Legal

Privacy policy

Last updated: 29 September 2026

1. Who is responsible

GrantMatcher (grantmatcher.eu) is operated by NodeLedger, which is the data controller for the personal data described in this policy. Company details are available at nodeledger.io.

For any privacy question or request, contact us at info@grantmatcher.eu.

2. What we collect

Access requests: the details you enter in our request-access form, such as your name, work email, organisation and what you are looking for.
Account data: your name, work email, organisation, password (stored only in hashed form) and plan.
Content you upload: business plans, project descriptions and the profile we extract from them, such as sector, country, company size and technology readiness.
Usage data: your searches, saved searches, alerts and matches, so the service works and we can enforce plan limits.
Billing data: for paid plans, billing contact details, VAT number and invoices. Card details are handled by our payment provider and are never stored by us.
Technical data: IP address, browser type and request logs, generated automatically when you visit the website.
Correspondence: emails you send us.

We do not collect special categories of personal data, and we ask you not to include them in documents you upload.

3. Why we use it

To provide the service, including your account, matches, estimates and alerts. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
To handle access requests and respond to your emails. Legal basis: steps taken at your request before entering a contract (Art. 6(1)(b)) and our legitimate interest in answering enquiries (Art. 6(1)(f)).
To bill you and keep accounting records. Legal basis: legal obligation (Art. 6(1)(c)).
To keep the service secure and prevent abuse. Legal basis: legitimate interest (Art. 6(1)(f)).
To send service emails, such as alerts you set up and important account notices. Legal basis: performance of a contract (Art. 6(1)(b)).

We do not sell personal data, and we do not use it for advertising.

4. Your business plans

Business plans are often confidential, so we treat them with extra care:

They are used only to build your profile and generate your matches.
They are never used to train machine-learning models, and are never shown to other users.
You can delete an upload at any time. You can also keep only the extracted profile and delete the original file.

We share personal data only with service providers that help us run GrantMatcher, under data processing agreements, and only as far as needed:

Hosting and infrastructure, located in the EU.
Email delivery for account and alert emails.
Payment processing for paid plans.
Google, which hosts our request-access form (Google Forms). Your form answers are handled under Google's privacy policy.

We may also disclose data where the law requires it, or to protect our legal rights.

6. Where data is stored

Account data and uploaded content are stored and processed in the European Union. If a service provider processes data outside the EU or EEA, as can be the case for Google Forms, we rely on appropriate safeguards such as an EU adequacy decision or the European Commission's Standard Contractual Clauses.

7. How long we keep it

Access requests: up to 12 months if no account is created, then deleted.
Account data and uploads: while your account is active. Deleted within 30 days after you close your account, or sooner if you delete individual items.
Billing records: for as long as tax and accounting law requires.
Technical logs: for a short period, normally no longer than 30 days, unless needed to investigate a security incident.

8. Cookies

The public pages of this website do not use advertising or analytics cookies, and they do not load third-party trackers. If you sign in, we use only the strictly necessary cookies needed to keep you signed in. These do not require consent.

9. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased;
restrict or object to certain processing, including processing based on legitimate interest;
receive your data in a portable format;
withdraw consent at any time, where processing is based on consent.

To use any of these rights, email info@grantmatcher.eu. We reply within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

10. Security

We protect personal data with appropriate technical and organisational measures. These include encryption in transit and at rest, access restricted to staff who need it, and hashed passwords. No system is completely secure. If a breach affects your data, we will inform you and the authorities as the GDPR requires.

11. Changes to this policy

We may update this policy. The date at the top shows when it last changed. For significant changes, we will notify account holders by email.

12. Contact

Privacy questions and requests: info@grantmatcher.eu.
Data controller: NodeLedger, nodeledger.io.