Effective date: January 1, 2026
Information we collect
Account information you provide (name, work email, organization and role), information you enter into the platform (awards, projects, budgets, transactions, vendors and documents), and technical information such as log data, device information and IP address used to secure the service.
How we use information
To provide and operate the platform, authenticate users, enforce permissions and audit trails, respond to support requests, detect abuse and fraud, meet legal obligations, and improve reliability and performance. We do not sell personal information.
Customer data ownership
Organizational records you enter remain yours. We process them on your behalf as a service provider under your instructions and the agreement between us. Access by our personnel is limited to what is required to operate and support the service and is logged.
Legal basis and consent
Where required, we process personal information based on contract performance, legitimate interests in operating and securing the service, legal obligations, or your consent. Where consent is the basis, you may withdraw it at any time.
Sharing and subprocessors
We share information with infrastructure, database, email delivery and analytics subprocessors that are bound by confidentiality and data protection terms, and with authorities when legally required. Funder or recipient visibility inside the platform is controlled by explicit field-level sharing settings you configure.
Retention
Records are retained for as long as your organization maintains an account and thereafter for periods needed to satisfy grant, audit, tax and legal retention requirements. Audit history is append-only and is retained for the life of the record.
Security
We use encryption in transit and at rest, tenant isolation with row-level security, role-based access control, verification codes, authenticated document access and immutable audit logging. No system is perfectly secure; we notify affected customers of confirmed breaches without undue delay.
Your rights
Depending on your location, you may request access, correction, deletion, restriction, portability, or object to certain processing. For data held on behalf of an organization, we direct requests to that organization as the controller.
International transfers
Where information is transferred across borders, we rely on appropriate safeguards, including standard contractual clauses where applicable.
Children
The platform is intended for organizational use by adults. We do not knowingly collect information from children.
Changes and contact
We will post material changes to this policy on this page with an updated effective date. Questions or requests: privacy@iprojectcloud.com.