Grantias AI

GDPR overview

GDPR compliance is described concretely rather than merely claimed. GRANTIASHUB OU is established in Estonia and acts as data controller, becoming a processor when you upload third parties' personal data; a Data Processing Agreement is available on request. The privacy policy, dated 5 September 2025, sets out the legal bases (contract, legitimate interest, consent, legal obligation) and the seven data subject rights, with requests to info@grantias.com answered within 30 days. The supervisory authority is named: the Estonian Data Protection Inspectorate. Transfers outside the EEA rely on Standard Contractual Clauses. Security measures are itemised, from TLS 1.2+ in transit and AES-256 at rest to role-based access and 72-hour breach notification. No Article 27 representative is designated, which is expected for an EU-established controller.

Who owns the data?

Section 8 of the terms is explicit: you keep ownership of everything you create or upload. GRANTIASHUB OU receives only a limited, non-exclusive licence to process, store and display that content, and strictly to the extent needed to run the service. The platform itself, including its design, features, training material and documentation, remains the property of GRANTIASHUB OU or its licensors; you get a limited, non-transferable licence to use it for internal professional purposes. The Grantias name and logo are registered trademarks. In return, you warrant that the content you submit infringes no third-party intellectual property and that you hold the rights to upload it.

Reuse rights

Proposals generated in Grantias AI are yours to reuse, adapt and submit without asking permission: the licence the terms grant to the publisher covers service delivery only, not commercial exploitation of your work. Two limits deserve attention. First, your queries and project descriptions are transmitted to third-party model providers, namely OpenAI, Anthropic and Google, for processing; each is covered by a data processing agreement, and the privacy policy recommends leaving sensitive personal data about third parties out of project descriptions. Second, the terms state that proposal content and project descriptions are not used to train the vendor's AI models without explicit consent, which makes training an opt-in rather than something you have to switch off. What the terms do not soften is responsibility: whatever share of a submission Grantias AI drafted, you review it, you sign it, and checking any funder rule on disclosing AI use is your job.

Data retention & training

Hosting summary

No hosting country or region is disclosed. The site names its providers rather than their locations: Google Firebase for cloud infrastructure and authentication, Stripe for payments, with card details never stored on Grantias servers, and OpenAI, Anthropic and Google as AI model providers, each bound by a data processing agreement. Transfers outside the EEA rely on Standard Contractual Clauses, which implies such transfers occur without saying where. Security is documented in more detail than location: encryption in transit (TLS 1.2+) and at rest (AES-256), Firebase Authentication, role-based access limited to authorised personnel, regular security assessments and vulnerability monitoring, and notification of the supervisory authority within 72 hours of a qualifying breach. For the record, the domain resolved on 26 August 2026 to 199.36.158.100, a Fastly anycast node geolocated in the United States; that is an observation about the website, not a statement by the publisher about where customer data lives. Organisations with a hard EU-residency requirement should settle it in the DPA rather than assume it.