Privacy policy

Grantlane is a service of BDJ Official, based in the United Kingdom. For any privacy question or request, contact bookings@bdjofficial.com.

Only what the service needs to work:

• Account details. Your email address and a password. Passwords are stored only as a salted cryptographic hash — we cannot read them, and neither can anyone who obtains a copy of the database.
• Your applicant profile. Whatever you choose to enter: profile name, applicant type, UK nation, town, local authority, what you need funding for, the amount, turnover, year established, and whether you can provide match funding. Everything except a profile name is optional.
• Optional eligibility characteristics. Some funds prioritise specific groups. If you tell us one applies to you, we use it only to show you funding you would otherwise miss. We never infer these from anything else, they never reduce your results, and you can remove them at any time.
• Your activity in the app. Opportunities you save, searches you save, applications you track, tasks and notes you write, and notifications we have sent you.
• Reports you submit about incorrect listings, so we can check them against the official source.
• Basic technical logs generated by our hosting provider — IP address, browser type, page requested, timestamp — kept briefly for security and diagnostics.

The optional eligibility characteristics can reveal information UK GDPR treats as special category data — for example health or disability, race or ethnicity, or sexual orientation. We handle these on the basis of your explicit consent (UK GDPR Article 9(2)(a)), given by choosing to tick them.

You are never required to provide them. Removing them from your profile withdraws that consent immediately and deletes the values. They are used for one purpose only: matching you to funds that state a preference for those groups.

• Contract — your account, profile, saved items and tracked applications exist so we can provide the service you asked for.
• Explicit consent — the optional eligibility characteristics above.
• Legitimate interests — keeping the service secure and working, and understanding aggregate usage. We do not profile individuals or run behavioural advertising.

bdjofficial.com records your data but will never sell, rent, licence or trade it.We do not share it with advertisers or data brokers, and we do not pass your details to funders. When you apply for funding you do that on the funder’s own website — we simply link you there, and they never learn about you from us.

The only third parties that touch your data are the suppliers who run the service on our behalf, listed below. Each is bound by a data processing agreement and may only act on our instructions.

• Supabase — database and authentication.
• Vercel — application hosting and request logs.
• PayPal — only if you choose to donate. PayPal handles the payment entirely; we never see your card or bank details, and a donation is not linked to your Grantlane account.

Some of these providers operate infrastructure outside the UK. Where data is transferred abroad it is protected by the UK International Data Transfer Addendum or equivalent safeguards.

We set one cookie: a session cookie that keeps you signed in. It is strictly necessary, so no consent banner is required. We do not use advertising cookies, tracking pixels or third-party analytics that follow you across sites. Signing out removes the cookie.

• Account and profile — until you delete your account.
• Saved items, applications, notes — until you delete them, or your account.
• Reports about listings — kept after resolution as a record of what was corrected and why, with your identity detached.
• Technical logs — retained briefly by our hosting provider, then discarded.

Deleting your account removes your profile, saved items, saved searches, applications, tasks, notes and notifications.

Under UK GDPR you can ask us to:

• give you a copy of your data, or
• correct anything wrong, or
• delete your account and data, or
• restrict or object to how we use it, or
• withdraw consent for the optional characteristics — which you can do yourself, at any time, by unticking them.

Email bookings@bdjofficial.com and we will respond within one month. There is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or call 0303 123 1113. We would rather you told us first so we can put it right.

Grantlane is intended for people aged 16 and over. Some funds are open to younger applicants — if you are under 16, please ask a parent, guardian or a supporting organisation to hold the account.

Passwords are salted and hashed. Every record is protected by database-level row security, so one account cannot read another’s data even if the application has a bug. Traffic is encrypted in transit. Administrative access is limited and cannot be granted by a user to themselves.

No system is perfect. If you find a security problem, please email bookings@bdjofficial.com rather than posting it publicly, and we will fix it as quickly as we can.

If we change anything material we will update the date at the top and, where the change affects how your data is used, tell account holders in the app before it takes effect.