Privacy policy

Controller

Grant Radar, Wrocław, Poland ("Grant Radar" or "we"), is the controller of your personal data in all three services. Contact for all data questions and requests: iwo@scindu.com.

What we process in every service

• Sign-in data: Funding and Clubs use one sign-in system. It holds your e-mail address, a password hash, your language, login records and the date you confirmed your e-mail address.
• If you sign in with Google, Google sends us your name, e-mail address, Google account ID and the address of your profile picture. If you add a passkey, we store its public key, its name and the dates it was added and last used. The private key stays on your device. We never receive your fingerprint or face data.
• Usage data: pages you visit and actions you take, device and browser data, and technical logs.
• Messages you send us, by e-mail or through a form.

The funding search on grant-radar.pl

• The text you type about what your company develops. We use it to find matching calls and do not store it, unless you also leave your e-mail address.
• If you leave your e-mail address, we store the address, the text you typed, the calls we showed you, your language, and a salted hash of your IP address and browser identifier. We use the hash only against abuse. It does not reveal the IP address itself.

Funding

• The company profile you enter: company name, website, country, voivodeship, size, sector, what the company works on, its funding goal, keywords, interest in working with universities, and NIP.
• The calls you save, and account events: registration, logins, profile completion and saved calls.
• Company data is personal data only when it identifies a person, for example the name or NIP of a sole trader.

Grant Radar Clubs

• Account data: name, university and the date you accepted the terms.
• Profile data you enter: faculty, programme, degree and year of study, average grade, languages, skills, tools, interests, achievements, links, a short bio, residence and the situations you choose for scholarship matching.
• Documents you upload (at present, a CV as a PDF), and the information we extract from them.
• Club data: the club profile, members and their roles, projects, needs and invite links.
• Company requests: contact details and the message a company sends through the form.

Special categories of personal data

In Clubs, some scholarship situations, such as disability, are data concerning health. We process them only with your explicit consent (Art. 9(2)(a) GDPR). You give it when you select that situation in your profile. It is optional. You withdraw it when you remove the selection. We use this data only to match you with scholarships, and we never show it to clubs or companies.

Why we process it and the legal basis

• To provide the services you use: in Funding, your account, company profile, call matching and messages about calls that fit your profile; in Clubs, your account, club pages, member directories, scholarship and opportunity matching, and reading the documents you upload to fill your profile. Basis: necessity for the performance of a contract (Art. 6(1)(b) GDPR).
• To send you information about matching calls and researchers when you leave your e-mail address in the funding search. Basis: your consent (Art. 6(1)(a) GDPR). Withdraw it at any time by writing to iwo@scindu.com.
• In Clubs, to show your details to companies and to send you opportunity alerts, when you turn these settings on. Basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in your profile.
• To analyse and improve the services, develop our new products and features, keep the services secure, and prevent abuse. Basis: our legitimate interest (Art. 6(1)(f) GDPR).
• To build statistics and anonymised datasets about student clubs, skills, research interests and company funding needs, and to use them in our services for companies, universities and funders. Basis: our legitimate interest (Art. 6(1)(f) GDPR).
• To establish, exercise or defend legal claims (Art. 6(1)(f) GDPR), and to meet the controller's legal obligations, such as accounting (Art. 6(1)(c) GDPR).

Anonymised and aggregated data

When data can no longer identify you, it is not personal data. We may keep and use anonymised and aggregated data for any purpose, also after you delete your account. Examples: the number of students with a skill at a university, or the share of companies that look for funding in a field.

Automated tools, AI and profiling

• Funding and the funding search match your text to calls with a text model that runs on our own servers. Your text is not sent to an AI provider for this.
• Clubs uses automated tools to match you with scholarships and opportunities, and AI models to read documents you upload and to suggest profile entries.
• Profiling: matching calls in Funding, and scholarships and opportunities in Clubs, is an automated evaluation of your profile data, such as a company's goal or your programme and year of study. This is profiling within the meaning of Art. 4(4) GDPR. It is used only to show matching items. Basis: necessity for the performance of a contract (Art. 6(1)(b) GDPR).
• These tools give suggestions only. They do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Check the suggestions before you rely on them.

Who receives your data

• In Clubs, other users, as far as the service shows it. Public club pages show the club profile, projects, open needs, the names and roles of board members, and the number of members per skill. On public project pages we show the names of board members and of the team members who turned on "Show my profile to companies" in their profile. Other team members are shown without their name.
• Members of a club see each other's profiles: name, university, faculty, programme, degree and year of study, skills, tools, interests, short bio and links. The club admin and board also see your e-mail address. Other members see it only if you turn on "Show my e-mail to club members" in your profile.
• Your CV and other documents, average grade, residence and scholarship situations are visible only to you. We do not show them to clubs or companies.
• In Clubs, companies, only if you turn on "Show my profile to companies" in your profile. We may then show your name, skills and study details to companies that look for student teams.
• Funding company profiles and the e-mail addresses left in the funding search are not public. We do not pass them to universities, researchers or other companies without your consent.
• Google, when you sign in with Google. Google handles that sign-in under its own privacy policy and tells us only the sign-in data listed above.
• Our service providers, who process data for us under a data processing agreement: Supabase (database, login and file storage, servers in the EU), Vercel (hosting and analytics without cookies), Resend (sending account e-mails such as confirmation and password reset links; Resend is a US company, and sending from our domain runs in its EU region eu-west-1, Ireland) and, in Clubs only, OpenAI (AI reading of uploaded CVs to suggest profile entries; the file is sent when you upload a CV or ask us to read it again; OpenAI does not use it to train models and keeps it for at most 30 days for abuse monitoring).
• Public authorities, when the law requires it.
• A buyer or legal successor of the operator of the services, if the business is sold or reorganised. The successor must respect this policy.
• We do not sell personal data.

Transfers outside the EEA

Supabase, Vercel, Resend and OpenAI are US companies. They, and Google for Google sign-in, may process data in the United States, also when the service runs in an EU region. We base such transfers on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards used.

How long we keep it

• Account, company profile, Clubs profile and club data: while your account exists. We delete it within 30 days after the account is deleted, except for anonymised data.
• E-mail addresses left in the funding search: until you withdraw your consent, and at most 2 years after our last contact.
• Documents: until you delete them or your account.
• Usage data and logs: up to 24 months. After that we delete or anonymise them.
• Company requests and messages: up to 3 years after the last contact, for possible claims.
• Backups are overwritten in a regular cycle, after 30 days at the latest.

Your rights

• You have the right to access your data, correct it, delete it, restrict its processing, receive it in a portable format, and object to processing based on the controller's legitimate interest.
• Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
• To use a right, or to delete your account, write to iwo@scindu.com, if possible from the address of your account. We reply within one month.
• You can lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

Required and optional data

• Funding: to create an account with e-mail, you need an e-mail address, a password, a company name and a goal. With Google sign-in, a Google account is enough, and you give the company name later in your profile. A company name is enough to save the profile. For a complete profile, also give the goal and the company size. All other data is optional. Without it, matching is less precise.
• Clubs: to create an account with e-mail, you need your name, e-mail address, a password and your university. With Google sign-in, your name and e-mail address come from your Google account. All other profile data, documents and settings are optional. Without them, matching is less precise.
• The funding search works without an e-mail address. Leaving one is optional.

Cookies

We use only the cookies needed to keep you signed in (including a short-lived one during Google sign-in) and to remember your language. Our analytics does not use cookies and does not record query strings in page addresses. The service may also keep small settings, such as a closed notice, in your browser's local storage. They do not leave your device.

Age and changes

• Grant Radar Clubs is for people aged 16 or older. Funding is for companies and the people who act for them.
• We may update this policy. The date at the top shows the version in force. We tell users about important changes by e-mail or in the service.

Sample data

In Clubs, opportunities marked Sample, and the example club, are illustrative. They do not describe real calls, funders or people.