Privacy Policy

1. Who We Are

The Grant Map is operated by StanHattie LLC, a limited liability company based in Waukee, Iowa, in the Des Moines metro. We build free tools that help homeowners research grant programs, rebates, forgivable loans, and other possible assistance.

Questions about this policy? Email support@thegrantmap.com.

2. What Data We Collect

Information you give us directly

• Email address, when you sign up for grant alerts or submit a contact form
• Home address, when you use our grant lookup tool, so we can screen possibly relevant directory records by location and jurisdiction; only the administrator decides program eligibility
• Form submissions, any other information you voluntarily enter into our forms (e.g., project type, income range, homeowner status)
• Eligibility-quiz answers, categorical answers are processed to screen possible program matches. The quiz does not ask for your name or email. If you separately choose to email yourself the results, we collect that email for the program-results signup only and do not route that signup to contractors.
• Match requests, when you ask to be matched with a contractor we collect your name, email, address, and project description. See "Contractor matching and leads" below for exactly who that is shared with.
• Homeowner account and workspace records, if you sign in we store your account, database-backed sessions, passkey credentials, associated submissions, saved programs or contractors, and application-organizer states
• Testimonials and reviews, if you accept one of our one-time invitation links, we collect the story text you write, the name you want shown, and (for contractor reviews) a star rating, linked to your original request or job. These are collected only through invitations; there is no open submission form.

Information collected automatically

• Google Analytics data, pages visited, time on site, general location (city/region level), device type, browser. GA4 runs in Google Consent Mode: until you click Accept on our cookie banner it sends only cookieless, non-identifying pings, and analytics cookies are set only after you accept.
• Browser storage, your cookie-consent choice, optional Journey tracker, and categorical grant-matching answers can live in your browser's localStorage. The matching profile expires after 30 days, is shown before reuse, and can be edited or cleared from the matching form. Matching answers are sent to us only when you request matches or submit a form; clearing site data also removes the browser copy.
• Authentication and security records, if a homeowner, contractor, partner, or staff member signs in, a secure cookie plus a server-side session keeps that person signed in for up to 30 days or until logout. We also store magic-link hashes, passkey challenges and public-key credentials, and related security/audit timestamps
• Dataset API credentials, API authentication keeps a one-way hash rather than the raw key. For paid-key delivery and recovery, a separately encrypted copy is retained only while delivery is pending or ambiguous, deleted when delivery is accepted, and deleted after at most 30 days if delivery remains ambiguous. An authorized operator can then revoke and rotate the key, but cannot retrieve the expired plaintext.
• Email delivery and first-party interaction records, provider delivery, delay, bounce, complaint, open, or click events when available, plus first-party signed-link or call-to-action events. Security and attribution records can include a timestamp, a hashed IP address, and a bounded user-agent value; token-bearing sensitive pages do not load analytics

3. How We Use Your Data

We use the information we collect to:

• Screen your address and situation for possibly relevant programs; only each program administrator decides eligibility
• Send city-alert subscribers email when scheduled checks detect a new program, opening or closure, deadline or funding-status change, or correction to a stored amount. Detection and delivery are not guaranteed
• Send a requested project-screening confirmation and up to three practical application follow-ups over 14 days; if you explicitly tell us you applied, we may send one story invitation around day 30. Nonessential follow-ups include an unsubscribe link
• Make program recommendations based on your project type, income, and location
• Improve the site (via analytics, what pages are useful, where people get stuck)
• Respond to support requests and data correction submissions

We do not use your data for targeted advertising. We use it only to operate the services you request, maintain the site, prevent abuse, and meet legal or security obligations.

Contractor matching and leads

If contractor sharing remains checked and the request passes our routing checks, we may send contact-free offers to claimed, active contractors whose service area and trade fit the project; routing and contractor contact are not guaranteed. Every offer, including a contractor's free-credit offer, excludes your name, email, property address, and free-text project description until that contractor signs in and explicitly accepts. If the request does not reach a compatible active listing, we may send each compatible unclaimed public-record business a one-time contact-free claim notice containing only the city, repair category or trade, and possible program names. It never contains your name, email, property address, or free-text description, and claiming does not unlock those details. A paid offer unlocks only after its charge is finalized. No more than three contractors receive contact details for a shared request. Contractors pay us only for paid leads they accept; that fee never comes from you and does not change what you see. Section 14 describes this request-specific sharing and compensated introduction.

Testimonials and reviews

If you submit a story or review through an invitation link and check the publication consent box, we review it and may publish it on the site showing only your first name, last initial, and city. Your email address is never published. You can withdraw a published story at any time by emailing support@thegrantmap.com. Reviews of specific contractors are collected the same way and are not displayed publicly at this time.

4. Third-Party Services

We use a small number of trusted third-party services to operate the site:

• Google Analytics, website usage measurement under the consent behavior described below. Google processes the resulting data under its own terms. See Google's Privacy Policy.
• Resend, email delivery service used to send grant alerts and transactional emails. See Resend's Privacy Policy.
• US Census Geocoder, we send the address you submit to the US Census Bureau's geocoding API to obtain geographic coordinates for program screening.
• Google Maps Platform, address autocomplete on the homeowner lookup form. As you type, the partial address is sent (proxied through our server) to Google's Places API to suggest matches. It is not used for advertising. See Google's Privacy Policy.

Complete subprocessor list

The following service providers ("subprocessors") may process limited data on our behalf to run the site. Each is bound by its own privacy and security terms:

• Railway, application and database hosting (our servers and PostgreSQL database run here).
• Cloudflare, DNS, CDN, and bot protection (Turnstile) in front of the site.
• Stripe, payment processing for contractor per-lead charges, dataset/API licenses, and sponsorships. A contractor does not provide a card to claim a listing. The first accepted compatible lead can use a free credit; for a later paid lead, Stripe collects a card, finalizes the displayed charge before contact unlock, and may save it for later one-time charges. Stripe receives billing details of paying contractors, licensees, and advertisers, never homeowners.
• Resend, transactional and alert email delivery.
• Migadu, email hosting for our staff mailboxes. Support messages are received there. For project-confirmation threading, a copy may also go only to a validated StanHattie or The Grant Map staff mailbox so a later follow-up can reference the delivered message correctly; it is an internal processing copy, not another contractor or outside recipient.
• Backblaze B2, object storage for decoded and re-encoded public contractor photos. Private insurance documents are accepted only when a separately confirmed private bucket and scope are operational; otherwise the upload fails closed rather than placing a private document in public storage.
• Google Analytics and Microsoft Clarity, usage analytics. Clarity (session replay and heatmaps) does not load at all unless you accept analytics cookies. Google Analytics runs in Consent Mode: cookieless, non-identifying pings until you accept, cookies only after.
• Twilio Verify, used only to send and validate one-time listing-claim codes after a contractor requests one for the on-file business phone (never to homeowners, never for marketing or project offers). Twilio selects the managed sender, generates the code, and returns the verification result. No mobile information is shared with third parties or affiliates for marketing or promotional purposes; text-message opt-in data and consent are not shared with third parties except the providers needed to deliver and validate the code. For help or to record an account-level opt-out, email support@thegrantmap.com. Full consent details: thegrantmap.com/sms-opt-in.
• Apollo.io, business-contact and public-records data used to build and verify our contractor directory. Apollo provides information about businesses (contractors), not homeowners. See the "Contractor Directory" section below for how public-records listings work.
• Anthropic, AI provider (Claude API). Limited redacted content may be processed to prepare homeowner and partner email replies. Initial homeowner confirmations are deterministic, not model-written. A routine homeowner question or a figure-free partner message may receive an automated reply grounded in the sender's on-file program records; a reply that cannot be grounded falls back to a general, figure-free answer, and sensitive messages are held for human review instead. No automatic acknowledgement receipt is sent, and a response and its timing are not guaranteed. Only mail addressed to our public support address or our contractor-contact address enters this worker; other mail in the shared staff inbox is not parsed or modeled by it. An inbound email asking for contractor contact remains human-review-only and cannot itself trigger project sharing. Inbound drafting removes detected email addresses, phone numbers, and street addresses before processing. Homeowner and support calls are pinned to Anthropic and do not fail over to another AI provider. We also use Anthropic to compile and re-check public program data. Anthropic's handling of API content is governed by its then-current commercial data terms. See Anthropic's Privacy Policy.
• OpenAI, AI provider used only for workflows that do not contain homeowner or support-message personal data, such as some public-data processing. Homeowner and support prompts do not fail over to OpenAI. See OpenAI's Privacy Policy.
• Google Maps Platform, address autocomplete and geocoding. Receives the partial address you type on the lookup form (proxied server-side) to return address suggestions and coordinates for grant matching. Not used for advertising.
• CJ Affiliate (Commission Junction), affiliate-link routing and commission attribution. If you choose a clearly labeled affiliate deal, the outbound click passes through CJ before the retailer. CJ and the retailer may receive normal web-request data such as IP address, browser or device identifiers, referral data, and their own cookie or attribution information under their policies. We do not send your Grant Map form answers or homeowner contact details with that click. See CJ's Privacy Policy.

5. We Do Not Sell Data Lists or Use Behavioral Advertising

We do not sell or rent personal-information lists, disclose personal information for a third party's independent marketing, or use it for cross-context behavioral advertising. The only compensated disclosure of homeowner contact information is the contractor-introduction service included with the checked contractor-sharing option for that submission. Contractors first receive a contact-free offer; up to three may unlock the details after explicit acceptance, and paid access unlocks only after payment finalizes. Uncheck the option before submitting or send a privacy request if you do not want that introduction.

6. Cookies

We use two types of cookies:

• Analytics cookies, set only after you click Accept on our cookie banner. Decline and no analytics cookies are set (Google Analytics then runs cookieless in Consent Mode, and Microsoft Clarity does not run at all). You can also opt out of GA entirely with the Google Analytics Opt-out Browser Add-on.
• Authentication cookies, if you sign in, a secure login cookie keeps you signed in for up to 30 days or until you log out.

We do not use advertising cookies or ad-targeting pixels. Microsoft Clarity (session recordings and heatmaps) loads only after you accept analytics cookies. Google Analytics starts in Consent Mode with analytics storage denied; before acceptance it may send cookieless measurement pings, and after acceptance it may use analytics cookies.

7. Affiliate Links

Some retail-deal links on The Grant Map are active affiliate placements. Each is labeled as an affiliate advertisement before the outbound link and states that we may earn a commission if you buy, at no extra cost from The Grant Map. Other links or quote-request modules may also be affiliate or referral placements only when similarly labeled.

Third-party sites have their own privacy policies and data practices. We have no control over what happens on their sites. See our Affiliate Disclosure for full details.

8. Contractor Directory

Our contractor directory lists local businesses for home-repair and improvement projects. Contractors submit business information voluntarily when they create a free listing (they pay only for homeowner leads they accept after any free credit). Public directory fields are limited to the business name, city or service area, trade, profile information the contractor supplies for display, and limited on-file or review-status signals. We do not publish a contractor's email, phone number, raw license number, insurance document, or private billing details through the public directory API.

License numbers are private account fields. Insurance documents are accepted only when confirmed private storage is operational; otherwise the upload is rejected. An on-file indicator is not proof of current licensing or coverage; homeowners must verify both with the state board, insurer, and contractor before hiring.

Unclaimed listings sourced from public records

To give homeowners useful coverage while the directory grows, some listings are "unclaimed", meaning we created them from publicly available business records rather than from the contractor signing up. Our public-record sources include business directories and contact data provided through Apollo.io, state contractor-licensing records published by government agencies, and business listings contributed to OpenStreetMap (© OpenStreetMap contributors). Public unclaimed cards are minimized to business-level directory information such as the business name, general location, and trade. Source records used to build or verify a listing may also contain a business contact method or license record, but the public directory API does not return the raw phone, email, or license number.

We may use a business contact method from those records for limited business-to-business email about the public listing, a current contact-free project opportunity, or a clearly labeled sponsorship inquiry. A listing may receive one generic claim notice, or one project-triggered claim notice plus at most one onboarding follow-up; those contractor sequences do not mix. A separate sponsorship inquiry is suppressed when the same address already received contractor outreach. A project-triggered notice is sent only after the homeowner's request-specific sharing choice and contains only city, repair category or trade, and possible program names. These messages never contain the homeowner's name, contact information, property address, or free-text description; they carry an unsubscribe route and are subject to global suppression, deduplication, and delivery measurement. We do not use public-record contacts for homeowner marketing.

Unclaimed listings are clearly labeled as sourced from public records and not yet verified, and they do not carry our "Grant-Approved" badge. Except for the limited contact-free context described above, we do not disclose project information to an unclaimed listing. An unclaimed listing never receives the homeowner's name, contact information, property address, or free-text project description, and claiming never unlocks them. A contractor can claim, correct, or have an unclaimed listing removed at any time by emailing support@thegrantmap.com.

If you are a contractor and want to update or remove your listing, email support@thegrantmap.com.

9. Embeddable Widget

We offer an embeddable lookup widget that other websites can install. The sandboxed widget loads the public city list and opens the city page a visitor selects. It does not ask for or collect a name, email, street address, project description, or eligibility answers.

10. Data Retention

• Form submissions, stored on our server until you request deletion
• Email subscriptions and suppressions, maintained as needed to deliver requested messages and honor opt-outs. Unsubscribing stops all nonessential Grant Map email, not only the stream named in the link. User-requested sign-in, security, claim, purchase, and account-delivery messages may still be sent. An unsubscribe does not itself delete an account, submission, billing record, or other record containing the same address; request deletion separately if desired
• Analytics data, retained according to our provider configuration and the provider's current retention terms; aggregated reports may remain after user-level event data expires
• Authentication cookies, expire after 30 days or on logout
• Testimonials and reviews, kept while published; removed on request to support@thegrantmap.com
• Contractor profile and credential records, kept while the listing or account is maintained and as needed for billing, fraud prevention, dispute handling, or legal records; raw credential documents are not public directory fields
• Homeowner accounts, sessions, saves, and organizer records, kept while the account is maintained or until deletion is requested, subject to security, fraud, dispute, and legal retention. Sessions and authentication capabilities expire on their own schedules
• Support messages and human-review drafts, kept while needed to review, answer, secure, or document the request and then for reasonable operational retention, subject to deletion requests and any legal, security, fraud, or dispute retention that still applies
• Email delivery and interaction events, retained as needed for deliverability, suppression, security, attribution, dispute handling, and operational reporting
• Internal project-email threading copies, retained in a restricted staff mailbox as needed to preserve reply context and troubleshoot delivery, subject to privacy deletion requests and any legal, security, fraud, or dispute retention that still applies
• Dataset license buyer records (name, email, organization of API licensees), kept for the life of the license plus standard financial-record retention

11. Your Rights

You can request at any time:

• A copy of the personal data we have about you
• Correction of inaccurate data
• Deletion of your data
• To unsubscribe from nonessential emails (use the unsubscribe link in a marketing or follow-up email, or email us). Requested sign-in, security, claim, purchase, and account-delivery messages may still be sent

To make any of these requests, email support@thegrantmap.com with the subject line "Privacy Request." We may request information reasonably needed to verify the requester and will respond within the period required by applicable law, including notice of any permitted extension.

12. Children's Privacy (COPPA)

The Grant Map is not directed at children under the age of 13 and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has submitted information to us, please contact us and we will delete it promptly.

13. California Residents, CCPA Disclosure

To the extent the California Consumer Privacy Act (CCPA) applies, California residents may have the following rights:

• The right to know what personal information we collect, use, disclose, or sell
• The right to request deletion of your personal information
• The right to request correction of inaccurate personal information
• The right to opt out of sale or sharing as those terms are defined by applicable law; contractor introductions occur only after the request-specific direction described in Sections 3, 5, and 14
• The right to limit certain uses and disclosures of sensitive personal information, where applicable
• The right not to be discriminated against for exercising these rights

To exercise these rights, email support@thegrantmap.com with the subject "Privacy Request, California." We may verify the request. Where the CCPA applies, the ordinary response period is 45 calendar days, with a permitted extension after notice. See the California Attorney General's CCPA information.

14. How We Share Your Information With Contractors

When you submit a request with the contractor-sharing option left checked, we may send contact-free offers to claimed, active contractors whose service area and trade match the request; routing and contact are not guaranteed. The form starts checked and you can uncheck it before submitting for program information only. If the request does not reach a compatible active listing, we may send each compatible unclaimed public-record business a one-time contact-free claim notice containing only city, repair category or trade, and possible program names. That notice never contains your name, email, property address, or free-text description, and claiming does not unlock contact. For an active-contractor offer, your name, email, property address, and free-text project description remain locked until the contractor signs in and explicitly accepts; this applies to both free-credit and paid offers. A paid offer unlocks only after payment finalizes. No more than three contractors receive contact details for a shared request. We do not independently guarantee a contractor's license, insurance, work quality, or program experience. Contractors pay only for paid leads they accept; the fee never comes from you or changes the programs you see. This is the only compensated disclosure of homeowner contact information and follows the request-specific checked state described above.

You can opt out at any time:

• Uncheck contractor sharing on the intake form before submitting, and we will not create contractor offers for that submission.
• Reply to a project email or email support@thegrantmap.com, and we will stop future contractor sharing and remove any not-yet-accepted routing hooks we can identify.

Each submission carries its own sharing choice; a later form does not silently grant or revoke consent for an earlier lead. A support request can stop open, not-yet-accepted offers we can identify, but it cannot recall details a contractor already received after acceptance. That contractor may retain information under its own legal obligations and privacy practices; contact it directly about data it already holds.

We do NOT share your household income information with contractors. We currently share your contact details for email outreach only; we do not give contractors your phone number for calls or texts.

15. Iowa Residents, Iowa CDPA Disclosure

To the extent the Iowa Consumer Data Protection Act (Iowa CDPA) applies, an authenticated Iowa consumer may ask whether we process the consumer's personal data and access it, delete personal data the consumer provided, obtain a portable copy of data the consumer provided where technically practicable, and opt out of a sale as defined by that law. The statute does not create a correction or targeted-advertising opt-out right; we nevertheless accept correction requests under Section 11 and do not use cross-context behavioral advertising.

To exercise Iowa CDPA rights, email support@thegrantmap.com with the subject "Privacy Request, Iowa." We may authenticate the request. Where the law applies, the response period is up to 90 days, with one permitted 45-day extension after notice. To appeal a refusal, use the subject "Privacy Appeal, Iowa"; the statutory appeal response period is 60 days. See Iowa Code chapter 715D.

16. Security

We take reasonable technical measures to protect your data, including HTTPS encryption on all pages. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the site after changes are posted means you accept the updated policy.

18. Contact

StanHattie LLC
731 SE Alices Rd PMB 1035
Waukee, IA 50263
Email: support@thegrantmap.com