Privacy Policy

Granted is operated by Quill, Inc. This policy explains how we handle information when you use Granted. University and scholarship-provider records may also be subject to their own policies. A connection to an advisor does not by itself authorize every use or disclosure of an institutional record.

Account and profile information includes your name, email, school, education history, interests, goals and scholarship preferences. You may choose to provide eligibility details such as financial circumstances, demographic information and personal experiences. We use the information you provide to support matching and applications; an unanswered intake question is not treated as a confirmed answer.

Content includes essays, coaching messages, uploaded application documents, Google Doc links and saved drafts, advisor feedback, scholarship outcomes and supporting evidence, reminders, and community content you submit. We use it to provide the features you request, maintain application history and support authorized advising and reporting.

Operational records include sign-in and security events, IP addresses and browser information in service logs, requests to our servers, feature actions, agreement versions and acceptance times, and support requests. They help us operate, secure and troubleshoot Granted. If you enable mobile push notifications, we store the device notification token. Payment records include subscription status and processor identifiers; Stripe handles full payment-card details.

Your account information is not a public directory. Access depends on the feature and your permissions. Connected advisors can review shared application work under the current sharing rules. Donor advising requires its consent step; invitation-only fellowship workspaces follow their invitation, assignment and assistance rules. Authorized CSSE staff can access award records and restricted reports for their assigned responsibilities.

Community posts, reactions, squad activity and content you choose to share can be visible to other users under that feature’s rules. Anyone holding a portfolio or progress link you create may see the information included in that link. Consider the audience before sharing personal details. Copies already received by another person may remain with that person after you withdraw sharing.

Authorized Quill personnel and service providers may access information as needed to operate, support and protect Granted. We may disclose information when required by law, to protect rights and safety, or in a business transfer subject to applicable protections. We do not sell personal information or share it for cross-context behavioral advertising.

Vercel hosts the application and processes requests and operational logs. Supabase provides authentication, the database and document storage. Google provides optional sign-in and the Google Docs connection described below. Stripe processes payments and subscription administration. Resend delivers configured notifications and transactional email. ClickUp may receive the contact details and description in a support request to help our team resolve it.

Anthropic processes the text and relevant profile or application context used when you request AI coaching, essay review, drafting, strengths analysis or other AI assistance. Perplexity processes search questions and relevant profile or eligibility attributes for scholarship, fellowship and essay research. AI output can be inaccurate; verify requirements with the original provider. Provider handling and retention depend on the applicable contracts and account settings; contact us for questions about a particular use.

Our recovery process uses GitHub Actions to make encrypted backups and Backblaze B2 to store them. A separate restricted credential vault holds recovery credentials. The vault is not part of routine student matching or essay processing. Only authorized recovery operators can use the recovery materials.

Providers may process information in the United States and other locations where they operate. We limit disclosures to the service being used. Changes to these practices will be reflected in this policy.

The completed-application import in your profile uses local parsing within Granted’s server environment, without sending the application to an AI provider. The original import file is not retained by that feature. You review extracted suggestions and choose which details to save. This is different from saving an uploaded document in an application workspace or deliberately requesting AI review of a draft.

Connecting Google Docs, importing a completed application, or accepting terms does not itself consent to optional AI coaching or advisor sharing. Feature-specific permissions still apply. Avoid including unnecessary sensitive information in any draft, research question or support message.

When you connect Google, Granted requests access to individual documents you select. We store an encrypted connection credential, document links, dated text copies and review comments so you and your authorized advisor can review an essay and revisit drafts. Saving a copy does not change the original essay text. Comments you submit for Google sync are sent to the selected Google Doc; refreshing comments copies its comments and replies into Granted.

Regular essay reviews require an active advisor connection and the student’s essay-sharing permission. Fellowship reviews also follow current assistance rules. Feedback notices appear in Granted; configured email notices contain a sign-in link without essay text. Connecting a document alone does not send it to an AI provider.

You can disconnect Google in the review workspace and revoke Granted’s access in your Google Account. Disconnecting stops new access; it does not delete previously saved drafts or comments. Changes to Granted permissions do not change sharing permissions on the original Google Doc. Deleting a Granted account does not delete the original Google Doc or comments already posted there.

Granted uses cookies and browser storage for sign-in, security and interface preferences. Blocking these may prevent sign-in or other functions. We do not currently use Google Analytics or advertising trackers. We do not use cross-site behavioral tracking, and a browser Do Not Track signal does not change these practices. We do not sell or share information for cross-context advertising regardless of a Global Privacy Control signal.

Embedded services and externally hosted images or fonts may receive your IP address and browser request information when loaded. Google and payment services process information when you choose their features. Those providers may also operate on other websites under their own policies; Granted does not authorize them to use our disclosures for cross-site advertising. Links to scholarship sites lead to services with their own privacy practices.

We retain account records while needed to provide your account and requested features. You can delete individual content where that feature allows it. Account closure removes your sign-in account and dependent account records from the active database, removes stored Google credentials and queues eligible uploaded files for removal. Files awaiting cleanup may remain briefly in private storage. Support records linked to your account are redacted in Granted; copies at a support provider may require a separate follow-up.

Some institutional fellowship, advising, award, reporting and audit records survive account closure. Security, agreement, payment, dispute and legally required records may also need separate retention. These records are not all erased by the account-close button. Contact us and, where appropriate, CSSE for a review of the purpose, applicable retention requirements and any additional access or deletion request. We will not treat account closure as authorization to destroy institutional records.

Encrypted recovery copies use a rolling 30-day recovery window. Backblaze objects are locked for recovery protection and scheduled for removal through lifecycle rules; deletion is not immediate and provider processing can extend the time. Unchanged files used by newer backups remain protected for those newer recovery points. Supabase also maintains backups according to the project’s backup settings. Backup data is restricted to recovery and security purposes, not ordinary application use. Recovery procedures must reapply completed deletions before restored data is put back into service.

Settings lets you update your profile, download available account records and close your account. The export identifies unavailable sections and does not include every institutional record or every original uploaded file. Download original application files from their workspace. You can manage feature sharing, notification preferences, public links and Google access separately.

For additional access, correction, deletion or privacy questions, email privacy@grantedscholarships.com or use Granted’s support form. We may verify your identity and authority before responding. Available rights and exceptions depend on applicable law and whether Quill or an institution controls the records. We will not discriminate against you for exercising applicable privacy rights.

We use access controls, encrypted transport, database row-level security and restricted recovery credentials. No system can promise absolute security. Keep your sign-in credentials private and report suspected unauthorized access through support.

Granted is intended for older students and their advisors, not children under 13. We do not knowingly collect personal information from children under 13. Contact us if you believe such information has been provided so we can investigate and take appropriate action.

The version and date above identify this policy. We will provide notice of material changes through an in-app notice or email as appropriate, and request any consent required for a new use. Acknowledging this policy confirms receipt of the notice; it is not a waiver of privacy rights or blanket consent to every use of data.

Quill, Inc. operates Granted. Privacy requests: privacy@grantedscholarships.com. General support: support@grantedscholarships.com or the support form in Granted.