Privacy Policy

GrantSmart.ai is a project management platform for Horizon Europe and other EU-funded projects. For the personal data described here, the GrantSmart.ai team acts as data controller for website visitors, live-demo visitors and demo requests, and as data processor for the project data our customers upload into their own workspace.

You can reach us about any privacy matter at kostas@amplianitis-consulting.com.

• Live demo requests. Name, work email, company or organisation name, your role, the number of EU projects you manage, the biggest issue you tell us you face, and the fact that you accepted this policy. We use this to contact you about your live demo and product updates.
• Live demo usage. When you open the public live demo at grantsmart.ai/demo, we create a temporary workspace copy containing only fictional sample data and store a session identifier so we can return you to your own copy. Anything you add inside the demo copy stays in that copy and is deleted automatically after 24 hours. We do not record usage activity (pages or clicks) for live-demo visitors, and the AI assistant is switched off in the demo.
• Account data. Email address and authentication credentials handled by our authentication provider, plus organisation details you enter (company name, address, VAT number, logo, legal representative).
• Project data you upload. Grant Agreements and other project documents, contributor records (name, role, email, contract hours, rates, leave and cessation dates), timesheets, tasks and comments, ledger entries and proofs of payment, equipment and subcontracting records.
• Technical data. Standard server logs generated when you use the service, used for security and troubleshooting.
• Usage activity. When you are signed in, we record the pages you open and the buttons and links you click, with the time, to support you, improve the product and investigate misuse. We never record what you type into forms.

We do not intentionally collect special categories of personal data. Please avoid uploading them.

• To respond to live-demo requests and arrange a walkthrough with you.
• To provide the public live demo: creating your temporary workspace copy with fictional sample data, keeping it available during your visit and deleting it after 24 hours.
• To create and operate your account, organisation and projects.
• To generate timesheets, financial views, exports and status reports from the data you enter.
• To send service emails such as contributor invitations and comment mentions.
• To process subscription payments and keep billing records.
• To secure the service, prevent abuse and fix problems.

Some features use AI models to read uploaded Grant Agreements and to draft status report summaries. Content sent for that purpose is processed to produce your output; we do not use your project content to train our own models.

We rely on your consent for demo requests and marketing contact, on performance of a contract to provide the platform to account holders, on legal obligations for invoicing and accounting records, and on our legitimate interests in keeping the service secure and reliable.

We use a small number of providers who process data on our behalf under contract:

• Cloud hosting, database, authentication and file storage for the application.
• An email delivery provider for transactional messages.
• A payment provider for subscriptions; card details are handled by them, never stored by us.
• AI model providers for document extraction and report drafting.

Where a provider processes data outside the EEA, transfers are covered by the safeguards offered by that provider, such as Standard Contractual Clauses.

Live-demo requests are kept for up to 24 months after last contact unless you ask us to delete them earlier. Live-demo workspace copies — including anything added inside them — are deleted automatically after 24 hours. Account and project data is kept for as long as your account is active and deleted on request after closure, except records we must keep for accounting or legal reasons. Deleting a project removes its associated records from the live database.

Access to your workspace requires authentication, and database access rules restrict each account to its own organisation's records. Data is encrypted in transit, and uploaded files are stored in private buckets that are not publicly listable. No system can be guaranteed free of risk, so we do not make absolute security claims; we do commit to notifying affected users and, where required, supervisory authorities of a personal data breach without undue delay.

If you are in the EEA or UK, you may request access, correction, erasure, restriction, portability, or object to processing, and you may withdraw consent at any time. Email kostas@amplianitis-consulting.com and we will respond within one month. You also have the right to lodge a complaint with your national data protection authority.

If your data is in a customer's workspace (for example as a project contributor), please contact that organisation first; we will assist them as their processor.

We use only cookies and local storage that are strictly necessary to keep you signed in and to remember basic preferences. We do not run advertising or cross-site tracking cookies.

We may update this policy as the product evolves; the date at the top always shows the current version. For any question, request or complaint, write to kostas@amplianitis-consulting.com.