Loading GrantX
Privacy Policy
This policy explains what we collect, why we collect it, where it is stored, who helps process it, and how you can ask us to access, correct, or delete it.
Last updated: October 13, 2026
GrantX is an educational and technology initiative operated by Power Deck in India. It provides grant information, learning resources and an AI grant assistant for founders.
Power Deck is responsible for the personal data processed through GrantX.
Account data: when you sign in with Google or Auth0, we receive your account identity and store the name, email address and profile image available from that provider, together with your account preferences, roles, internal user ID and service usage records.
Billing data: when paid plans are available and you choose one, we store your selected plan and payment mode, the amount and currency, payment, order, and subscription reference IDs, payment status, access end date, and related timestamps. We do not receive or store your card, UPI, bank-account, or other payment-method details.
Newsletter data: if you subscribe, we use your current account email and store consent status, source, timestamps, deactivation reasons, and delivery outcomes.
Contact data: if you send a contact form message, we store your name, email address, topic, message, status, timestamps, and, if you are signed in, your internal user ID.
Chat data: if you use the grant assistant, we store your chat threads, thread titles, user messages, assistant replies, knowledge sources used for answers, model/provider metadata, token usage, and timestamps.
Voice data: if you use voice input or live voice chat, audio may be sent to a speech-to-text provider or LiveKit. We store resulting transcripts, room/segment identifiers, provider/model metadata, and timestamps when voice transcripts are saved to chat.
Grant tool data: saved grants are stored in your account when you are signed in. For visitors who are not signed in, saved grants, view mode, and theme preference are stored in browser local storage.
Optional usage measurement data: only after you accept analytics, Google Analytics and Microsoft Clarity may collect information about visits and interactions with the site, such as pages viewed, device and browser details, and approximate location derived from IP address. Clarity may record pseudonymous session interactions to help us understand usability.
Anonymous traffic measurement: Vercel Web Analytics measures aggregate page traffic without using cookies or collecting personal identifiers such as full IP addresses.
First-party click measurement: after analytics opt-in, GrantX stores daily aggregate counts by action, item, and coarse city/country. These counts contain no full IP addresses or user IDs, and staff do not receive username rankings. Location totals are kept separately from action/item totals; small city groups are hidden. The private activity calendar and earned progress use separate account-linked activity counts independently of analytics consent.
Security and rate-limit data: we process IP address, user ID, or email-derived identifiers to protect the site from abuse. These identifiers are hashed before storage in rate-limit records.
We use personal data to provide accounts, keep your chat history organized, run usage limits, process and administer paid plans, answer grant questions, save contact messages, send requested newsletters, understand how the site is used, maintain admin operations, improve reliability, and protect the site from spam or abuse.
We do not sell personal data. We do not use your chat content for advertising within this website.
Consent: newsletters, optional contact messages, optional voice features, Google Analytics, Microsoft Clarity, and optional browser preferences.
Requested services: we process data you voluntarily provide for the specific service you request, where a permitted certain legitimate use under the DPDP Act applies; otherwise we request consent for that purpose.
Security and administration: each processing purpose must have an applicable legal ground; we do not rely on a general legitimate-interests exemption under DPDP.
Legal obligation: where we are required to preserve or disclose information under applicable law.
We use necessary authentication cookies through NextAuth so signed-in sessions work. The configured session can last up to six months.
Google Analytics and Microsoft Clarity do not load until you select Accept analytics. Your choice is stored in this browser for 12 months. You can change or withdraw it at any time through Analytics preferences in the site footer; withdrawal stops future collection and we attempt to remove analytics cookies accessible to GrantX. It does not erase information already collected by a provider.
Analytics preferences control optional Google Analytics, Microsoft Clarity, and first-party click measurement. They do not disable activity counts needed to provide your private calendar and earned progress.
We use browser local storage for theme preference, grant directory view mode, and grant bookmarks when you are not signed in. You can clear these from your browser at any time.
Embedded videos connect to YouTube only when you choose to load them. We use YouTube privacy-enhanced embeds; Google receives connection information when a video loads. Google sign-in and loaded video players may use cookies or similar technologies controlled by Google.
Google and Auth0 are used for account sign-in; email/password credentials are handled by Auth0, not stored by GrantX.
Google reCAPTCHA helps protect contact, founder-application, and scheme-submission forms from automated abuse. It loads on protected forms and may receive connection and device information. Google's Privacy Policy and Terms of Service apply.
Google Analytics is used to measure site traffic and interactions.
Microsoft Clarity is used to understand site interactions and usability.
Vercel Web Analytics is used for anonymous, cookie-free aggregate traffic measurement and remains active when you choose Necessary only.
MongoDB is used to store site data, including restricted encrypted retention records, privacy requests and cleanup jobs, users, signed-in grant bookmarks, subscribers, contact messages, chat threads, chat messages, grants, courses, videos, knowledge chunks, and rate-limit records.
OpenAI-compatible AI providers are used for chat responses and speech-to-text, depending on the configured environment variables.
LiveKit is used for live voice sessions when voice chat is enabled.
Razorpay is used to process paid-plan checkout, recurring-payment mandates, payments, refunds, and related payment notifications when paid plans are available. Razorpay receives the information needed to complete the transaction, including your account email and transaction context; its processing is governed by its own privacy policy and terms.
Resend is used to deliver opt-in internal operational notifications and GrantX newsletter messages. Visitors can subscribe with an email address without creating an account. New accounts are subscribed automatically unless that email already has subscription history; every newsletter includes an unsubscribe link. Newsletter delivery uses the subscriber's email address or, for a linked account, the User's current account email and retains operational outcomes such as acceptance, delivery, bounce, complaint, failure, skip, and unsubscribe; GrantX does not track newsletter opens or content-link clicks.
YouTube is used to embed course and homepage videos.
These providers may process data outside your country. Their processing is governed by their own terms and privacy policies as well as our configuration choices.
Rate-limit records are designed to expire automatically after their rate-limit window.
Account records, contact messages, chat threads, chat messages, and saved transcripts are kept until they are no longer needed for the purposes described here or until a valid deletion request is completed. Newsletter consent history is retained to preserve unsubscribe, bounce, and complaint status; recipient-level delivery outcomes are retained for up to twelve months.
Billing/accounting records are retained for the applicable statutory accounting and tax period, with longer retention only where required by a documented legal hold. Payment-method details are handled by Razorpay.
Deleting a chat removes the conversation and saved transcripts from active storage. You can request account deletion in Settings or through our privacy contact and confirm it by email. Your account is disabled immediately after confirmation and deletion is scheduled for seven days later. An admin may process it earlier. Contact support to request cancellation before cleanup starts. Cancelling restores access but does not restart newsletters or subscription renewals. Staff accounts require an authorised handover before closure. Records required by law may remain in restricted storage, and connected services may retain limited records under their applicable retention policies. We email you when deletion is scheduled, completed or cancelled.
Closed contact/application records and identifiable administrative audits have a proposed twelve-month retention period; newsletter consent evidence is retained while subscribed and for twelve months after withdrawal. Anonymous reporting totals expire after twenty-four months. Mandatory statutory retention and documented holds may change final deletion dates. Restricted copies are not reused for marketing or ordinary product access.
Right to access: you may request a summary of the personal data we hold about you and the processing activities involving it.
Right to correction and erasure: you may ask us to correct, complete, or update inaccurate, incomplete, misleading, or obsolete personal data, or request deletion of your account and personal data, subject to information we must retain for a specified purpose or to comply with law.
Right to grievance redressal: you may raise a complaint about how Power Deck processes your personal data or handles a request to exercise your rights.
Right to nominate: you may nominate another individual to exercise your rights in the event of your death or incapacity, in accordance with applicable law and our verification process.
Depending on where you live, including if GDPR applies to you, you may also have rights to be informed, restrict or object to processing, receive a portable copy, withdraw consent, and complain to a data protection authority.
To exercise a right, use the Contact page with the Privacy / Grievance topic and the email address associated with your account or signup. We may need to verify your identity before acting on the request.
Exercise your data rightsFor personal-data questions and requests, email Power Deck at d@powerdeck.in or use the Contact page and select Privacy / Grievance. These routes remain available without signing in and during coming-soon mode.
Power Deck aims to acknowledge grievances within 48 hours and resolve them within 30 days. Where applicable law prescribes a shorter period, we will comply with that period.
Contact Power Deck about privacyWe use access controls for admin routes, same-origin checks on write actions, rate limiting, hashed rate-limit identifiers, security headers, and database indexes to help protect personal data.
No online service can guarantee perfect security, so please avoid sending highly sensitive personal, financial, health, or identity-document details through chat or contact forms unless clearly necessary.
GrantX accounts are for adults aged 18 or older. Creating an account requires a declaration that you are 18 or older and agreement to the Terms of Service. Existing users do not repeat that declaration during normal login. Signed-out contact forms ask you to confirm that you have read the Privacy Policy; this is not an age declaration. The coming-soon launch notification form does not request an age declaration or create an account. If we discover an underage account, we stop affected processing and arrange appropriate restricted retention or erasure. Privacy requests, including guardian requests, remain accessible.
We may update this policy as the website, processors, or legal requirements change. The updated date at the top of the page shows when this policy was last revised.