Privacy Policy

1. Who We Are

The Grant Map is operated by StanHattie LLC, a limited liability company based in Waukee, Iowa, in the Des Moines metro. We build free tools that help homeowners research grant programs, rebates, forgivable loans, and other possible assistance.

Questions about this policy? Email support@thegrantmap.com.

2. What Data We Collect

Information you give us directly

• Email address, when you request eligibility-screening results by email, sign up for grant alerts, or submit a contact form
• Home address, when you use our grant lookup tool, so we can screen possibly relevant directory records by location and jurisdiction; only the administrator decides program eligibility
• Form submissions, any other information you voluntarily enter into our forms (e.g., project type, income range, homeowner status)
• Eligibility-quiz answers, categorical answers are processed to screen possible program matches. The quiz itself does not ask for your name or email, and results remain visible on the page. After results, if you enter your email and choose the combined results-and-alert action, we use it to queue one message with up to five possible matches and save your interest in possible city alerts. Result-email delivery and city alerts are not guaranteed. We do not route this signup to contractors.
• Match requests, when you ask to be matched with a contractor we collect your name, email, address, and project description. See "Contractor matching and leads" below for exactly who that is shared with.
• Homeowner account and workspace records, if you sign in we store your account, database-backed sessions, passkey credentials, associated submissions, saved programs or contractors, and application-organizer states
• Data API evaluation, license, and correction records, if you ask to evaluate or license the program API, we may collect your name, work email, organization, proposed use, approved geography, key identifier, usage and error counts, billing and entitlement records, and correction evidence. Do not include applicant files or sensitive personal information in a data correction. The program API does not accept or return homeowner profiles, applicant records, or contractor-lead contact details.
• Testimonials and reviews, if you accept one of our one-time invitation links, we collect the story text you write, the name you want shown, and (for contractor reviews) a star rating, linked to your original request or job. These are collected only through invitations; there is no open submission form.

Information collected automatically

• Google Analytics data, pages visited, time on site, general location (city/region level), device type, browser. GA4 runs in Google Consent Mode: until you click Accept on our cookie banner it sends only cookieless, non-identifying pings, and analytics cookies are set only after you accept.
• Browser storage, your cookie-consent choice, optional Journey tracker, and categorical grant-matching answers can live in your browser's localStorage. The separate Farm & Rural profile may store applicant type, state or county, project categories, operation stage, a rural-location answer, utility, and optional yes/no confirmations about reviewed USDA/SBA definitions on your device; it does not ask for raw farm revenue, exact net worth, acreage, a street address, farm number, tax ID, account data, or documents. Matching profiles expire after 30 days, are shown before reuse, and can be edited or cleared from their matching forms. Matching answers are sent to us only when you request matches or submit a form; clearing site data also removes the browser copy.
• Authentication and security records, if a homeowner, contractor, partner, or staff member signs in, a secure cookie plus a server-side session keeps that person signed in for up to 30 days or until logout. We also store magic-link hashes, passkey challenges and public-key credentials, and related security/audit timestamps
• Dataset API credentials, API authentication keeps a one-way hash rather than the raw key. For paid-key delivery and recovery, a separately encrypted copy is retained while delivery is pending or ambiguous and deleted after a signed provider delivery event confirms delivery. If delivery remains ambiguous, retry handling can extend that retention, so we make no fixed deletion-time promise. An authorized operator can revoke and rotate the key, but cannot retrieve plaintext after the encrypted copy is deleted.
• Email delivery and first-party interaction records, provider delivery, delay, bounce, complaint, open, or click events when available, plus first-party signed-link or call-to-action events. Security and attribution records can include a timestamp, a hashed IP address, and a bounded user-agent value; token-bearing sensitive pages do not load analytics

3. How We Use Your Data

We use the information we collect to:

• Screen your address and situation for possibly relevant programs; only each program administrator decides eligibility
• Send a requested eligibility-screening results email with up to five possible matches and use the same address for a city alert when a deliberately run check reports a new program, opening or closure, deadline or funding-status change, or correction to a stored amount. Result-email delivery is not guaranteed. A saved alert interest does not promise that a check will run or that an alert will be detected or delivered
• Store and review a requested project screening. Automated project confirmations, application follow-ups, and related story invitations are currently disabled while they are rebuilt on the shared evidence, suppression, cadence, and delivery-safety controls; submitting a project does not promise an email response
• Make program recommendations based on your project type, income, and location
• Screen the separate Farm & Rural profile against its own vocabulary, rules, and program records. We do not silently combine that profile with the Home matching profile or the licensed Home program dataset
• Operate bounded data API evaluations and licenses, authenticate and meter keys, investigate errors, process correction evidence, and enforce scope, expiry, revocation, and usage limits
• Improve the site (via analytics, what pages are useful, where people get stuck)
• Respond to support requests and data correction submissions

We do not use your data for targeted advertising. We use it only to operate the services you request, maintain the site, prevent abuse, and meet legal or security obligations.

Contractor matching and leads

If contractor sharing remains checked and the request passes our routing checks, we may send the same contact-free offer to every contractor listed in the directory whose service area and trade fit the project and for whom we have a usable business email, whether the listing is claimed or unclaimed; routing, delivery, and contractor contact are not guaranteed. Every offer, including one that can use a free credit, excludes your name, email, property address, and free-text project description. Exactly one eligible contractor may unlock those details, and our database enforces that limit. The contractor must claim the listing, satisfy the account requirements, sign in, explicitly accept that exact lead, and be the first whose acceptance finalizes into a current accepted entitlement. A zero-dollar free-credit acceptance still requires that signed-in action and can unlock only if it finalizes first. A paid offer unlocks only if its exact displayed charge finalizes first. Once the first acceptance finalizes, the lead closes permanently to every other contractor. Contractors whose offers do not win are not charged, do not consume a free credit, and do not receive your contact details through The Grant Map. Receiving an offer, claiming, possession proof, or automatically activating a listing never creates that entitlement, implies a quality endorsement, or unlocks homeowner details. Contractors pay us only for paid leads they win and accept; that fee never comes from you and does not change what you see. Paid leads that pass the sellability checks range from $20 to $500. The exact one-time price is shown before acceptance and reflects the job, its scope, the local market, and lead quality. A lead with insufficient core information is not sold at a lower price. Section 14 describes this request-specific sharing and compensated introduction.

Testimonials and reviews

If you submit a story or review through an invitation link and check the publication consent box, we review it and may publish it on the site showing only your first name, last initial, and city. Your email address is never published. You can withdraw a published story at any time by emailing support@thegrantmap.com. Reviews of specific contractors are collected the same way and are not displayed publicly at this time.

4. Third-Party Services

We use a small number of trusted third-party services to operate the site:

• Google Analytics, website usage measurement under the consent behavior described below. Google processes the resulting data under its own terms. See Google's Privacy Policy.
• Resend, email delivery service used to send grant alerts and transactional emails. See Resend's Privacy Policy.
• US Census Geocoder, we send the address you submit to the US Census Bureau's geocoding API to obtain geographic coordinates for program screening.
• Google Maps Platform, address autocomplete and a separate fallback geocoder. As you type, the partial address is sent through our server to Google's Places API to return suggestions only. If the primary resolver cannot place a full Home address after submission, the separate Google Geocoding fallback may receive that full free-form address to resolve its city and state. These flows are not used for advertising. See Google's Privacy Policy.

Subprocessor and integration data boundaries

The following current or conditionally enabled service providers may process limited data on our behalf to run the site. A provider receives data only when the relevant integration is configured and invoked under the boundary stated below; naming an optional provider does not mean it is active. Each provider is subject to its own privacy and security terms. EmailKit and LLMKit are software components in our application, not separate external processors.

• Railway, application and PostgreSQL database hosting. It hosts the account, form, contractor, lead, API-license, support-workflow, security, and operational records described in this policy.
• Cloudflare, DNS, CDN, request routing, and bot protection through Turnstile. It can process normal network and request metadata needed to deliver and protect the site.
• Stripe, payment processing for contractor per-lead charges, dataset/API licenses, and sponsorships. A contractor does not provide a card to claim a listing. The first accepted compatible lead can use a free credit; for a later paid lead, Stripe collects a card, finalizes the displayed charge before contact unlock, and may save it for later one-time charges. Stripe receives billing details of paying contractors, licensees, and advertisers, never homeowners.
• Resend, transactional and alert email delivery. It processes the recipient, message content, delivery metadata, and provider events needed for an authorized email. It does not decide eligibility or lead entitlement.
• Migadu, email hosting for our staff mailboxes. Support messages are received there, and only mail to an allowlisted public support address can enter the governed support-research workflow. Other shared-mailbox messages are not parsed by that workflow.
• Backblaze B2, object storage for decoded and re-encoded public contractor photos. Private insurance documents are accepted only when a separately confirmed private bucket and scope are operational; otherwise the upload fails closed rather than placing a private document in public storage. B2 is not an approved paid dataset-file delivery channel, and no bulk dataset or snapshot is currently offered from it.
• Google Analytics and Microsoft Clarity, usage analytics. Clarity (session replay and heatmaps) does not load at all unless you accept analytics cookies. Google Analytics runs in Consent Mode: cookieless, non-identifying pings until you accept, cookies only after.
• Twilio Lookup and Twilio messaging, the retired Twilio Verify claim-code path is disabled. Listing possession proof is email-only, and we do not send a listing-claim code by text. Twilio Lookup receives a submitted contractor business phone for deterministic line-type screening; we cache the returned line type and carrier, and do not use Lookup for homeowner eligibility or marketing. The separate authenticated messaging integration can process supported STOP, START, and HELP replies to the legacy public SMS line and a founder-only receipt after a positive paid-lead settlement; it does not send homeowner or contractor project offers. No mobile information is shared with third parties or affiliates for marketing or promotional purposes; SMS command and suppression data are shared only with the providers needed to process the message. For help or to record an account-level opt-out, email support@thegrantmap.com. Full legacy SMS details: thegrantmap.com/sms-opt-in.
• Apollo.io, business-contact and public-records data used to build and verify our contractor directory. Apollo provides information about businesses (contractors), not homeowners. See the "Contractor Directory" section below for how public-records listings work.
• Anthropic, AI provider (Claude API). Limited, redacted content may be processed for internal drafting or public program-data work. Homeowner and support calls are pinned to Anthropic and do not fail over to another AI provider. The governed inbound-support workflow does not ask a model to free-write factual program answers: it reduces the request locally, researches bounded official sources, stores claim-level evidence, and renders factual reply text deterministically. Missing or conflicting evidence is held for human review and never becomes a generic fallback email. External research requests exclude the raw message, headers, name, email, phone, street address, financial or disability details, and free-text repair description. No automatic acknowledgement receipt is sent, and a response and its timing are not guaranteed. Only mail addressed to an allowlisted public support surface enters this workflow; other mail in the shared staff inbox is not parsed by it. An inbound request for contractor contact remains human-review-only and cannot itself trigger project sharing. We may also use Anthropic to compile and re-check public program data under its then-current commercial data terms. See Anthropic's Privacy Policy.
• OpenAI, an optional AI provider that, if configured, can be used only for workflows without homeowner or support-message personal data, such as public-data processing. It was not configured in the observed production web or recognized worker services on July 26, 2026. Homeowner and support prompts do not fail over to OpenAI. See OpenAI's Privacy Policy.
• SerpAPI, an optional public-web search provider. The production web finder was disabled on 2026-07-26. If it is enabled after review, SerpAPI receives city, state, and a query derived from an allowlisted repair taxonomy, not the raw support message or headers, name, email, phone, street address, ZIP code, financial or disability details, or free-text repair description.
• US Census Geocoder, address geocoding for Home program screening. It receives the submitted Home address needed to return geographic coordinates. It does not receive the separate Farm & Rural profile.
• Google Maps Platform, address autocomplete and a separate fallback geocoder. Places receives a partial address through our server and returns suggestions only. If the primary resolver cannot place a full submitted Home address, the fallback geocoder may receive that full free-form address to resolve city and state. These flows are not used for advertising.
• Google Fonts and unpkg, browser asset delivery for fonts and selected public-page icon scripts. A browser request to those providers can expose normal network metadata such as IP address, user agent, and referrer. Our application does not include form answers or account records in those asset requests.
• CJ Affiliate (Commission Junction), affiliate-link routing and commission attribution. If you choose a clearly labeled affiliate deal, the outbound click passes through CJ before the retailer. CJ and the retailer may receive normal web-request data such as IP address, browser or device identifiers, referral data, and their own cookie or attribution information under their policies. We do not send your Grant Map form answers or homeowner contact details with that click. See CJ's Privacy Policy.

5. We Do Not Sell Data Lists or Use Behavioral Advertising

We do not sell or rent personal-information lists, disclose personal information for a third party's independent marketing, or use it for cross-context behavioral advertising. The only compensated disclosure of homeowner contact information is the contractor-introduction service included with the checked contractor-sharing option for that submission. Directory-listed contractors with a usable business email whose area and trade match may receive a contact-free offer, whether or not they have claimed their listings. Exactly one eligible contractor may unlock your actual contact details, and our database enforces that limit. The first contractor whose free-credit acceptance or displayed paid acceptance finalizes receives them, and the lead closes to everyone else. No other contractor is charged, uses a free credit, or receives the details through The Grant Map. Uncheck the option before submitting for program information only, with no contractor offers created for that submission, or send a privacy request if you do not want that introduction.

6. Cookies

We use two types of cookies:

• Analytics cookies, set only after you click Accept on our cookie banner. Decline and no analytics cookies are set (Google Analytics then runs cookieless in Consent Mode, and Microsoft Clarity does not run at all). You can also opt out of GA entirely with the Google Analytics Opt-out Browser Add-on.
• Authentication cookies, if you sign in, a secure login cookie keeps you signed in for up to 30 days or until you log out.

We do not use advertising cookies or ad-targeting pixels. Microsoft Clarity (session recordings and heatmaps) loads only after you accept analytics cookies. Google Analytics starts in Consent Mode with analytics storage denied; before acceptance it may send cookieless measurement pings, and after acceptance it may use analytics cookies.

7. Affiliate Links

Some retail-deal links on The Grant Map are active affiliate placements. Each is labeled as an affiliate advertisement before the outbound link and states that we may earn a commission if you buy, at no extra cost from The Grant Map. Other links or quote-request modules may also be affiliate or referral placements only when similarly labeled.

Third-party sites have their own privacy policies and data practices. We have no control over what happens on their sites. See our Affiliate Disclosure for full details.

8. Contractor Directory

Our contractor directory lists local businesses for home-repair and improvement projects. Contractors submit business information voluntarily when they create a free listing (they pay only for homeowner leads they accept after any free credit). Public directory fields are limited to the business name, city or service area, trade, profile information the contractor supplies for display, and limited on-file or review-status signals. We do not publish a contractor's email, phone number, raw license number, insurance document, or private billing details through the public directory API.

A new registration that proves email possession, completes the required profile fields, and passes the deterministic duplicate, abuse, disposable-domain, and service-area checks activates automatically. An existing public-record listing activates automatically after email-link possession proof sent to its usable public business email on file, required profile completion, and clean deterministic duplicate and contact-revalidation checks. A listing without a usable public business email is not claimable today; there is no SMS-code or manual possession-proof path. A record that does not pass stays pending with reasons shown to the contractor. Automatic activation is an account state, not an endorsement, badge, license or insurance verification, or accepted lead entitlement, and it never unlocks homeowner contact information.

License numbers are private account fields. Insurance documents are accepted only when confirmed private storage is operational; otherwise the upload is rejected. An on-file indicator is not proof of current licensing or coverage; homeowners must verify both with the state board, insurer, and contractor before hiring.

Unclaimed listings sourced from public records

To give homeowners useful coverage while the directory grows, some listings are "unclaimed", meaning we created them from publicly available business records rather than from the contractor signing up. Our public-record sources include business directories and contact data provided through Apollo.io, state contractor-licensing records published by government agencies, and business listings contributed to OpenStreetMap (© OpenStreetMap contributors). Public unclaimed cards are minimized to business-level directory information such as the business name, general location, and trade. Source records used to build or verify a listing may also contain a business contact method or license record, but the public directory API does not return the raw phone, email, or license number.

We may use a public business email from those records for limited business-to-business email about the public listing, a current contact-free project opportunity, or a clearly labeled sponsorship inquiry. A matching claimed or unclaimed listing may receive a project-triggered contact-free offer after the homeowner's request-specific sharing choice. A separate sponsorship inquiry is suppressed when the same address already received contractor outreach. The project offer contains only bounded structured context such as city, repair category or trade, and possible program names. It never contains the homeowner's name, contact information, property address, or free-text description; it carries an unsubscribe route and is subject to global suppression, deduplication, delivery measurement, and the one-buyer entitlement boundary. We do not use public-record contacts for homeowner marketing.

Unclaimed listings are clearly labeled as sourced from public records and not yet verified, and they do not carry our "Grant-Approved" badge. Except for the limited contact-free context described above, we do not disclose project information to an unclaimed listing. An unclaimed listing never receives the homeowner's name, contact information, property address, or free-text project description, and claiming never unlocks them. When a usable public business email is on file, a contractor can claim through the listing's claim page. A contractor can email support@thegrantmap.com to correct or remove an unclaimed listing; support email is not a manual possession-proof route.

If you are a contractor and want to update or remove your listing, email support@thegrantmap.com.

9. Embeddable Widget

We offer an embeddable lookup widget that other websites can install. The sandboxed widget loads the public city list and opens the city page a visitor selects. It does not ask for or collect a name, email, street address, project description, or eligibility answers.

10. Data Retention

• Form submissions, stored on our server until you request deletion
• Email subscriptions and suppressions, maintained as needed to deliver requested messages and honor opt-outs. Unsubscribing stops all nonessential Grant Map email, not only the stream named in the link. User-requested sign-in, security, claim, purchase, and account-delivery messages may still be sent. An unsubscribe does not itself delete an account, submission, billing record, or other record containing the same address; request deletion separately if desired
• Analytics data, retained according to our provider configuration and the provider's current retention terms; aggregated reports may remain after user-level event data expires
• Authentication cookies, expire after 30 days or on logout
• Testimonials and reviews, kept while published; removed on request to support@thegrantmap.com
• Contractor profile and credential records, kept while the listing or account is maintained and as needed for billing, fraud prevention, dispute handling, or legal records; raw credential documents are not public directory fields
• Homeowner accounts, sessions, saves, and organizer records, kept while the account is maintained or until deletion is requested, subject to security, fraud, dispute, and legal retention. Sessions and authentication capabilities expire on their own schedules
• Support messages and human-review drafts, kept while needed to review, answer, secure, or document the request and then for reasonable operational retention, subject to deletion requests and any legal, security, fraud, or dispute retention that still applies
• Email delivery and interaction events, retained as needed for deliverability, suppression, security, attribution, dispute handling, and operational reporting
• Internal project-email threading copies, retained in a restricted staff mailbox as needed to preserve reply context and troubleshoot delivery, subject to privacy deletion requests and any legal, security, fraud, or dispute retention that still applies
• Dataset evaluation and license records, including buyer name, work email, organization, approved scope, key identifier, usage, errors, billing, entitlement, expiry, revocation, and correction evidence, kept as needed for the evaluation or license plus applicable financial, security, fraud, dispute, and legal retention. Raw API keys are not stored in ordinary records

11. Your Rights

You can request at any time:

• A copy of the personal data we have about you
• Correction of inaccurate data
• Deletion of your data
• To unsubscribe from nonessential emails (use the unsubscribe link in a marketing or follow-up email, or email us). Requested sign-in, security, claim, purchase, and account-delivery messages may still be sent

To make any of these requests, email support@thegrantmap.com with the subject line "Privacy Request." We may request information reasonably needed to verify the requester and will respond within the period required by applicable law, including notice of any permitted extension.

12. Children's Privacy (COPPA)

The Grant Map is not directed at children under the age of 13 and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has submitted information to us, please contact us and we will delete it promptly.

13. California Residents, CCPA Disclosure

To the extent the California Consumer Privacy Act (CCPA) applies, California residents may have the following rights:

• The right to know what personal information we collect, use, disclose, or sell
• The right to request deletion of your personal information
• The right to request correction of inaccurate personal information
• The right to opt out of sale or sharing as those terms are defined by applicable law; contractor introductions occur only after the request-specific direction described in Sections 3, 5, and 14
• The right to limit certain uses and disclosures of sensitive personal information, where applicable
• The right not to be discriminated against for exercising these rights

To exercise these rights, email support@thegrantmap.com with the subject "Privacy Request, California." We may verify the request. Where the CCPA applies, the ordinary response period is 45 calendar days, with a permitted extension after notice. See the California Attorney General's CCPA information.

14. How We Share Your Information With Contractors

When you submit a request with the contractor-sharing option left checked, we may send the same contact-free offer to every directory-listed contractor whose service area and trade match and for whom we have a usable business email, whether the listing is claimed or unclaimed; routing, delivery, and contact are not guaranteed. The form starts checked and you can uncheck it before submitting for program information only, with no contractor offer created from that submission. The offer may contain bounded structured context such as city, repair category or trade, and possible program names, but never your name, email, property address, or free-text project description. Receiving the offer, claiming, or automatic activation does not unlock contact. Exactly one eligible contractor may unlock it. That contractor must claim the listing, satisfy the account requirements, sign in, explicitly accept by POST, and be the first to finalize the current accepted entitlement for that exact offer; this applies to both free-credit and paid offers. A free-credit offer becomes a zero-dollar entitlement only through that signed-in acceptance and only when it finalizes first. A paid offer unlocks only when its exact displayed payment finalizes first. Once one contractor unlocks contact, the lead closes permanently to every other contractor. A contractor who does not win is not charged, does not consume a free credit, and does not receive your contact through The Grant Map. A revoked, refunded, disputed, expired, or otherwise invalid entitlement does not authorize new contact access. We do not independently guarantee a contractor's license, insurance, work quality, or program experience. Contractors pay only for paid leads they win and accept; the fee never comes from you or changes the programs you see. This is the only compensated disclosure of homeowner contact information and follows the request-specific checked state described above.

You can opt out at any time:

• Uncheck contractor sharing on the intake form before submitting, and we will not create contractor offers for that submission.
• Reply to a project email or email support@thegrantmap.com, and we will stop future contractor sharing and remove any not-yet-accepted routing hooks we can identify.

Each submission carries its own sharing choice; a later form does not silently grant or revoke consent for an earlier lead. A support request can stop open, not-yet-accepted offers we can identify, but it cannot recall details a contractor already received after acceptance. That contractor may retain information under its own legal obligations and privacy practices; contact it directly about data it already holds.

We do NOT share your household income information with contractors. We currently share your contact details for email outreach only; we do not give contractors your phone number for calls or texts.

15. Iowa Residents, Iowa CDPA Disclosure

To the extent the Iowa Consumer Data Protection Act (Iowa CDPA) applies, an authenticated Iowa consumer may ask whether we process the consumer's personal data and access it, delete personal data the consumer provided, obtain a portable copy of data the consumer provided where technically practicable, and opt out of a sale as defined by that law. The statute does not create a correction or targeted-advertising opt-out right; we nevertheless accept correction requests under Section 11 and do not use cross-context behavioral advertising.

To exercise Iowa CDPA rights, email support@thegrantmap.com with the subject "Privacy Request, Iowa." We may authenticate the request. Where the law applies, the response period is up to 90 days, with one permitted 45-day extension after notice. To appeal a refusal, use the subject "Privacy Appeal, Iowa"; the statutory appeal response period is 60 days. See Iowa Code chapter 715D.

16. Security

We take reasonable technical measures to protect your data, including HTTPS encryption on all pages. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the site after changes are posted means you accept the updated policy.

18. Contact

StanHattie LLC
731 SE Alices Rd PMB 1035
Waukee, IA 50263
Email: support@thegrantmap.com