Privacy Policy
How Grant collects, uses, and protects your information.
Grant is a service that helps people create and maintain a structured personal context file for use with connected AI agents. This notice explains what personal information Grant collects, how it is used, who it is shared with, and the choices you have under UK GDPR.
Who this policy applies to
This policy applies to people who use Grant, including people who create an account, complete onboarding, connect agents, submit or review proposals, or otherwise use the service.
Who controls your information
For the purposes of UK data protection law, Grant is the controller of the personal information described in this policy.
If you have questions about how Grant handles personal information, you can contact your Grant deployment operator.
What information Grant collects
Grant currently stores and processes the following categories of information as part of operating the service.
- name
- email address
- profile picture
- Grant profile contents
- onboarding answers
- proposal history
- activity history
- connection metadata
- connection tokens
How Grant collects information
When you run an AI feature such as quality analysis, the relevant parts of your Grant profile are sent to OpenRouter using the key you configured in Settings.
- directly from you when you sign in, complete onboarding, edit your Grant profile, manage connections, or use account features
- from Google Auth when basic account information is provided during sign-in, such as your name, email address, and profile image
- from connected agent activity when an agent reads Grant through a tokenised endpoint or submits a proposal back through a tokenised endpoint
Why Grant uses information
Grant uses personal information to provide and run the service, including to create and manage accounts, authenticate users, generate and maintain profiles, run AI features such as quality analysis, support connected agent reads and proposals, store proposal and activity history, manage tokens and connections, respond to support requests, and comply with legal obligations.
Under UK GDPR, the main lawful bases Grant is likely to rely on are performance of a contract where processing is needed to provide the service you asked for, legitimate interests where processing is needed to run and secure the service in a proportionate way, and legal obligation where processing is needed to comply with applicable law.
Where a specific activity depends on consent, Grant will rely on consent for that activity.
Agent access and proposal endpoints
Grant provides tokenised endpoints that let connected agents interact with a user's Grant profile.
- A valid read token allows an agent to read the relevant Grant payload.
- A valid proposal token allows an agent to submit a proposal back to Grant.
- Proposal submissions may include the agent name, section information, the reason for the proposed change, and draft content.
- Connection metadata may be recorded so Grant can show connection status and recent activity.
These tokens are secrets and should be treated carefully. Grant stores connection tokens so the service can verify and use them. Users can rotate tokens, and rotating a token will break existing agent connections that depend on them.
Retention
Grant keeps personal information for as long as it is reasonably needed to provide the service, maintain the account, keep proposal and activity history available to the user, and meet legal or operational requirements.
- Account and Grant data are normally kept while your account remains active.
- If you ask for deletion, Grant will delete your account and associated data, subject to any limited retention that may be required for legal, security, fraud-prevention, or administrative reasons.
- If you want a copy of your data before deletion, you can request export first.
Your rights
Depending on the circumstances, UK GDPR gives you rights over your personal information.
- ask for access to your personal information
- ask for incorrect information to be corrected
- ask for your information to be deleted
- ask for export of your data
- object to certain processing
- ask for processing to be restricted
- withdraw consent where processing depends on consent
To make a privacy request, contact your Grant deployment operator. Grant also provides account deletion and data export functionality as part of the service.
Contact and complaints
If you have questions about this policy or how Grant handles personal information, contact your Grant deployment operator.
If you are unhappy with how Grant handles your personal information, please contact Grant first so there is a chance to help.
You also have the right to complain to the UK Information Commissioner's Office (ICO). Information about how to do that is available at ico.org.uk.
Changes to this policy
Grant may update this Privacy Policy from time to time to reflect changes to the service, legal requirements, or how personal information is handled.