Privacy Policy
Last updated: 16 October 2026
This policy explains how [DENUMIRE FIRMĂ / COMPANY NAME] ("we") handles personal data in GrantFlow, a service for managing EU-funded grants (timesheets, budgets, reporting and audit records).
1. Who we are and our two roles
[DENUMIRE FIRMĂ / COMPANY NAME], [SEDIU SOCIAL / REGISTERED ADDRESS], trade register [NR. REGISTRUL COMERȚULUI / TRADE REGISTER NO.], VAT ID [CUI / VAT ID]. Contact for data protection: [E-MAIL DE CONTACT / CONTACT E-MAIL].
We play two different roles under the GDPR:
- Processor for the data our customers put into GrantFlow: the organisations that use GrantFlow (universities, research centres, companies) decide why and how their staff's data is processed. They are the controllers. We process that data only on their instructions, under a Data Processing Agreement (DPA). If you are an employee of a customer, your employer is your first contact for questions about your data.
- Controller for a small amount of data we collect for ourselves: requests sent through our website, the contact details of the people who manage customer accounts, billing data and the security logs of our own service.
2. Data we process for our customers (as processor)
Depending on how a customer uses GrantFlow, the service holds:
- Identity and role: name, work e-mail address, role, supervisor, HR identifier, organisation.
- Employment data: employment contract period, working time (FTE) and hours per day; staff category.
- Personnel costs: annual personnel costs and contributions, and the daily rate derived from them.
- Absences: periods of leave and their type. A type such as "sick leave" can reveal health information; customers may record a neutral "absence" instead.
- Timesheets: hours per day and task, signatures (name, time, document fingerprint), corrections and the reasons given.
- Expenses and documents: receipts, invoices and project documents, which may contain names of travellers, suppliers or signatories.
- Project information: risk owners, authors of publications, meeting events imported from a calendar file, and commit messages if the GitHub integration is used.
- Audit trail: who did what and when, with the IP address and browser of the person, for every change and download.
The customer is responsible for having a legal basis for this processing (usually the employment contract, legal obligations and the obligations of the EU grant agreement) and for informing its staff.
3. Data we process for ourselves (as controller)
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Pilot and contact requests: name, e-mail, organisation, PIC, country, project acronym, grant number, budget | To answer the request and set up a pilot | Steps before a contract (b); our legitimate interest in answering business enquiries (f) |
| IP address of form submissions | To limit abuse (at most 5 requests per hour per network) | Legitimate interest in security (f) |
| Contact details of customer administrators | To provide the service and support | Contract (b) |
| Billing data of customer organisations (card data is handled only by Stripe) | Invoicing and accounting | Contract (b) and legal obligation (c) |
| Technical logs and error reports | To keep the service secure and working | Legitimate interest (f) |
4. Where the data is stored and who receives it
GrantFlow's database and files are hosted in the European Union (Ireland). Receipts are read with text recognition in your own browser: the image is not sent to any external AI service. We do not sell personal data and we do not use it for advertising.
We use the following providers (sub-processors). Some are companies based in the USA; transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
| Provider | Service | Data location | Transfer safeguard |
|---|---|---|---|
| Supabase, Inc. | Database, file storage for receipts and documents, sign-in | Ireland (AWS eu-west-1) | Hosted in the EU; company in the USA: EU–US Data Privacy Framework and Standard Contractual Clauses |
| Vercel Inc. | Application hosting and delivery | Application servers in Dublin, Ireland; content delivery network worldwide | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Resend | Sending e-mails (reminders, alerts, password reset) | USA | EU–US Data Privacy Framework and/or Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Subscription payments (customer organisations only) | Ireland (with group entities in the USA) | Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Technical error reports; personal data is removed before sending | USA or EU, as configured | EU–US Data Privacy Framework and Standard Contractual Clauses |
Exchange rates (European Central Bank) and public holidays (Nager.Date) are fetched from public services; no personal data is sent to them.
5. How long we keep data
- Customer data: for as long as the customer's contract runs, then returned (export) and deleted as set out in the DPA. EU grant rules require beneficiaries to keep records for 5 years after the payment of the balance (3 years for grants up to €60,000); customers can keep closed projects in a read-only archive for that period.
- When a person leaves: the customer can pseudonymise the profile (name and e-mail are replaced). Signed timesheets and the audit trail are kept unchanged, because the EU retention obligation requires it (GDPR Art. 17(3)(b)).
- Pilot and contact requests: up to 12 months if no contract follows.
- Billing records: as long as accounting law requires.
- Technical logs: up to 90 days, except the audit trail of customer projects, which follows the customer's retention.
6. Security
Encrypted connections, data hosted in the EU, access by role, optional two-factor sign-in, database rules that make signed records and the audit trail impossible to change or delete, a tamper-evident (hash-chained) audit log and logging of every download. The full list is in Annex 2 of the DPA.
7. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent.
- Data held for a customer (for example your timesheets): contact your employer or the organisation that invited you. If you write to us, we forward the request to that organisation within 5 working days and help it to answer.
- Data we hold for ourselves: write to [E-MAIL DE CONTACT / CONTACT E-MAIL]. We answer within one month.
- In GrantFlow, administrators can export a person's data (JSON) and pseudonymise a profile. Signed timesheets are corrected by a new version, never overwritten.
You can also complain to a data protection authority. In Romania: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro.
9. Automated checks and AI
GrantFlow checks entries against EU grant rules (for example the 215-day annual limit) and computes a project "scorecard". These are aids for people: they do not take decisions with legal effects about anyone. The optional AI assistant answers questions from project data and is run on a model chosen by the customer; your data is not used to train models.
10. Changes and contact
We will publish any change to this policy on this page and tell customer administrators about important changes in advance.
Questions: [E-MAIL DE CONTACT / CONTACT E-MAIL] · [DENUMIRE FIRMĂ / COMPANY NAME], [SEDIU SOCIAL / REGISTERED ADDRESS].