Privacy notice

Version: 2026-10-08-v1. Effective 8 October 2026. Responsible operator: Amply LLC, 1110 N Virgil Ave, Los Angeles, CA 90029.

1. Information we handle

GrantTune handles account information, workspace content and technical records needed to provide scientific research and grant-drafting tools.

• Account and access information: account identifier, email, available name and profile picture, workspace membership, roles, invitation activity and access requests. Requests may include an institution and the submitted consent record.
• Workspace content: prompts, notes, drafts, generated answers, paper metadata and uploaded PDFs, reviews, corrections, decisions, and version or research history.
• Contribution records: all saved scientist corrections and associated context, contributor role and expertise, use permissions, agreement versions, dataset assignments and provenance.
• Technical information: session and browser storage, IP addresses, request times, device or browser information, security events and operational logs handled by us or our providers.

2. Sign-in and browser storage

Supabase manages authentication. If you choose Google sign-in, Google provides basic identity information using openid, email and profile permissions. We do not request Gmail, Drive, calendar or contact access. Google identity information is used for authentication and access control, not for training scientific or grant-writing models.

Your browser stores session information and may retain unfinished work and workspace selection. Signing out or revoking Google access does not delete records already saved. Authentication and workspace storage are used to provide the service. We do not use account identity for advertising.

3. Why we use information

We use information to authenticate users, check workspace permissions, save and display shared research records, process requested model jobs, support users, maintain appropriate histories, prevent abuse and meet legal obligations. Access requests help operators assess eligibility; they do not grant access or subscribe you to marketing.

All scientist corrections saved through scientific review features qualify for ongoing training and evaluation under the Training contribution agreement. This includes corrected answers, feedback, scientific annotations and explanations with associated context needed to understand them. There is no separate training opt-in for each correction. Ordinary draft uploads, paper uploads and generation requests do not automatically qualify; unrelated documents and third-party sources need their own permission. Role and expertise are self-reported signals used to interpret corrections, not verified credentials. We keep account identity separate from training content and remove direct identifiers before permitted model-improvement use.

We do not sell personal information or use Google identity information for advertising. We do not share personal information for cross-context behavioral advertising.

4. Who can access information

Records are shared with authorized members of the selected workspace. Admins manage access. GrantTune operators and service providers may access information as needed for their assigned functions. This is a collaborative workspace, not an individual private vault. Members may copy or export information they can access.

We may disclose information to comply with law, protect legal rights or address abuse and security risks, subject to applicable safeguards. We do not publish nonpublic workspace source content without separate permission. Models trained on authorized Contributions may be used by other customers; that does not give those customers access to your workspace records. Training can nevertheless create reproduction risks, addressed in the contribution agreement.

5. Providers and processing locations

Netlify hosts the application and stores shared records. Supabase handles authentication; Google handles optional Google sign-in. Our configured authentication-email service processes email addresses and sign-in messages to deliver authentication links or codes. These providers may process technical data needed for their services.

Current tRNA inference runs on an operator-managed computer. Cloud execution groundwork and an isolated public-model pilot do not establish that private workspace jobs currently run in the cloud. A cloud provider must be added to this notice, assessed and configured before it receives private content under the disclosed arrangement. Providers receiving Contributions must not use them for independent general-model training under our arrangement.

GrantTune is operated in the United States. Provider processing may occur in the United States or other countries where providers operate. We will assess any legally required transfer safeguards before processing subject to those requirements. The service does not promise local-only storage or processing.

6. Retention and removal

We retain information for the purposes described here, subject to applicable law and the criteria below. Shared research history and snapshots can contain earlier versions; account removal does not itself remove every contributed record. Training-source deletion and removal of influence from an existing model are different operations.

We retain account and access information while needed for membership, support and security; access requests while needed to assess and record eligibility; and technical logs while needed for operations and incident review. Workspace records, research snapshots and Contributions are retained while needed for the ongoing project and the permitted service and model-improvement purposes. We retain minimal acceptance and provenance evidence while needed to establish rights and resolve disputes. Backups may preserve earlier copies while needed for recovery. We review removal requests against these purposes and applicable law; this notice does not promise a fixed automatic deletion period.

The Training contribution agreement permits ongoing future use and does not offer contractual withdrawal. Labs may ask us to consider a written exception; requests do not automatically stop training permission. Mandatory privacy rights remain separate. We may retain limited restricted records where legally justified, but will explain the basis. We do not treat research history or technical difficulty as a blanket exemption from required deletion.

7. Your choices and requests

Contact hello@granttune.com to request access, correction, export, account closure, a lab-specific training exception or deletion. We may verify your identity and authority before acting. We will explain the scope of action, any applicable exception and the response timetable required by law. You may sign out or revoke Google access independently.

Where applicable law provides privacy rights, we will honor them, including relevant rights to object, restrict processing, withdraw consent or complain to a supervisory authority. Any withdrawal of privacy consent, where that is our legal basis, is distinct from the contractual content license and will be handled as required by law. A notice acknowledgment is not consent to every purpose.

We evaluate privacy obligations for the actual users and processing involved. Contract acceptance is not blanket consent to every use of personal information; we will provide any additional required notices or arrangements before introducing processing that requires them.

8. Information to keep out of the service

The service is intended for adults doing research work. Do not submit patient-identifying information, human-subject records or sensitive personal information. Share unpublished research only with the necessary authority. Contact us promptly if such information is submitted accidentally so we can assess containment and removal.

9. Changes and contact

We will date new versions and notify users of material changes. We will not silently expand training permissions for previously collected material. Contact: hello@granttune.com. Responsible operator and postal address: Amply LLC, 1110 N Virgil Ave, Los Angeles, CA 90029.