Privacy policy

Data controller

The data controller is POLYGRANTS LTD, a private limited company registered in England and Wales under company number 16951447, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX. Contact: privacy@polygrants.com.

Data we collect

Depending on how you use the service, we process:

• identity and contact data: name, preferred name, email address, profile photo;
• application data: the information you enter in your dossier (personal, academic, financial and related information) and the documents you upload;
• communications: messages you exchange with our advisors;
• preferences: language and display settings;
• technical data: connection and security logs, approximate IP-derived information, anti-abuse signals (including Cloudflare Turnstile).

Purposes and legal bases

We process your data to:

• provide the service, manage your account and transmit your applications (performance of a contract);
• answer your questions through the advisor messaging (performance of a contract);
• secure the service, prevent fraud and abuse (legitimate interests);
• comply with legal obligations (legal obligation);
• send service communications such as confirmation and security emails (performance of a contract or legitimate interests).

Sharing

Your application file is shared with partner institutions and organisations only when you submit it for that purpose. We also rely on processors acting on our instructions, including Supabase (database, authentication, storage), Cloudflare (security, Turnstile) and our email delivery provider. We do not sell your personal data.

International transfers

Your data is stored in the United Kingdom and the European Economic Area. Where a transfer outside these areas is necessary, we use safeguards recognised by the UK GDPR and the EU GDPR, such as adequacy decisions or standard contractual clauses.

Retention

We keep your data for as long as your account is active. After account deletion, data is erased within 30 days, and residual copies are purged from backups within 90 days, except where a longer retention is required by law.

Your rights

You have the right of access, rectification, erasure, portability, restriction of processing, objection, and the right to withdraw consent where processing is based on consent. See the Access to your data page for how to exercise them.

You may lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom or with the supervisory authority of your country of residence (for example the CNIL in France).

Security

We apply technical and organisational measures appropriate to the sensitivity of application data: encryption in transit, access controls with row-level security, captcha protection on sensitive actions, and audit of privileged access.

Children

The service is not directed at children under 16. We do not knowingly collect data from children under 16 without appropriate consent.

Changes

We will notify you in the application or by email of any material change to this policy before it takes effect.