Legal / trust
Privacy notice
Version 1.1 · Last updated: 10 August 2026. This notice describes the current validation-list website. It is not legal advice.
Controller and contact
GrantSignal is the service name used on this website. Contact the operator at team@grantsignal.madethis.app. The operator must publish its legal entity name and registered address before commercial launch. No data-protection officer or registration number is represented here.
Personal data currently processed
For a validation-list registration, the code processes your name, email address and password-derived authentication credential. It also processes account/session identifiers and technical data needed to operate, secure and troubleshoot the site. If optional analytics is configured and you affirmatively allow it, PostHog may receive usage events. The code does not request date of birth, payment details, contacts, precise location, user-uploaded content or special-category data.
Purposes and lawful-basis confirmation
Current purposes are to create and secure a registration, provide sign-in, respond to support and data-rights requests, and understand aggregate site use only where optional analytics is allowed. The intended lawful-basis mapping requires operator confirmation before launch: account operation may rely on steps at your request or contract performance; security and limited service improvement may rely on legitimate interests; optional analytics should rely on consent where required. Do not treat this placeholder mapping as final legal advice.
Current platform services and future stack
| Service | Current role | Status |
|---|---|---|
| Convex / MadeThis deployment environment | Validation-stage authentication, application data and hosting integration. | Current platform-hosted dependency; not the intended independent production stack. |
| PostHog | Optional analytics only when configured and affirmatively allowed. | Optional; leave env values blank to disable. |
| Future independent providers | Planned database, email, hosting and operational services after the validation gate. | Not selected or active in this codebase. |
The operator must verify actual processor terms, hosting locations, transfer mechanisms and subprocessor lists before a commercial launch. This notice does not invent countries or safeguards.
Sharing, advertising and international transfers
The current code has no advertising pixels, sale of personal data or behavioural advertising function. It does not add a third-party email SDK. Platform and analytics services may process information where they operate; the operator must verify whether any international transfer applies and document the applicable safeguards before launch.
Retention
The self-service deletion flow removes the active registration and authentication records. The operator should maintain a deletion-request record only for as long as needed to verify, respond and evidence the request, and should confirm the final period before launch. Consent preferences remain in your browser until changed or cleared. Limited security, fraud-prevention, dispute or legal-obligation records may need to be retained separately; the validation site does not promise immediate erasure of every trace.
Your rights and incidents
You can request access, correction or deletion through account deletion and data rights, or email the support address. We may ask for proportionate identity information before acting. If you believe there is a privacy or security issue, contact us first with enough detail to investigate. The operator must establish its final incident-response process and regulator contact details before commercial launch.