Innovista Management GmbH ("we", "us", "our") operates GrantBuddy (accessible at www.grantbuddy.ai). This Privacy Policy describes how we collect, use, and protect your personal data when you use our service.
We are committed to protecting your privacy and handling your data in compliance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
1. Data We Collect
Account Data
- Email address
- Name (optional)
- Password (stored as a salted, one-way hash)
Uploaded Documents
- Grant proposal files (PDF, DOCX) that you upload for review
- Extracted text content derived from your uploaded files
Usage Data
- Login timestamps and frequency
- Pages visited within the application
- Browser type and device information
Our usage analytics are run in-house. We do not set analytics cookies, do not load third-party trackers, and do not store your IP address. We honour the DNT (Do Not Track) header.
2. How We Use Your Data
We use your account data to authenticate you, your uploaded documents to generate automated feedback, usage data to improve reliability and security, and payment references to manage credits and purchase history.
3. Data Sharing
- Stripe for payment processing
- Mistral AI receives your original uploaded files, including any personal or confidential content, to extract text, tables, and images. This happens before local text redaction. We request deletion of the uploaded file after OCR processing.
- OpenAI receives extracted proposal text and grant-review instructions to generate feedback. When our local privacy filter is enabled, it replaces detected sensitive details in the extracted text before this analysis step. If the filter fails, analysis stops and is retried; we do not fall back to sending the unredacted text. Automated redaction may not detect every sensitive detail and does not remove all confidential business information.
- Infrastructure providers for hosting, email delivery, and storage
- Legal authorities if required by law
4. Data Retention
Account data is retained until deletion, uploaded proposal data until you delete it or your account, and payment references according to statutory record-keeping obligations.
5. Data Security
- Encryption in transit and at rest
- Salted, one-way password hashing
- Access controls and security reviews
6. Your Rights
You may request access, correction, deletion, export, or restriction of your data, subject to applicable law.