Privacy Policy

1. Who we are

WellGranted is a product of VRP Consulting. The company responsible for your personal information (the "controller") depends on where you are:

• EU, EEA and Switzerland: VRP Consulting sp. z o.o., Jerozolimskie 123A, 02-017, Warsaw, Poland,
• United Kingdom: VRP Consulting Ltd, 10-12 Bourlet Close, London, W1W 7BR, the UK,
• United States and all other countries: VRP Consulting, Inc., 268 Bush Street, #3836, San Francisco, CA 94104, USA.

"WellGranted", "we" and "us" mean the controller for your region. Where these companies jointly decide how data is used, they act as joint controllers, and you can exercise your rights with any of them at legal@vrpconsulting.com.

If you add information about other people (for example, team members named in an application), you confirm that you have the right to share it with us.

2. What we collect

• Account details: name, email, phone, password, organisation name and role.
• Application content: information you enter or upload to prepare grant applications, such as organisation details, project descriptions, budgets, team bios and documents, and the drafts WellGranted generates.
• Billing details: billing name and address, plan and payment history.
• Communications: support requests, feedback and emails with us.
• Device and usage data: IP address, browser, device, pages and features used, referring site and approximate location, collected through cookies and similar technologies (section 6).

Please do not include sensitive information (such as health data, ethnicity or religious beliefs) in application content unless the grant requires it and you have the right to share it.

3. How we use it and why

The legal basis under the EU/UK GDPR is shown in brackets.

• Create and manage your account and provide the service, including generating AI drafts from your content (contract).
• Process payments and keep financial records (contract; legal obligation).
• Provide support and send service messages, such as security and billing notices (contract; legitimate interests).
• Keep the service secure and prevent fraud and abuse (legitimate interests).
• Improve WellGranted using usage data and aggregated or de-identified information (legitimate interests).
• Send product news, see section 5 (legitimate interests or consent).
• Use analytics and advertising cookies (consent).
• Comply with the law and defend legal claims (legal obligation; legitimate interests).

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (section 10).

4. How we use AI

WellGranted uses AI models to analyse your content and draft application text. Your content is sent to the provider only to generate responses for you, and the provider does not use it to train its models. We do not use your application content to train AI models without your permission. AI output can be inaccurate, so please review it before you submit anything. You decide what to submit; WellGranted does not make decisions about you that have legal or similarly significant effects.

5. Marketing

We may email you product updates, grant tips and offers.

• In the EU, UK and Switzerland, we send marketing only where local e-privacy rules allow it, and ask for consent where they require it.
• Every email has an unsubscribe link. We will still send essential service messages about your account.

6. Cookies

We use cookies. Only essential cookies are set without your choice; in the EU, UK and Switzerland, others are set only after you accept them in our cookie banner. You can change your choice any time via Cookie Settings. We use four types:

• Essential: login, security, load balancing and saving your cookie choice.
• Functional: live chat and support.
• Analytics (Google Analytics): measuring visits, feature use and campaign performance.
• Advertising (Google Ads, Microsoft Advertising, LinkedIn): measuring ads and showing relevant ads on other sites.

A full, current list of cookies is available in Cookie Settings. We honour Global Privacy Control (GPC) signals as an opt-out of advertising cookies.

7 . Who we share it with

We do not sell your personal information for money. We share it only with:

• Service providers acting on our instructions: hosting, AI models, email (Google), analytics (Google) and advertising (Google, Microsoft, LinkedIn).
• VRP group companies, under this policy.
• Authorities or courts where the law requires it, or to prevent fraud or protect rights and safety.
• A buyer or successor if WellGranted or our business is sold or merged.

8. International transfers

Our companies are in the USA, the UK, Poland, and our service providers operate worldwide, so your data may be transferred between countries. We protect these transfers with:

• adequacy decisions, for transfers between the EU, the UK and Switzerland;
• the EU-US Data Privacy Framework, its UK Extension and the Swiss-US framework, where our US service providers are certified;
• Standard Contractual Clauses, including between our own companies; or
• another lawful safeguard.

9. Retention and security

We keep personal information only as long as we need it for the purposes above or to meet legal, tax and accounting duties. Typical periods:

• account details and application content: while your account is open, then deleted within 30 days of closure (90 days for backups);
• billing records: 7 years;
• support and marketing records: 24 months after the last interaction, or until you unsubscribe;
• web server logs: 12 months; IP addresses deleted or truncated after 30 days;
• cookies: up to 2 years.

You can delete application content or close your account at any time by sending an email at: legal@vrpconsulting.com.

We protect your data with measures including encryption in transit and at rest, access controls and regular security reviews. If a breach is likely to put you at risk, we will notify the regulator within 72 hours and inform you where required.

10. Your rights (EU, UK and Switzerland)

You have the right to:

• access your data and get a copy of it;
• correct inaccurate data;
• have your data deleted;
• restrict how we use it;
• receive your data in a portable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting earlier processing.

To use these rights, email legal@vrpconsulting.com. We respond within one month and may need to verify your identity. Requests are free unless clearly unfounded or excessive.

If you are unhappy with how we handle your data, please contact us first so we can try to resolve it. You can also complain to a data protection authority.

11. Your rights (United States)

Depending on your state (for example California, Colorado, Connecticut, Virginia or Texas), you may have the right to:

• know what personal information we collect, use and disclose, and get a copy;
• correct or delete it;
• opt out of "sale" or "sharing" for targeted advertising;
• not be treated differently for using these rights.

12. Children

WellGranted is not directed at anyone under 18. If we learn we hold a child's data, we will delete it.

13. Changes

We may update this policy. We will change the effective date above and, for significant changes, notify you by email.

14. Contact us

For privacy questions and requests, email: legal@vrpconsulting.com

• EU, EEA and Switzerland: VRP Consulting sp. z o.o., Jerozolimskie 123A, 02-017, Warsaw, Poland,
• United Kingdom: VRP Consulting Ltd, 10-12 Bourlet Close, London, W1W 7BR, the UK,
• United States and other countries: VRP Consulting, Inc., 268 Bush Street, #3836, San Francisco, CA 94104, USA