Privacy Policy — Grant Opportunity Analyser

Last updated: 5 June 2026

1. Who we are

This tool is operated by Thomas Murray ("we", "us", "our").

Contact:
Email: thomasmurraynz@gmail.com
Address: 8 Redmond House, N1 0TN, London, United Kingdom

For users in the United Kingdom and European Union, we are the data controller of your personal data as defined by UK GDPR / EU GDPR.

2. What personal data we collect and why

When you use this tool, we record the following information about each analysis session:

Data	Why we collect it	Legal basis (UK/EU GDPR)
Company website URL you enter	To deliver the analysis; to understand what types of companies use this tool	Legitimate interest (Art. 6(1)(f))
Company description text (first 500 characters of any pasted text)	To understand what types of companies use this tool and improve results quality	Legitimate interest (Art. 6(1)(f))
Search preferences (geography, grant types)	To tailor results; to understand user needs	Legitimate interest (Art. 6(1)(f))
AI-generated company profile	To record analysis outputs and improve the AI pipeline	Legitimate interest (Art. 6(1)(f))
Grant analysis results	To record outputs and improve the scoring methodology	Legitimate interest (Art. 6(1)(f))
Email address (if provided)	To send you a single notification when your analysis is complete	Legitimate interest (Art. 6(1)(f)) — directly fulfilling the service you requested
IP address	To detect and prevent abuse; to understand the geographic spread of users	Legitimate interest (Art. 6(1)(f))
Date and time of analysis	To understand usage patterns	Legitimate interest (Art. 6(1)(f))

What we do NOT collect:

Your name (unless you contact us directly)
Your email address, unless you choose to provide it for result notifications
Payment or financial information
Information from or about children
Cookies or persistent browser tracking identifiers

Legitimate interest balancing test: We have assessed that our legitimate interest in improving the quality of this tool does not override users' rights and freedoms, because: the data is predominantly business-related (company URLs, grant searches) rather than personal; we store only a brief snippet of any pasted text; we do not use the data for marketing or share it with advertisers; and users can request deletion at any time (see section 6).

3. Who we share your data with

We use the following third-party services to operate this tool. Each acts as a data processor on our behalf and is contractually required to handle data securely:

Supabase Inc.

supabase.com — database storage

Stores the analytics data described above on servers located in the United States. For transfers from the UK and EU, we rely on Supabase's Data Processing Agreement and Standard Contractual Clauses (SCCs). See supabase.com/privacy.

Anthropic PBC

anthropic.com — AI processing

Receives the company information you provide in order to generate the grant analysis. Processing takes place on Anthropic's servers in the United States. Anthropic's API usage terms apply and they do not use API inputs to train their models by default. See anthropic.com/privacy.

DuckDuckGo

duckduckgo.com — web search

The AI generates web search queries based on your company inputs to research grant opportunities. We do not send your raw input text directly to DuckDuckGo — only AI-generated search terms. See duckduckgo.com/privacy.

Resend Inc.

resend.com — transactional email

If you provide an email address, we use Resend to send you a single notification when your analysis is complete. Your email address is passed to Resend solely for this purpose and is not used for any other communication. Resend operates servers in the United States. We rely on Resend's Data Processing Agreement and Standard Contractual Clauses for transfers from the UK/EU. See resend.com/legal/privacy-policy.

We do not sell your personal data to any third party, and we do not share it with advertisers or data brokers.

4. International data transfers

Both Supabase and Anthropic store and process data in the United States. The US does not have an adequacy decision from the UK or EU in all cases. Where required, we rely on Standard Contractual Clauses (SCCs) as the legal mechanism for these transfers, as incorporated into each provider's Data Processing Agreement. You can request a copy of the relevant safeguards by emailing us.

5. How long we keep your data

We retain analysis records for 12 months from the date of the analysis. After this period, records are permanently deleted. You may request earlier deletion at any time (see section 6).

6. Your rights

If you are in the UK or EU (UK GDPR / EU GDPR Article 15–22):

Access Request a copy of the personal data we hold about you.

Rectification Ask us to correct inaccurate data.

Erasure Ask us to delete your data ("right to be forgotten").

Restriction Ask us to limit how we use your data.

Portability Receive your data in a structured, machine-readable format.

Object Object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.

If you are in California, USA (CCPA / CPRA):

Right to know what personal information we collect
Right to request deletion of your personal information
Right to opt out of the sale of personal information — we do not sell personal information
Right to non-discrimination for exercising your privacy rights

How to exercise your rights

Email thomasmurraynz@gmail.com with the subject line "Data Request". Please include the approximate date of your analysis and the company URL you entered so we can locate your record. We will respond within 30 days (UK/EU) or 45 days (California).

Please include your email address if you provided one, or the approximate time and company URL of your analysis, so we can locate your record.

7. Right to complain to a supervisory authority

If you believe we have not handled your data lawfully, you have the right to complain to your local data protection authority:

United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint
European Union: Your national data protection authority (a full list is at edpb.europa.eu)
California, USA: California Privacy Protection Agency (CPPA) — cppa.ca.gov

We would, however, appreciate the opportunity to address your concern directly before you contact a regulator.

8. Automated decision-making

Grant analysis results are produced entirely by automated AI processing. These results do not produce legal effects or otherwise significantly affect you — they are informational suggestions to help you research grant opportunities. You remain free to disregard any output and no decisions about you are made based on this processing.

9. Cookies and tracking

This tool does not use cookies, tracking pixels, analytics scripts, or any other persistent browser tracking technology.

10. Children

This service is not directed at, and is not intended for use by, anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has submitted data through this tool, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect the most recent revision. Where changes are material, we will take reasonable steps to bring them to users' attention.

12. Contact

For any privacy-related questions or requests:
Email: thomasmurraynz@gmail.com
Address: 8 Redmond House, N1 0TN, London, United Kingdom