1. Scope and who we are
This Privacy Policy applies to the Funding Staff website, application, contact form, and related communications. FUNDING STAFF LLC, a Michigan limited liability company operating as Funding Staff, is responsible for the practices described here. The service is intended for United States nonprofit organizations and their authorized representatives.
This Policy does not cover a funder, government agency, or other third-party website linked from Funding Staff. Those organizations control their own privacy practices.
2. Information we collect
Account and team information
We collect account email addresses, authentication and security information, organization memberships, invitation records, roles, and account activity needed to create and protect accounts. We do not store your plain-text password in organization profiles or support records.
Organization profile information
You may provide an organization name, legal name, website, employer identification number, organization and tax status, years operating, headquarters city and state, service geography, mission, programs, populations served, funding needs, desired award range, priorities, deadline preferences, readiness information, average annual revenue, and related notes.
An organization may also choose to provide faith tradition, denominational affiliation, religious participation information, historic property information, capital project needs, security needs, or information about separating religious and community program costs. Some of this information may be considered sensitive in certain places. Provide it only when your organization is authorized and comfortable doing so.
Opportunity and workflow information
We collect opportunity matches, match scores and explanations, status choices, review history, readiness decisions, assignment information, approvals, notifications, and related timestamps.
Communications
If you contact us, we collect your name, email address, optional organization name, selected topic, message, and related correspondence. Contact form messages are delivered to the Funding Staff operations mailbox and are not stored as customer records in the application database.
Technical and security information
We and our providers may process IP address, device and browser information, timestamps, requested pages, session and authentication events, error details, deployment and uptime data, and bot-detection signals. The contact form rate limiter stores one-way keyed fingerprints derived from visitor and email information, not the raw IP address or raw email address in that rate-limit table.
Subscriptions and payments, when offered
Stripe processes paid checkout and payment-method management. Stripe may collect billing contact details, address, payment details, and information needed to process a payment and prevent fraud. Funding Staff keeps limited subscription, price, invoice, payment-status, cancellation, refund/dispute, founding-member eligibility, and purchase-agreement records needed to operate billing and resolve errors. We do not store full card numbers or card security codes in our application database. Named private testers do not provide a card or automatically become paying subscribers.
Private pilot feedback
For invited testers, we record the access period, check-in requests and answers, reminder and delivery status, and any access pause or restoration. Feedback helps us understand use and improve the service. Do not include information about beneficiaries, private grant documents, card details, passwords, or verification codes. Feedback is not permission to identify you publicly or use your words as a testimonial.
3. Where information comes from
We collect information:
- Directly from you when you create an account, complete a profile, contact us, or use the service.
- From an organization owner or teammate who invites you or manages a shared workspace.
- Automatically from the website, application, authentication system, security tools, and hosting infrastructure.
- From public funder, government, and nonprofit sources used to maintain the opportunity library.
4. How we use information
We use information to:
- Create accounts, authenticate users, and manage organization access.
- Build organization profiles and calculate or explain opportunity matches.
- Display, track, and manage funding opportunities and related workflow.
- Send account, security, invitation, support, private-pilot check-ins, and service communications.
- When you purchase, process subscriptions, record purchase agreements and price protection, provide payment notices, and handle cancellation and billing errors.
- Respond to contact requests and provide support.
- Protect the service, prevent abuse, enforce limits, and investigate security incidents.
- Monitor availability, diagnose errors, maintain backups, and recover from failures.
- Improve features, test performance, and understand how the service operates.
- Comply with law, protect rights and safety, and enforce our Terms of Use.
5. Cookies and similar technologies
Funding Staff uses strictly necessary session and authentication cookies to keep users signed in and protect account access. Cloudflare Turnstile uses device and security signals to distinguish people from abusive automated traffic. Hosting, monitoring, and security providers may also process technical logs needed to operate and secure the service.
Funding Staff does not currently use advertising cookies, cross-site behavioral advertising, or third-party advertising analytics. If that changes, we will update this Policy and provide any notice or choice required by law.
6. How we disclose information
We may disclose information in these limited circumstances:
- Within your organization. Authorized owners and team members may see information in the shared workspace.
- Service providers. Vendors process information for hosting, databases, authentication, email, security, backups, monitoring, and related operations under their own contractual and security obligations.
- Legal and safety reasons. We may disclose information when reasonably necessary to comply with law, legal process, or a valid government request, or to protect users, Funding Staff, or the public from fraud, abuse, security threats, or harm.
- Business transactions. Information may be transferred as part of a merger, financing, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality and notice requirements.
- With your direction or consent. We may disclose information when you ask us to or clearly agree.
7. Service providers used by Funding Staff
Current providers include:
- Supabase for authentication and the application database.
- Vercel for application hosting and deployment.
- Cloudflare for domain services, Turnstile security checks, and encrypted backup storage.
- Resend for transactional, authentication, and contact-form email delivery.
- Sentry for error and uptime monitoring.
- Google Gemini for a staff-only tool that helps extract draft facts from public opportunity sources.
- Stripe for checkout, subscriptions, payment-method management, and billing communications when paid billing is offered. Stripe's Privacy Policy describes its processing.
These providers may process technical and account information necessary to perform their services. Their own privacy notices also apply to their processing.
8. AI-assisted processing
Funding Staff currently uses Google Gemini in a staff-only workflow to extract draft facts from public funding-opportunity source material. A staff member reviews the draft before an opportunity is published. The current workflow is not designed to send organization profiles, customer messages, passwords, payment information, or private application documents to the AI provider.
Funding Staff records limited operational audit information about these requests, such as the provider, model, timing, token usage, status, and staff user. The audit record does not store the full pasted source text. Match results shown to users are generated by Funding Staff's application rules from profile and opportunity data, and do not make funding decisions.
9. No sale of personal information
Funding Staff does not sell personal information. Funding Staff does not share personal information for cross-context behavioral advertising and does not use personal information to target third-party advertisements. If these practices change, we will update this Policy before the change and provide legally required choices.
10. Retention
We retain account, organization, and workflow information while the account or organization is active and for as long as reasonably needed to provide the service, resolve disputes, maintain security and audit records, comply with law, and enforce agreements. The exact period depends on the type of information and the reason it is kept.
Current production database backups are retained for seven days. Independent encrypted database exports stored in the private backup system have a 90-day deletion lifecycle. Deleted information may remain in protected backups until those backups rotate out, and it will not be restored except as part of disaster recovery. Contact-form rate-limit fingerprints older than seven days are deleted during normal rate-limit processing.
Communications and pilot feedback may remain in business email, delivery records, or the application as needed for support, product improvement, and operations. Legal acceptance, purchase-agreement, founding-member, billing, and security records may be retained when reasonably necessary for compliance, accounting, fraud prevention, or dispute resolution. Cancelling renewal stops future renewal charges; it is not an immediate deletion request. You can separately make a privacy request below.
11. Security
Funding Staff uses administrative, technical, and organizational safeguards intended to protect information. Current measures include role-based access controls, row-level database security, encrypted network connections, restricted production credentials, multi-factor authentication for critical infrastructure, bot protection, monitoring, managed backups, and independently encrypted backup copies.
Monitoring is configured to exclude cookies, request and response bodies, user identity fields, headers, query strings, database values, AI inputs and outputs, and stack-local variables from error events. No system can guarantee absolute security. You are responsible for protecting your account credentials and devices.
12. Your organization and other users
Information in an organization workspace is available to its authorized members according to their roles. Funding Staff does not control how your organization uses information it obtains independently or exports from the service. Ask your organization owner about internal access and retention practices.
13. Your choices and privacy requests
You can review and correct much of your organization profile in the application. You may ask Funding Staff to provide access to, correct, export, or delete personal information associated with you. You may also ask questions or object to a particular use. Available rights vary by location and may have legal exceptions.
Send a request from the email address connected to your account to support@fundingstaff.com. Describe what you are requesting and the organization involved. We may verify your identity and authority before acting. We will not discriminate against you for making a privacy request.
Organization information may belong to the organization rather than an individual. In that case, we may direct the request to the organization owner or require proof that you are authorized to act for the organization.
14. Account deletion
To request account or organization deletion, email support@fundingstaff.com. Deleting an account may not immediately remove information from active sessions, protected backups, legal records, security records, or information that must be retained by law. We will explain any material exception that applies to a verified request.
15. Children's privacy
Funding Staff is intended only for adults age 18 or older acting for nonprofit organizations. Individuals under 18 may not create or use an account. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact support@fundingstaff.com so we can investigate and take appropriate action.
16. United States processing
Funding Staff is currently offered for United States organizations. Information is processed and stored in the United States or in locations used by our service providers. If you use the service from another country, your information may be transferred to and processed in the United States, where privacy laws may differ.
17. Changes to this Policy
We may update this Policy as the service, law, or business changes. The date at the top shows when it was last updated. If a change materially affects current users, we will provide notice through the service, by email, or by another reasonable method when required by law.
18. Contact
For privacy questions or requests, email support@fundingstaff.com or use the Funding Staff contact form. For a suspected security issue, email security@fundingstaff.com.