Privacy policy for web, PWA, and Android

1. Scope across website, PWA, and Android app

This Privacy Policy explains how GrantsLookup Directory Services LLC collects, uses, retains, and protects information when you visit grantslookup.com, install the GrantsLookup Progressive Web Application (PWA), or use the GrantsLookup Android application distributed through Google Play.

2. Information we collect

Account information: When you register a free or paid account, we collect your email address, display or organization name, and a cryptographically salted and hashed password (scrypt).

Billing and subscription metadata: Web subscription payments are processed directly by our PCI-DSS Level 1 payment processor (such as Stripe), and Android in-app subscriptions are processed by Google Play Billing. We store your subscription tier (Free, Monthly, or Annual), billing status, renewal date, and processor customer/transaction reference ID. We never receive or store your full credit card number or CVV.

Workspace activity: For signed-in users, we store your bookmarked grant IDs so they sync across devices. Standard server logs capture IP address, HTTP method, timestamp, and user-agent string for rate-limiting, anti-scraping security, and debugging.

3. How we use information and strict non-sale rule

We use collected data strictly to authenticate your session, enforce free-versus-paid grant dossier permissions, process subscription renewals and cancellations, answer support or legal notices, and protect the directory against automated scraping and fraud.

We do not sell your personal information, email address, or NAICS search history to data brokers, lead-generation firms, grant-writing consultants, or third-party advertisers.

4. Service providers and legal disclosures

We share limited operational data only with infrastructure vendors acting under data-processing agreements (payment processors, transactional email delivery, and cloud hosting) or when required by valid subpoena, court order, or statutory obligation.

5. Nevada privacy rights (NRS 603A / SB 220)

Under Nevada Revised Statutes Chapter 603A, Nevada residents may submit a verified request directing a website operator not to make any covered sale of personal information. Although GrantsLookup does not sell covered information as defined by NRS 603A, Nevada consumers may record a formal statutory opt-out at any time by emailing privacy@grantslookup.com with the subject line "Nevada NRS 603A Opt-Out".

6. California (CCPA/CPRA) and U.S. state privacy rights

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with comprehensive privacy statutes have the right to request: (a) disclosure of the categories and specific pieces of personal data we hold about you, (b) correction of inaccurate personal data, and (c) deletion of your personal data, subject to statutory tax and accounting retention exceptions. We will never discriminate against you for exercising privacy rights.

Submit access, correction, or deletion requests via our self-service Account Deletion page at /legal/delete-account or by emailing privacy@grantslookup.com.

7. Google Play Data Safety, security, and retention

All traffic between our web client, PWA, Android app, and backend API is encrypted in transit via HTTPS/TLS. Passwords are stored exclusively using memory-hard scrypt hashing with per-user cryptographic salts. Session cookies are marked HttpOnly and SameSite=Lax.

Active account records are retained while your account remains open. When you submit an account deletion request (in-app or via /legal/delete-account), your user profile, sessions, and saved grant bookmarks are permanently purged within thirty (30) days, while minimal invoice records required by federal and state tax regulations are retained in isolated accounting storage for up to seven (7) years.

8. Children's privacy (18+ service)

GrantsLookup is directed exclusively to adult business owners and non-profit administrators aged 18 and older. We do not knowingly collect personal information from anyone under 16 years of age. If you believe a minor has submitted data, email privacy@grantslookup.com for immediate removal.