Privacy Policy

Grantboard is operated by OVERMATCH OÜ (“Grantboard”, “we”, “us”), a private limited company registered in the Estonian Business Register under code 17564126, with its registered address at Tartu mnt 67/1-13B, 10115 Tallinn, Harju County, Estonia. Contact: hello@grantboard.co.

For privacy questions or to exercise your rights, write to hello@grantboard.co.

• Controller. OVERMATCH OÜ is the controller for account data (for example your name, email address and sign-in records), billing records for paid plans, support correspondence, and technical data from visits to our websites.
• Processor. Data that an organization puts into its workspace, such as grant records, grantee contact details, submissions, documents and messages, is processed on behalf of that organization, which is the controller. The same applies to spreadsheets and other files an organization sends us for setup help: we use them only to set up its workspace, and it can ask us to delete them at any time. Our Data Processing Agreement, part of our Terms of Service for every workspace, governs this processing. Requests about that data are best sent to the organization; we will help it respond.

• Account data: email address, name, and authentication data (a password hash if you set a password).
• Workspace data: the grants, milestones, payment records, documents, messages and activity history created in a workspace, including contact details of grantees and wallet addresses entered for grant or treasury records.
• Billing data: plan, subscription status, invoice records, and the billing name, billing address and any tax ID such as a VAT number entered at checkout. Card details are collected and processed by Stripe; we do not receive or store full card numbers.
• Technical data: IP address, browser user agent, sign-in events, request timestamps and error reports needed to run and secure the service.

We do not use advertising trackers. We set only the cookies strictly necessary for sign-in, session security and form protection.

Visit statistics: on our public website (grantboard.co) we count visits with our own cookieless, first-party statistics tool. For each page view it records the page address, the referring website, your country and a rough screen size (mobile, tablet or desktop). Your IP address and browser user agent are processed briefly to tell one day's visitors apart and are never stored. It sets no cookies and stores nothing on your device. We keep only aggregate counts, for up to 25 months. If your browser sends Global Privacy Control or Do Not Track, you are not counted. The app and grantee portal are not measured. During October 2026 we also run Cloudflare Web Analytics, which is also cookieless and does not identify you, to cross-check these counts. Our legal basis is our legitimate interest in understanding how the website is used (Article 6(1)(f)).

We use personal data to provide the service (accounts, sign-in, workspaces, grantee portal links, transactional email and notifications), to bill paid plans, to keep the service secure and prevent abuse, to answer support requests, and to meet legal obligations such as accounting and tax record-keeping.

Our legal bases under the GDPR are performance of a contract (Article 6(1)(b)), our legitimate interest in operating a secure and reliable service and in understanding how our public website is used (Article 6(1)(f)), compliance with legal obligations (Article 6(1)(c)) and, where we ask for it, your consent (Article 6(1)(a)), which you can withdraw at any time.

We share personal data only with providers that help us run the service. We do not sell personal data or share it with advertisers.

• Supabase

  Purpose

  Database, sign-in and file storage

  Location

  London, United Kingdom

  Transfers outside the EEA

  United Kingdom: European Commission adequacy decision. Any access by Supabase from other countries: standard contractual clauses in Supabase’s data processing addendum, part of its terms of service.

• Vercel

  Purpose

  Application hosting and content delivery

  Location

  Washington, D.C., United States, for the app; Vercel’s global network for delivery

  Transfers outside the EEA

  EU-US Data Privacy Framework: Vercel is certified. Vercel’s data processing addendum, which applies to our Pro plan, adds standard contractual clauses (Decision (EU) 2021/914).

• Resend

  Purpose

  Sending email: sign-in links, invitations, notifications and reminders

  Location

  Ireland (European Union) for sending; United States for Resend’s other processing

  Transfers outside the EEA

  EU-US Data Privacy Framework, and standard contractual clauses in Resend’s data processing addendum, part of its terms of service.

• Sentry

  Purpose

  Error monitoring and a 10% sample of performance traces, never from sign-in or grantee portal pages, configured not to collect default personal data

  Location

  Frankfurt, Germany (Sentry’s EU data region)

  Transfers outside the EEA

  Stored in the European Union. Any access by Sentry from the United States: EU-US Data Privacy Framework, under which Sentry is certified, with standard contractual clauses (Decision (EU) 2021/914) in Sentry’s data processing addendum as the fallback.

• Upstash

  Purpose

  Rate limiting to protect the service from abuse

  Location

  Frankfurt, Germany

  Transfers outside the EEA

  Stored in the European Union. Any access by Upstash from the United States: EU-US Data Privacy Framework, with standard contractual clauses in Upstash’s data processing addendum, part of its terms, as the fallback.

• Proton

  Purpose

  Our support mailbox, hello@grantboard.co, including spreadsheets sent to us for setup help

  Location

  Switzerland, Germany or Norway

  Transfers outside the EEA

  Switzerland: European Commission adequacy decision. Germany and Norway are in the European Economic Area.

• Stripe

  Purpose

  Subscription payments, invoices and the billing portal

  Location

  European Union and United States

  Transfers outside the EEA

  EU-US Data Privacy Framework, and standard contractual clauses in Stripe’s data processing agreement, part of its services agreement.

• Cloudflare

  Purpose

  Cookieless visit statistics for the public website (grantboard.co) only: runs our own visit counter, which uses IP addresses and browser user agents briefly and stores only aggregate counts, and, during October 2026, Cloudflare Web Analytics

  Location

  Global network; data may be processed in the United States

  Transfers outside the EEA

  EU-US Data Privacy Framework: Cloudflare is certified.

Stripe also acts as an independent controller for some payment data under its own privacy policy. The providers that process workspace data on an organization’s behalf are our sub-processors; they and every change to them are listed on our sub-processor page.

If your workspace uses the optional crypto features, public wallet and Safe addresses are sent to public blockchain services to look up ENS names, check treasury accounts and read executed Safe transfers: the Safe Transaction Service (api.safe.global) and public RPC endpoints, mainly PublicNode (publicnode.com) with other public endpoints as fallbacks. No other personal data is sent to them.

Our database and file storage are in London, United Kingdom. The European Commission has decided that the United Kingdom protects personal data adequately, so data can go there from the European Union without further safeguards. Some providers listed above process data in the United States or elsewhere outside the European Economic Area. For each one, the list above names the safeguard that applies, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

Account data is kept while your account is active. When you delete your account from Settings → Your data, it is scheduled for deletion with a 30-day window in which you can restore it, with an immediate deletion option. Deletion can be held while workspace administration, billing or ownership of older files needs to be resolved. We explain the hold and help resolve it through support before removing the account and profile. Workspace data belongs to the workspace and follows the organization's own retention; records you contributed stay in the workspace. We keep spreadsheets and files sent for setup help in our support mailbox, and delete them when the organization that sent them asks us to. Billing records are kept for as long as accounting and tax law requires. Website visit statistics are kept as aggregate counts for up to 25 months. Backups and provider logs are kept for the providers' standard retention periods.

Denied requests to reveal a grantee portal link are kept in a private security log. A daily job deletes them once they are older than 90 days, or immediately when the requesting account is deleted. The log never stores the link itself. Short-lived rate counters are deleted by the daily job once they are older than two days.

Under the GDPR you can ask to access, correct, delete or port your personal data, to restrict or object to its processing, and to withdraw consent. Signed-in users can download their data and delete their account from Settings → Your data. For anything else, write to hello@grantboard.co. We reply within one month, as the GDPR requires.

You can also complain to a data protection supervisory authority. In Estonia that is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon); you may also contact the authority where you live or work.

We protect data with encryption in transit and at rest, database access rules that confine each workspace's data to its members, and an audit trail. Read more on our Security page.

Grantboard is a business service and is not intended for children under 16. We do not knowingly collect their personal data.

We may update this policy. Material changes will be sent by email to active account holders. The "Last updated" date above shows when the current version took effect.