Privacy

What we collect

Two kinds of information, and nothing beyond what the service needs to work.

• Your charity profile — largely drawn from the public ACNC register using the ABN you provide (legal name, entity type, DGR status, size, the states you operate in, beneficiaries), plus the details you add during onboarding that a public register cannot know.
• Account information for the people who use Granto — name, email address, and the charity they belong to.
• Your activity inside the product — which grants you saved, dismissed or marked as applied, so your list stays yours across sessions and teammates.

Why we hold it

Your charity profile exists so that grants can be assessed against your real eligibility rather than against keywords. It is the difference between a list of results and a list you can act on.

Account information exists to sign you in and to keep each charity's data separated from every other charity's.

What we never do

• We do not sell your information, and we do not share it with advertisers or data brokers.
• We do not pool your charity profile with another organisation's, and we do not show your data to another charity using Granto.
• We do not use your charity's information to train third-party AI models. Assessment prompts are sent to model providers to evaluate a grant for you and are not retained by us for training.

Who processes data on our behalf

Granto runs on a small, deliberate set of providers: Supabase for the database and authentication, Cloudflare for hosting and delivery, Resend for transactional email, and AI model providers for grant assessment. Each is used only for the function described, under their own terms.

Where it lives and how long we keep it

Your data is held for as long as your charity has an account with Granto. Ask us to delete it and we will remove your charity profile and account data. Records we are required to retain for tax or legal reasons are kept only for as long as that obligation lasts.

Your rights

You can ask us for a copy of what we hold about your charity, ask us to correct it, or ask us to delete it. Email grants@granto.au and we will action it. If you are not satisfied with how we have handled a privacy matter, you may complain to the Office of the Australian Information Commissioner.

Security

Access to your charity's data is enforced at the database level, so a signed-in user only ever reads rows belonging to a charity they are a member of. Traffic is encrypted in transit. We keep the number of people with production access small.