Grant Pathway — Privacy Policy
Version: 1.12
Effective date: 15 September 2026
Last updated: 15 September 2026
1. Who We Are
Grant Pathway is a free online tool that helps UK charities write grant applications. It is provided by RapidGlobe Ltd, a company registered in England and Wales.
| Company name | RapidGlobe Ltd |
| Company registration number | 05615649 |
| Registered address | Ground Floor Suite, Crown House, 40 North Street, Hornchurch, Essex RM11 1EW |
| ICO registration number | ZC168720 |
| Data protection contact | admin@rapidglobe.com |
RapidGlobe Ltd is the data controller for the personal information you provide when using Grant Pathway. This means we decide how and why your data is used, and we are responsible for keeping it safe.
2. What Information We Collect
Information you give us
When you register and use Grant Pathway, you provide:
- Your name — your first and last name, collected when you register. We use them to address you by name in emails and in the service
- Your email address — used to create and identify your account
- Your password — stored only as a secure one-way hash. We never see, store, or have any way to recover your actual password
- Your organisation's details — the name, description, whom you help, and where you work, as entered in your organisation profile
- Grant application content — funder guidelines you upload or paste in, and the answers you write and refine within the tool
- Any AI-suggested improvements you choose to accept, and any further edits you make, before saving your answer
- Your feedback preference — whether you tick the optional box at registration saying you are happy to be contacted about your experience of using the service. This is entirely optional, ticking it is not a condition of using Grant Pathway, and you can change your mind at any time (see Section 8)
Information we collect automatically
- Usage data — a count of AI-assisted requests made per account each month, used to manage the fair-use limit
- Session data — a secure token stored in your browser that keeps you signed in while you use the service
- Technical logs — when your browser or device contacts our service, our systems record standard technical information about the request, including your IP address, the page or feature requested, the time, and the type of browser you are using. We use these logs only to keep the service running, diagnose faults, and detect abuse. They are automatically deleted after 30 days (see Section 7)
- Error reports — if something goes wrong, limited technical information about the error may be collected to help us diagnose and fix the problem
Where we get your information from
Almost everything we hold comes directly from you — you type it in when you register, complete your organisation profile, or work on an application.
There is one exception. If you enter your charity's registration number, Grant Pathway may look that number up in a public register of charities and pre-fill some of your organisation's details, to save you typing them again. Two registers are used: the Charity Commission for England and Wales, and the Scottish Charity Register, maintained by the Office of the Scottish Charity Regulator (OSCR). Charities registered in Northern Ireland are not looked up automatically and enter their details themselves. This is optional — you can leave the registration number blank and enter everything yourself. The information returned is public register data about the organisation, not about you personally, and we only use it to populate your organisation profile. We send the regulator only the registration number you typed; we do not send them your name, email address, or anything else about you.
We do not buy personal information, receive it from data brokers, or obtain it from any other third-party source.
We do not collect payment information. We do not use advertising trackers. We do not build profiles for marketing purposes.
3. How We Use Your Information
We use your information to:
- Provide the service — create your account, save your organisation profile, generate AI-assisted summaries of funder guidelines and refine the answers you write on request, and let you export completed applications
- Maintain the service — monitor for errors, manage the fair-use limit, and keep the system running reliably
- Communicate with you — send a welcome email when you register, and a warning email if your account is approaching the two-year inactivity threshold (see Section 7)
- Keep the service secure — detect and prevent fraudulent or abusive use of the platform
We do not use your information for marketing. We do not sell your data. We do not use your information to train artificial intelligence models.
4. Legal Basis for Processing
Under the UK General Data Protection Regulation (UK GDPR), we must have a legal basis for processing your personal data. We rely on the following:
| Processing activity | Legal basis |
|---|---|
| Creating and managing your account | Contract — necessary to provide the service you have signed up for |
| Saving your organisation profile and application content | Contract — necessary to deliver the core features of the service |
| Sending service emails (welcome, inactivity warning) | Contract / Legitimate interests — necessary to operate the account lifecycle and keep you informed |
| Managing the fair-use limit | Legitimate interests — necessary to manage running costs and ensure fair access for all users |
| Error monitoring and security | Legitimate interests — necessary to keep the service reliable and protect against abuse |
| Keeping technical logs of requests made to the service, including IP addresses | Legitimate interests — necessary to keep the service running, diagnose faults, and detect and prevent abuse. These logs are deleted automatically after 30 days |
| Recording your feedback preference, and contacting you about your experience if you opted in | Consent — we only do this if you ticked the optional box at registration. You may withdraw your consent at any time, and doing so has no effect on your ability to use the service (see Section 8) |
Where we rely on legitimate interests, we have considered whether the processing is necessary, whether it could reasonably be achieved another way, and whether it would override your interests or rights. In each case above the processing is limited to what is needed to run the service safely and within cost, and we are satisfied it does not.
5. Who We Share Your Information With
We do not sell your data. We do not share it for advertising or marketing purposes. We work with a small number of trusted third-party service providers who process data on our behalf:
| Provider | What they do | Where your data is processed |
|---|---|---|
| Supabase | Stores your account, organisation profile, and application data | United Kingdom (London) |
| Amazon Web Services (Bedrock) | Powers the AI features that summarise funder guidelines and help refine the answers you write | United Kingdom / European Union |
| Resend | Sends transactional emails (welcome email, inactivity warning) | United States (Irish infrastructure is the sending endpoint only — see Section 6) |
| Vercel | Hosts the Grant Pathway web application | United Kingdom (London) — Vercel is a US company |
| Upstash | Limits how often requests can be made, to protect the service from abuse | Ireland (European Union) |
| Sentry | Captures error reports to help us diagnose and fix technical problems | Germany (European Union) |
| Axiom | Stores technical logs so we can diagnose faults and detect abuse | Germany (European Union) — technical logs; United States — RapidGlobe's account details, billing, etc. |
| GoDaddy (Professional Email) | Hosts the noreply@grantpathway.org.uk mailbox our automated emails are sent from, and which also receives any reply you send to that address | United States and the Cayman Islands — see Section 6 |
Each provider is bound by a data processing agreement and is only permitted to use your data to deliver the service to us — not for their own commercial purposes.
A note on AI processing: When you ask Grant Pathway to summarise funder guidelines or help refine an answer you have written, the relevant content (funder guidelines and your organisation profile) is processed by Amazon Web Services using the Anthropic Claude model via the Amazon Bedrock service. This processing takes place within the United Kingdom (AWS eu-west-2, London) under normal operating conditions, and never outside the European Economic Area under any circumstances. Your email address is never sent to the AI processing layer. Anthropic does not use this data to train its AI models — this commitment is upheld through the AWS and Anthropic terms governing the Bedrock service.
6. International Data Transfers
Almost all of your data stays within the United Kingdom or the European Economic Area (EEA). The EEA is covered by the UK's adequacy decision, which means personal data may be transferred there without any additional safeguard being required. Section 5 sets out where each provider processes your data.
Transfers outside the UK and EEA. Two providers are involved in processing outside the UK and EEA, and they are covered separately below because the data and the destinations differ. The first is Resend, which sends our transactional email. Email for our domain leaves Resend's network from Irish infrastructure, but that setting controls only the point of dispatch and does not affect where data is held. Resend has confirmed to us in writing, and its data processing agreement states, that personal data is transferred to and processed in the United States as a necessary part of providing the service. This applies to the recipient's name and email address, the content of the email, and the delivery logs and email event history. Resend does not offer an EU or EEA data-residency option.
Transfers to the Cayman Islands and the United States — our email mailbox. The mailbox behind noreply@grantpathway.org.uk is hosted by GoDaddy, whose infrastructure includes Titan Solution Ltd SEZC (Cayman Islands) and Amazon Web Services (United States) — neither covered by a UK adequacy decision. GoDaddy's data processing addendum applies the EU standard contractual clauses and the UK International Data Transfer Agreement, with the ICO as supervisory authority. This only affects any mail sent to the noreply@grantpathway.org.uk address — not your account or application data. You're never required to email us, and if you do, the only data involved is your name, email address, and message content. For data requests generally, see Section 11.
Where personal data is transferred outside the United Kingdom to either provider named above, or to any provider outside the United Kingdom we may substitute for it or for any other provider in future, we ensure that appropriate safeguards are in place — typically the UK's International Data Transfer Agreement (IDTA) or equivalent EEA standard contractual clauses — so that your data continues to be protected to the same standard as within the UK. Resend relies on the EU standard contractual clauses, the UK addendum to those clauses, and the EU–US Data Privacy Framework including its UK Extension.
7. How Long We Keep Your Information
| Data | Retention period |
|---|---|
| Account details and organisation profile | Until you delete your account, or until the inactivity deletion policy applies (see below) |
| Application content | Deleted when your account is deleted |
| AI usage log | Deleted when your account is deleted |
| Your name and feedback preference | Deleted when your account is deleted |
| Automated backup copies | Permanently removed within 7 days of account deletion, as part of standard backup rotation (see below) |
| Email delivery records | Held by Resend in the United States, in accordance with their standard retention policy (up to 90 days) |
Replies you send to our noreply@ address | Held in the mailbox until we delete them. No automatic deletion applies, so please use the Section 11 contact address for anything you want handled formally |
| Technical logs | Held for 30 days by our logging provider, and for a shorter period by our hosting provider, then automatically and permanently deleted |
| Rate-limiting data | Held only transiently — around one hour — and then automatically deleted |
| Error reports | Retained for up to 12 months for diagnostic purposes, anonymised where possible |
Inactivity deletion: If your account has not been used for two years, we will send a warning email to your registered address. If you do not log in within 30 days of that warning, your account and all associated data will be permanently deleted. You will receive no further warning before deletion occurs.
Account deletion on request: You can delete your account at any time from within the service. Your data is removed from our live systems immediately and permanently. As part of our operational backup infrastructure, automated backup copies are permanently removed within 7 days as part of the standard backup rotation cycle. These backup copies are not accessible to users and cannot be used to restore deleted content.
It is recommended that you store any information that may be deleted separately if you think you may need to use it after it is deleted as set out above.
8. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access — you can request a copy of the personal data we hold about you
- Right to rectification — you can ask us to correct inaccurate or incomplete data
- Right to erasure — you can ask us to delete your personal data (you can also do this directly by deleting your account within the service)
- Right to restriction — you can ask us to limit how we process your data while a concern is being resolved
- Right to data portability — you can ask for your data in a structured, commonly used, machine-readable format
- Right to object — you can object to processing based on legitimate interests
- Right to withdraw consent — where we rely on your consent, you can withdraw it at any time. The only processing we base on consent is contacting you about your experience of the service, if you opted in at registration. You can withdraw that consent by emailing us, and it will not affect your account or your ability to use Grant Pathway in any way
- Rights related to automated decision-making — Grant Pathway does not make automated decisions that have a legal or similarly significant effect on you
Which of these rights apply depends on the legal basis we rely on for the processing in question — Section 4 sets out the basis for each activity. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.
To exercise any of these rights, please contact us at admin@rapidglobe.com. We will respond within one month of receiving your request. We may need to verify your identity before we can process it.
There is no charge for exercising your rights in most cases.
9. Cookies
Grant Pathway uses a small number of cookies that are strictly necessary to operate the service:
- Sign-in cookies — when you open the sign-in page, a small number of temporary cookies are set so that the sign-in can be completed securely. They are part of the sign-in process itself and are not used to identify or track you.
- Authentication cookie — a secure, encrypted token that keeps you signed in during your session. This cookie is deleted when you sign out or when your session expires.
We do not use advertising cookies, analytics cookies, or any third-party tracking technology. Because we only use cookies that are strictly necessary for the service to function, we are not required to ask for your consent to set them — but we want to be transparent about their use.
10. Changes to This Policy
If we make significant changes to this policy — for example, if we add a new category of data or a new service provider — we will notify you by email before the changes take effect.
Minor or clarificatory changes may be made without advance notice. The updated policy will always be available at grantpathway.org.uk, and the "Last updated" date at the top of this page will reflect when it was last changed.
11. How to Contact Us
For any questions about this privacy policy, or to exercise your data rights, please contact us:
Email: admin@rapidglobe.com
Post: RapidGlobe Ltd, Ground Floor Suite, Crown House, 40 North Street, Hornchurch, Essex RM11 1EW
We aim to respond to all enquiries within five working days.
12. How to Complain
You have a right to complain to us about the handling of your personal data by emailing admin@rapidglobe.com. We will acknowledge your complaint within 30 days and will aim to resolve it as soon as possible after that.
If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority:
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We would always prefer the opportunity to resolve any concern directly before a formal complaint is made. Please contact us first and we will do our best to address your concern promptly.
Grant Pathway is provided by RapidGlobe Ltd (company number 05615649), registered in England and Wales.
Version: 1.12 Effective date: 15 September 2026 Last updated: 15 September 2026