Privacy notice
Last updated 25 August 2026
Controller
GrantCrafter is operated by Blissfulplan Publishing Ltd., company number 15418196, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
Information we process
We process account and organisation profiles, applicant dossiers, uploaded source documents, saved searches, favourites, alerts, pipeline and proposal content, export requests, subscription identifiers, contact-form submissions, and security and diagnostic information.
Why we process it
We use information to provide and secure GrantCrafter, match opportunities, send requested alerts, analyse documents, generate proposal materials and exports, administer subscriptions, answer support enquiries, and meet legal obligations.
Your content and AI
Drafting, extraction and review send the relevant text — the call, your applicant dossier, the current draft — to an AI provider so that it can produce your output. That content is sent only to generate your own output. It is never used to train models, ours or a provider’s, and it is never sold or shared for advertising. We keep a usage record of each generation — model, token counts, estimated cost — and that record does not contain your proposal text.
Service providers and international processing
Infrastructure, database, email, payment and AI providers process relevant information under contractual and security controls. Data may be processed outside your country with safeguards required by applicable law, including the Standard Contractual Clauses where information leaves the UK or the European Economic Area.
Current processors: Supabase (database, authentication and file storage), Cloudflare (hosting and delivery), Stripe (payments — card details never reach us), Brevo (transactional and marketing email), and DeepSeek, Google, OpenAI and Anthropic for AI generation and review. SlidesGPT and Gamma receive proposal summary content only when a pitch deck is generated through them.
Security
Every database table has row-level security enabled, so access is scoped to your organisation at the database level rather than only in application code. Passwords are stored as hashes and nobody here can read yours. Provider keys and operational secrets are encrypted with AES-256-GCM under a master key held outside the database. Traffic is encrypted in transit.
Cookies
This marketing site sets no cookies and runs no analytics or advertising trackers. The application sets only what is strictly necessary to keep you signed in and to remember your colour theme. There is no consent banner because there is nothing to consent to.
Retention and your rights
Information is retained while accounts are active and as required for security, billing, dispute resolution and law. Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing.
Complaints
If you are in the UK or the European Economic Area and believe we have handled your information badly, you may complain to your national supervisory authority — in the UK, the Information Commissioner’s Office. We would rather you told us first.