposes you initially consented to, unless there is another legal ground for processing.

Data Deletion and Storage Period

A confirmed account deletion request is scheduled for processing after a 30-day withdrawal period. We remove account, profile, project and session data once the required checks and provider steps succeed, then send a completion notice. That notice is separate processing limited to confirming the deletion: the recipient address, content and delivery metadata may remain with the active mail provider for its verified retention period. Earlier removal of account emails does not cover this new message. Paid transaction records and issued invoice records may be kept in reduced form where a legal retention duty or an unresolved claim requires it; they are excluded from ordinary product use and removed when that reason ends. A minimized record of the deletion request is kept as evidence of how it was handled. If a technical step fails, the request remains open for review rather than being marked complete.

Processing Safety

We have implemented appropriate Technical and Organizational Security Measures (TOMs). This means that the data we process is protected against accidental or intentional manipulation, loss, destruction and unauthorized access. The security measures include, in particular, the encrypted transmission of data between your browser and our server using the SSL method in accordance with the state of the art.

Data Transfer to Third Parties, Subcontractors and Third-Party Providers

Within GrantHive, only persons are granted access to your personal data as far as they need it to fulfil the above-mentioned purposes.

We use service providers for hosting, authentication, payments, AI matching, email delivery and analytics. They receive the data needed for their function. Their respective roles and contractual arrangements vary; Stripe also has its own obligations for the invoice documents it issues.

Otherwise, personal data is only transferred to third parties within the framework of legal requirements. We only pass on user data to third parties if:

• you have given your express consent in accordance with Art. 6 para. 1 s. 1 lit. a GDPR,
• the disclosure is necessary to protect legitimate interests in accordance with Art. 6 para. 1 s. 1 lit. f GDPR and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,
• in the event that there is a legal obligation for disclosure pursuant to Art. 6 para. 1 s. 1 lit. c GDPR,
• this is legally permissible and necessary according to Art. 6 para. 1 s. 1 lit. b GDPR for the processing of contractual relationships with you, or
• this is necessary for billing purposes or for other purposes, if the transfer is necessary to fulfil contractual obligations towards users.

Some providers may process data outside the EU/EEA. The provider, location, legal basis and transfer safeguards must be assessed for each service; contact us for information about a specific transfer.

Providers Used by GrantHive

The following services can receive personal data when you use the corresponding GrantHive function:

• Stripe processes checkout, subscriptions and contact-fee payments and issues the customer-facing invoice document. Billing data can include the payer name, billing address, tax details, payment references and invoice content. GrantHive retains a reduced local transaction record when required after account erasure.
• Supabase provides account authentication, database services and file storage. It processes account identifiers, contact and profile data, application records and uploaded files as needed for these functions.
• Onyx provides AI-assisted grant matching. A matching request can contain a project description and related search context; chat session and message identifiers may be returned and stored with matching results.
• Transactional and account emails are sent through the configured email transport. Where Resend is the delivery provider, it receives the recipient address, message content and delivery metadata, including for the separate completion notice sent after account deletion. Resend stores these data in the United States regardless of the sending region. Retention depends on the active provider and plan and is checked for each environment. Another external SMTP provider has its own terms.

Data Transfers to Third Countries

Some of the services named below may involve processing outside the EU/EEA. The location can depend on the provider account and configuration.

Where a restricted transfer occurs, we assess the legal transfer mechanism and safeguards required for that provider. Possible mechanisms include:

• An adequacy decision for the destination, where one applies.
• Appropriate safeguards such as approved standard contractual clauses, where required and agreed.

Contact hello@granthive.app to ask which mechanism applies to a particular provider and how to obtain further information.

Provider locations and transfer arrangements are reviewed when services or their configuration change.

Google Tag Manager

Related websites may use Google Tag Manager to manage scripts. It can load other tags that process data.

Optional tags should not load where a relevant choice has disabled them, subject to the actual consent configuration.

Whether a loaded tag requires consent and which data it processes depends on that specific tag.

WordPress Editorial System

Related editorial websites may use WordPress. Technical access data and information entered in forms can then be processed. The provider Automattic and possible transfers outside the EU/EEA are subject to the relevant provider arrangements.

The provider notice is at https://automattic.com/de/privacy/. Which WordPress services are actually active on a given website needs separate confirmation.

Editorial content may be provided on the basis of a legitimate interest; the legal basis for optional functions must be determined separately.

Content Delivery Network (CDN)

A CDN can deliver images, scripts and other static content. This can involve technical access data such as IP address, time and requested resource.

Its purpose is reliable and fast delivery. The actual provider and legal basis must be confirmed for the CDN in use.

PostHog Analytics

We use PostHog for product analytics. The application is configured to send events to a European PostHog endpoint. The legal basis and provider arrangements for this use are subject to the choices and requirements described in this policy.

After sign-in, the application identifies the account in PostHog using its profile UUID and the account role. This identifier can be linked to an account and is personal data. PostHog also receives selected usage events and page views.

Automatic event capture and session recording are disabled in the application. We define the events sent to PostHog and redact sensitive URLs and structured fields; this does not make the account identifier anonymous.

You can change optional analytics settings in your account under Privacy & Analytics. The browser also respects Do Not Track. Operational events generated by the server may be handled separately from optional browser analytics.

For more information about PostHog's data practices, visit their privacy policy at https://posthog.com/privacy.

YouTube

Related pages may embed YouTube videos. Activating a video creates a connection to YouTube/Google.

YouTube can then process technical information about your device, the page and video use.

Cookies or similar identifiers may be set, depending on your settings and YouTube configuration.

If you are signed in to Google, Google may associate video use with your Google account.

What Google processes and how long it remains there also depends on its settings and notices.

Google privacy information is available at https://policies.google.com/privacy.

Where consent is required to load a video, it is activated only after your choice.

Hosting

GrantHive application services are hosted with netcup in Germany. The hosting provider may process technical access and security data needed to operate the service. See the provider privacy notice at https://www.netcup.eu/kontakt/datenschutzerklaerung.php.

Cookies

Cookies are pieces of information that are transmitted from our web server or third-party web servers to users' web browsers and stored there for later retrieval. Cookies can be small files or other types of information storage. The cookie is either sent from the web server to the browser or generated in the browser by a script (JavaScript). The web server can read this cookie information directly from the server when the user visits this page again or transfer the cookie information to the server via a script of the website.

Cookies are used to store data about your visit and for recognition purposes, as well as for statistical purposes, to improve and guarantee the operation of our website. The legal basis for this is Art. 6 para. 1 s. 1 lit. f GDPR. Cookies do not cause any damage to your device, do not contain viruses, trojans or other malware.

Information is stored in the cookie that is related to the specific device used. This does not mean, however, that we obtain direct knowledge of your identity.

If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online offer.

We generally use the following cookies:

Strictly necessary cookies

These cookies are necessary for the functioning of the website. In general, these cookies are only set in response to actions you take in response to a service request, such as setting your privacy preferences, logging in, or filling out forms. You can set your browser to block these cookies or to notify you about these cookies. However, some areas of the website may not function properly.

The legal basis for the processing of these cookies is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest follows from the data processing purposes listed above.

Performance cookies

Analytics technology can help us understand use and technical performance, including through PostHog. Events may be linked to an account UUID and are not necessarily anonymous.

The legal basis and any consent requirement depend on the specific analytics service. Where consent is required, it must be obtained before that optional service is used.

You can change optional analytics settings and withdraw a consent for future processing.

Functional cookies

These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third parties whose services we use on our pages. If you do not allow these cookies, some or all of these services may not function properly.

The legal basis depends on the specific function; where consent is required, your choice applies.

You have the right to revoke your consent at any time, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. To do so, please change the settings in the Privacy Preference Center.

Cookies for marketing purposes

These cookies can be set via our website. They may be used by our marketing partners to profile your interests and show you relevant ads on other websites. If you do not allow these cookies, you will experience less targeted advertising.

Non-essential marketing cookies require an appropriate prior choice where applicable.

You have the right to revoke your consent at any time, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. To do so, please change the settings in the Privacy Preference Center.

Specific Use of Cookies

The application uses necessary session technology and, when analytics is enabled, PostHog browser persistence. Optional cookies and embedded content depend on the relevant settings and browser choices.

YouTube Videos

When an embedded video is activated, the browser may send data to YouTube. Without activation, a preview image is shown where the embedding supports it.

After activation, YouTube data processing and cookies can apply. The identifiers below are examples; actual use and lifetimes can change.

Cookie Table

Data Breach Notification

In the event of a data breach, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If the data breach is likely to result in a high risk to the rights and freedoms of natural persons, we will communicate the data breach to the data subjects without undue delay.

Supervisory Authority Contact Information

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is:

Data Protection for Minors

This website is intended for persons who are at least 18 years old. If a minor submits personal data via this website, we will delete this data and not process it further as soon as we become aware of this fact.