Privacy Policy

Who we are

Subsidy Scanner is a UK grant and subsidy discovery platform for small businesses. We aggregate publicly available grant information from government websites and present it in a searchable, filterable format with personalised matching.

For data protection queries, contact us at michaelbucketman@gmail.com.

What data we collect

Account information

• Email address and name (when you sign up)
• Password (stored securely — we never store your password in plain text)

Business profile

• Business name, type, and sector
• Postcode (used to determine your region for grant matching)
• Number of employees and annual turnover band
• Additional sectors of interest

Usage data

• Pages you visit and searches you perform
• Alert preferences

Payment data

If you subscribe to a paid plan, payment is processed by Stripe. We store your Stripe customer ID and subscription ID but never see or store your full card details.

Why we collect it and our legal basis

Under UK GDPR, we process your data on the following bases:

• Consent— When you create an account, you consent to us processing your data to provide the service. You can withdraw consent at any time by deleting your account.
• Contract performance— We need your business profile to deliver personalised grant matching, which is the core service you signed up for.
• Legitimate interest— We use anonymised usage data to improve the platform, fix bugs, and understand which features are most useful. This does not override your privacy rights.

Third parties we share data with

We share data only with services needed to operate the platform:

• Stripe(payments) — Receives your email and payment details to process subscriptions. Stripe Privacy Policy
• Resend(email) — Receives your email address to deliver alert notifications and account emails. Resend Privacy Policy
• postcodes.io(location lookup) — Receives your postcode to determine your region. This is a free, open-source UK government API. No account data is sent.
• Vercel(hosting) — Our website is hosted on Vercel's infrastructure. Server logs may include IP addresses. Vercel Privacy Policy

We do not sell your data to anyone. We do not use your data for advertising.

Cookies

We use a small number of cookies:

• Essential cookies— Session cookies to keep you signed in and to protect form submissions. These are required for the site to function.
• Consent cookie— Records whether you have accepted our cookie notice. Expires after 1 year.
• Grant view cookie— Tracks how many grant detail pages you have viewed as an anonymous visitor. Used to prompt sign-up after a few views. Expires after 24 hours.

We do not use analytics cookies, advertising cookies, or third-party tracking cookies. If this changes in the future, we will update this policy and ask for your consent.

Data retention

• Account data— Kept for as long as your account is active. When you request deletion, we remove your personal data within 30 days.
• Grant data— Grant information is sourced from publicly available government websites and is kept indefinitely as a public-interest record.

Your rights under UK GDPR

You have the right to:

• Access— Request a copy of the personal data we hold about you.
• Rectification— Ask us to correct inaccurate data. You can also update your profile directly from your dashboard.
• Erasure— Ask us to delete your account and personal data.
• Portability— Request your data in a machine-readable format.
• Object— Object to processing based on legitimate interest.
• Withdraw consent— Unsubscribe from emails at any time using the link in every email, or by updating your alert preferences.

To exercise any of these rights, email michaelbucketman@gmail.com. We will respond within 30 days.

If you are not satisfied with our response, you can complain to the Information Commissioner's Office (ICO).

Data security

We protect your data with HTTPS encryption in transit, secure password hashing, and access controls. Our database is hosted on infrastructure with encryption at rest.

International transfers

Some of our service providers (Stripe, Resend, Vercel) may process data outside the UK. Where this happens, transfers are protected by Standard Contractual Clauses or equivalent safeguards approved by the ICO.

Children

Subsidy Scanner is a business service. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this privacy policy from time to time. If we make significant changes, we will notify registered users by email. The “last updated” date at the top of this page will always reflect the most recent version.