GrantPath Privacy Policy

Effective October 13, 2026

This policy explains what information Gnosis Concepts Inc. ("we," "us") collects through GrantPath at grantpath-ai.com (the "Service"), how we use it, who we share it with and the choices you have.

The short version: we use your information only to run GrantPath for your organization. We don't sell it, we don't run ads or analytics trackers, and we don't use it to train AI models.

Your agreement. By signing up for an account or signing in to GrantPath, you agree to this Privacy Policy and to our Terms of Service, and you acknowledge that we collect, use and share information as described here. If you don't agree, don't sign up, sign in or use the Service.

1. Information we collect

Account information. Your email address, your username, your password (stored only as a secure hash by our authentication provider), your reminder setting, your organization memberships and roles, and invitations you send or receive. We don't ask for your name or phone number.

Organization profile and readiness answers. Organization name, type, city, county and state, whether it is rural, annual budget, description, focus areas and funding levels. Readiness answers are yes-or-no and status questions, for example whether you have tax-exempt status, a UEI or a SAM.gov registration. We don't collect EINs, UEIs, Social Security numbers or bank account numbers as values.

Optional owner and faith-based information. To match you with programs meant for particular groups, you may choose to tell us whether your organization's owners or leaders are women, veterans, service-disabled veterans, people with disabilities, LGBTQ+, or Black, Hispanic, Asian or Native American. If your organization is a church or faith-based nonprofit, the readiness questions also ask how you separate grant funds and keep religious activities voluntary. This information is optional. It is used only to match programs and to tailor Charis's answers for your organization, and it is visible only to your organization's members.

Applications and awards. Opportunities you track, uploaded funding notices (NOFOs and RFPs), requirements and evidence notes, uploaded award documents, award amounts, budgets, spending records, change requests, reporting obligations, and the funder contacts (names, emails and phone numbers) found in your award documents.

Billing information. If you subscribe or buy an add-on pack, Stripe collects your payment card and billing details directly. We never see or store your full card number. We keep your plan, subscription status, billing period and Stripe customer and subscription IDs so we can apply your plan.

Charis conversations. Your messages to the AI assistant and its answers. They are private to you within your organization, and you can delete each conversation.

Technical information. Our hosting and database providers record standard server logs (such as IP address, browser type and the time of each request) to run and secure the Service. If bot protection is switched on for sign-in, Cloudflare Turnstile or hCaptcha processes device and browser signals.

Browser storage. The app stores your sign-in session, your current organization and your Charis web-lookup setting in your browser's local storage. We don't use advertising or analytics cookies.

2. How we use information

We use information to:

• provide the Service: score readiness, sort programs by fit, search Grants.gov, read uploaded documents, build requirement matrices and award calendars, and track budgets;
• answer your questions through Charis;
• send service emails: sign-in links, password resets, invitations and deadline reminders (you can switch reminders off in Settings);
• secure the Service, prevent abuse and fix problems;
• respond to support requests;
• process payments for subscriptions and add-on packs; and
• meet legal obligations and enforce our Terms.

We don't sell personal information, share it for targeted advertising, or use your organization's content to train AI models.

3. Who we share information with

We share information only with service providers that help us run GrantPath, under contracts that limit their use of it, and only as needed for their role:

Under its commercial terms, Anthropic does not train its models on content we send through its API. When Charis's web lookups are on, Anthropic runs the searches and reads public web pages for your question; the search terms come from your question.

We may also disclose information:

• when the law, a court order or a valid government request requires it;
• to protect the rights, safety and security of our users, the public or Gnosis Concepts Inc.; or
• to a buyer or successor in a merger, acquisition or sale of the business, which would remain bound by this policy.

4. Who can see your organization's information

Everything in an organization (profile, applications, awards, budgets, spending and uploaded documents) is visible to every member of that organization, not to other GrantPath users. Owners and admins manage the team. Charis conversations are visible only to the person who had them. Uploaded files are stored privately and opened through links that expire after five minutes.

5. How long we keep information

• Organization content is kept while the organization exists.
• When an owner deletes an organization, its records are deleted right away. Its uploaded files are deleted when you ask us, so please email us when you delete an organization.
• Account information is kept until you close your account.
• Reminder logs are kept so the same reminder isn't sent twice.
• Backups are kept for a limited period, then overwritten.

6. Your choices and rights

• Access, correct and delete. You can view and edit your organization's information in the app, delete applications and Charis conversations, leave an organization, and (as owner) delete an organization.
• Optional information. You can change or clear the optional owner answers on the Find grants page, and the faith-based answers on the Readiness page, at any time.
• Close your account. Email info@agilegnosis.com from your account's email address to close your account or to have uploaded files deleted. We will confirm the request and complete it within 30 days.
• Email. You can switch off deadline reminders in Settings. Sign-in and invitation emails are sent only when someone asks for them.
• State privacy rights. Depending on where you live, you may have the right to know, access, correct, delete or get a copy of your personal information, and to opt out of its sale or use for targeted advertising (we do neither). Email us to exercise any of these rights. We will verify your request, respond within the time the law allows, and won't treat you differently for using them. If we decline a request, you can appeal by replying to our decision.

7. Security

We use encryption in transit (HTTPS) and at rest, row-level security that limits each organization's data to its members, private file storage with short-lived links, and access to production systems limited to the people who run the Service. No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires.

8. Where information is processed

GrantPath is operated from the United States, and your information is stored and processed in the United States. The Service is intended for U.S. organizations.

9. Children

The Service is for organizations and isn't directed to children under 18. We don't knowingly collect information from children.

10. Changes to this policy

We will post any update here with a new effective date. If a change is material, we will tell you by email or in the app before it takes effect.

11. Contact

Gnosis Concepts Inc., San Antonio, Texas
Email: info@agilegnosis.com · Phone: (210) 993-6756