Privacy Policy

• Account email and password (handled by our authentication provider).
• Email addresses submitted to free tools and lead-capture forms.
• Documents you upload for scoring, mock review, or compliance checks.
• Payment information processed by Stripe. We never store full card numbers.
• Basic usage data — pages viewed, features used, error logs.

Text you submit is processed by our AI gateway provider (Lovable) and its upstream model providers — Google Gemini for analyses, OpenAI for dossier generation and Winner Intelligence embeddings — under those providers' API terms. We do not use your content to train models, and we do not permit its use to train the providers' models to the extent their API terms govern this.

We are being deliberately precise here: we consume the Lovable AI gateway rather than holding our own negotiated agreement with Google or OpenAI, so we do not claim a signed zero-retention contract with those model providers. What we can state is our own conduct — we never train on your content, never sell it, and never share it with other users — and the provider terms we operate under, listed in the sub-processor table below.

The Submission Readiness Check sends nothing to any AI model; it is a PDF parser and a rules table.

For Submission Match, Aims Page Grader, Aims Score, Resubmission Lab, and NOFO Rubrics, your file is parsed entirely in your browser. We never receive the original PDF or Word document, so there is no file to retain. The one exception is the Submission Readiness Check, which uploads the PDF to a server function, holds it in memory to measure page count, margins, and font size, then discards it. We operate no file storage bucket.

The extracted text is a different matter, and we want to be exact about it: to show you a result you can return to, we store the analysis we produce — and for Submission Match, that record includes the intake narrative you typed or pre-filled. So it is not true that we never keep your text. What is true is that we delete it on a clock.

Analysis results are auto-deleted 30 days after they are created, unless you save them to your Document Vault. A daily job performs the deletion; saved items are kept until you delete them. You can also delete anything at any time, saved or not, from Account → Delete my data. That request runs immediately and issues a time-stamped receipt with a verifiable code and an item-by-item count; if any item cannot be removed inline, the receipt names the next scheduled purge run (daily, 03:20 UTC) rather than claiming completion. Lead-capture emails are removed by the same flow. The per-feature table below states exactly what is stored and for how long.

These are every third party that touches your data, and what each one does with it. We share your data with no one else, and we do not sell or rent it.

• LovableHosting + AI gateway

  Runs the application and routes model requests. Text you submit for analysis passes through the Lovable AI gateway on its way to a model provider.

• GoogleGemini models

  Runs most analyses — Submission Match, Mock Study Section, Aims scoring, Resubmission Lab, and NOFO rubric extraction.

• OpenAIDossier generation + embeddings

  Generates the Drug Development Dossier / Target Intelligence Report, and computes the vector embeddings behind Winner Intelligence award search.

• SupabaseDatabase + authentication

  Stores your account, your analysis results, and your saved Vault items. Encryption at rest is provided by this managed backend.

• StripePayments

  Processes card payments. Card numbers go to Stripe directly and are never stored by us.

We also use an email delivery provider (Resend) to send order and product email.