Privacy notice

Draft for legal review, 17 October 2026. This text describes what the Openfund software actually stores and does, but a lawyer has not reviewed it yet; what is marked [like this] is still to be decided or filled in.

What personal data Openfund keeps, why, on what legal basis and for how long. This text is written from what the software actually does. In short: we keep as little as we can, we do not sell data or use it for advertising, there is no analytics and no tracking, and everything stays in the EU.

Who is responsible

The controller of your personal data is [legal name, ЕИК (company number) and registered address of the controller], which runs Openfund at www.openfund.eu. For anything about your data, write to security@openfund.eu. [Data protection officer: none appointed / name and contact]

In short

The public data on EU funds (calls, projects, organisations, the map, the API) needs no account and collects nothing about you.
If you join the waitlist, we keep your e-mail with your consent. You can leave at any time.
If you create an account, we keep a name, an e-mail and a hash of the password to provide the service.
Work started without an account opens only with its private link and is deleted 30 days after its last change.
Cookies only make the site work (sign-in, your drafts, the light or dark theme). There are no analytics, advertising or third-party cookies, and the site runs no JavaScript.
We make no automated decisions about you: checks and suggestions are aids, and a person decides.

What we keep, why and for how long

For each kind of data: exactly what we keep, for what purpose, on what basis under the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and for how long. “Deleted” here means deleted from the live database; for copies, see “Backups” below.

Waitlist

Data: E-mail, kind of organisation, its name (if you give it), the language of the page, when you consented, when you confirmed, when you were invited and by which Openfund administrator.
Purpose: To invite you to Openfund when it is your turn.
Legal basis: Your consent (GDPR art. 6(1)(a)), given with the box on the form and confirmed through the link we e-mail you.
Kept: Unconfirmed entries are deleted after 30 days. Confirmed entries stay until you leave with the link in the confirmation e-mail (valid for a year) or by writing to us. An entry is not deleted by itself after the invitation or when you create an account. [retention after the invitation – to be decided]

Invitation codes

Data: The code, only as a hash; for a code made for one address, that e-mail; when it was made, until when it is valid and which account used it.
Purpose: Closed beta: only invited people can sign up.
Legal basis: Our legitimate interest in opening the platform in stages (art. 6(1)(f)).
Kept: Currently not deleted automatically. [retention – to be decided]

Account

Data: Name, e-mail, password (only as an scrypt hash, never the password itself), whether the e-mail is confirmed, when the account was created and when you last signed in; if you turn on two-step verification, the secret key for the codes and hashes of the recovery codes.
Purpose: Signing you in, keeping your work, linking it to your organisation, and the e-mails this needs (confirming the e-mail, a new password, invitations).
Legal basis: Performance of the contract – the service you ask for (art. 6(1)(b)).
Kept: Until you delete the account. Inactive accounts are not deleted automatically. [inactivity limit – to be decided]

Sessions and sign-in protection

Data: For each device you sign in on: a hash of the session key, when the session started and was last used, the IP address and the browser's description (user agent), and whether it passed two-step verification. To limit attempts: the time and IP address of each failed sign-in or code, failed sign-up and waitlist request, and for a sign-in the e-mail or account tried.
Purpose: Keeping you signed in; showing your active sessions so you can end them; stopping password guessing.
Legal basis: The contract (art. 6(1)(b)) and our legitimate interest in keeping accounts secure (art. 6(1)(f)).
Kept: A session stops working after 7 days without use or 30 days in all. Its record is deleted when you sign out, end it from the account page, change your password or delete the account, or when an expired session is tried again. [automatic deletion of expired sessions – to be added] Attempts are kept for about 15 minutes.

One-time links

Data: A hash of each link we e-mail (confirming the e-mail, a new password, confirming or leaving the waitlist), its kind, the e-mail or account it is for, when it expires and when it was used.
Purpose: Making each link work once, and only for the person it was sent to.
Legal basis: The contract (art. 6(1)(b)); for the waitlist links, your consent (art. 6(1)(a)).
Kept: Until the link expires – 1 hour (e-mail and password), 48 hours (waitlist confirmation), 1 year (leaving the waitlist) – and it is deleted when the next link is issued.

E-mails we send

Data: A copy of every e-mail Openfund sends: the address, the subject, the text (with the one-time link in it) and when it was sent.
Purpose: Sending, and checking that it was sent. Until a mail provider is connected, e-mails stay here and in the server log instead of being sent.
Legal basis: The basis of the e-mail itself (contract or consent) and our legitimate interest in being able to show what was sent (art. 6(1)(f)).
Kept: Currently not deleted automatically, and not deleted with the account. [retention – to be decided]

Organisations, roles and invitations

Data: Organisations you create (name, kind, ЕИК), their units, memberships (who has which role, since when, until when and who gave it), supervisors and their students, invitations (the invited e-mail, role, who invites, expiry, when accepted), what is shared with whom, and a log of changes: units, roles given and removed, invitations with the invited e-mail, sharing with the other person's e-mail, joining, previews as a demo member.
Purpose: Letting an organisation decide who sees what – projects, finances, people – and keeping a record of who changed access.
Legal basis: The contract with the account holder (art. 6(1)(b)); for the other people in the organisation, the organisation's and our legitimate interest in controlled, traceable access (art. 6(1)(f)).
Kept: As long as the organisation exists in Openfund. When you delete your account, your memberships and shares are deleted, but entries about you in the organisation's log stay with it. Invitations are not deleted by themselves after they expire. Demo organisations, with their fictional people, are deleted after 30 days.

Application drafts (workspace)

Data: The call you apply to, your answers in the concept interview, the section texts, the budget, approvals with the approver's name, and the log of every suggestion and decision (the AI-usage log).
Purpose: Helping you prepare an application. Openfund never submits it.
Legal basis: The contract – the service you start (art. 6(1)(b)).
Kept: Without an account: deleted 30 days after the last change. In an account: until you delete it or the account. Made for an organisation: stays with the organisation when you delete your account.

Evidence and expenses (project ledgers)

Data: Documents you upload (invoices, contracts, payrolls, timesheets, travel orders and others), the details read from them (supplier, ЕИК, VAT number, IBAN, amounts), bank statement lines (date, amount, counterparty, IBAN, reference), the project's IBAN, matches, allocations and a hash-chained log. These files can contain other people's personal data, such as the employees on a payroll.
Purpose: Matching costs to payments and building an audit package for the project.
Legal basis: The contract (art. 6(1)(b)). You decide what other people's data goes into your documents; we process it only to provide this service to you. [data-processing terms for organisations (GDPR art. 28) – to be added]
Kept: Without an account: deleted 30 days after the last change, unless you turned on a legal hold – then it stays until you delete it. In an account or an organisation: as for application drafts.

Researcher profiles, job posts and teams

Data: Profile: name, headline, ORCID iD, position, organisation, city, skills, availability by month, a private pay band (not shown), contact, and whether the profile is shown. Job post: organisation, title, kind, description, skills, pay range, hours, place, dates, contact. Team: the roles, the budget, the people suggested and the log of approvals.
Purpose: A directory where people and employers contact each other directly; team suggestions that a person approves.
Legal basis: Showing your profile to others: your consent (art. 6(1)(a)) – the “show my profile” box, which you can untick at any time. Keeping it for you: the contract (art. 6(1)(b)).
Kept: Profiles without an Openfund account, and all job posts: deleted 30 days after the last change. Profiles in an account: until you delete them or the account. Teams: as for application drafts.

Equipment and capacity

Data: A resource you add (name, provider, contact for access, description, tariffs) and booking requests (the requester's name and ЕИК, user class, activity, units, notes).
Purpose: A catalogue of research equipment, and the State-aid check on the demo labs.
Legal basis: The contract (art. 6(1)(b)).
Kept: Resources added without an account: deleted 30 days after the last change. Booking requests: 30 days after they are made.

Public data on EU funds

Data: Openfund republishes official records: calls, projects, beneficiaries, contractors and organisations from ИСУН, the EU Funding & Tenders Portal, CORDIS, the Commercial Register, ЦАИС ЕОП and the other sources listed on the Data & methodology page. Where a source publishes a natural person (for example a farmer or a sole trader as a beneficiary or a contractor), we show the name as it is published. We do not keep ЕГН (personal numbers) or addresses; a seat is kept down to the settlement.
Purpose: Transparency of public money.
Legal basis: Legitimate interest – ours and the public's in knowing how EU funds are spent (art. 6(1)(f)) – for data the sources publish by law. You can object (art. 21) and ask for a correction; we will check it against the official source.
Kept: Records are refreshed from their sources regularly and kept as part of the public record of EU funding.

Server logs

Data: The web server's log: IP address, time, the page requested, the answer, the page you came from and the browser's description. The application's log: the pages requested and errors (without your IP address), and, until a mail provider is connected, the text of the e-mails. The delivery network (Bunny) keeps logs without your IP address.
Purpose: Security, stopping abuse, fixing errors.
Legal basis: Legitimate interest (art. 6(1)(f)).
Kept: The web server's log: 14 days. The application's log: 30 days.

Backups

The database with accounts and work is copied continuously to Exoscale object storage in Frankfurt (restore points for 30 days), and every night as an encrypted copy that the server itself cannot read (kept daily for 35 days, the first copy of each month for 12 months and the first of each year for 10 years). Deleted data therefore stays in backups until they expire – in the yearly copies, up to 10 years. Backups are used only to restore the service. [backup retention – to be reviewed]

Cookies

Openfund uses only cookies without which the site cannot do what you ask, so it does not ask for consent for them (Directive 2002/58/EC, art. 5(3); Bulgarian Electronic Communications Act, art. 4a). There are no analytics, advertising or third-party cookies; the site runs no JavaScript and loads nothing from other sites.

Cookie	What it holds	Lasts
`sid`	A random sign-in key (we keep only its hash). Not readable by scripts.	30 days, or until you sign out
`ws`	Links to the application drafts started on this device without an account (up to 20).	30 days from the last change
`vt`	Links to the project ledgers opened on this device without an account.	30 days from the last change
`tm`	Links to the teams built on this device without an account.	30 days from the last change
`theme`	Light or dark theme – only after you press the switch.	1 year

Service providers

Everything is stored and served in the EU. These providers work for us under data processing agreements [confirm the agreements are accepted]:

Exoscale – the server in Sofia, Bulgaria, and the backups in Frankfurt, Germany.
Bunny CDN (BunnyWay d.o.o., Slovenia) – delivers the pages from EU locations only; its logs do not contain your IP address.
[Scaleway TEM or Lettermint – to be chosen; an EU provider] – sends Openfund's e-mails (your address and the e-mail's text).
deSEC (Germany) – the domain's DNS; it receives no data about your account.
Let's Encrypt (ISRG, USA) – issues the site's TLS certificate; it receives no data about you.

We do not sell data, give it to advertisers or transfer it outside the EU. We disclose data to authorities only when the law requires it.

No automated decisions

Openfund makes no decision about you with legal or similarly significant effects (art. 22). Eligibility, budget and compliance checks, the mock evaluation and suggestions of partners and team members are aids: each says so, and a person decides. In this version the writing suggestions are fixed templates, not a language model.

Your rights

Access and portability (art. 15 and 20): download your account's data as JSON from /my/export.json (or “Account and security” → “Download your data”). The file holds the account, memberships, sessions, application drafts with their texts, the list of your ledgers and teams, your researcher profile and what is shared with you. A ledger's documents download from the ledger itself as an audit package. For anything else (such as a waitlist entry or the e-mails we sent you), write to us.
Correction (art. 16): change your name on the account page and your work directly in it; for public records, write to us.
Erasure (art. 17): delete your account from the account page. This deletes the account, sessions, memberships, shares, your researcher profile and your personal work; work made for an organisation stays with it, without you as its owner. Drafts and ledgers without an account have their own Delete button. Leave the waitlist with the link in the e-mail.
Withdrawing consent (art. 7(3)): leave the waitlist or untick “show my profile”. Withdrawing does not affect what was done before.
Restriction and objection (art. 18 and 21): write to us – especially if you appear in the public data.
Complaint: to the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or to the supervisory authority where you live or work.

Write to us at security@openfund.eu. We answer within one month (art. 12(3)).

Security

HTTPS only; passwords kept as scrypt hashes; sessions and one-time links kept only as hashes; optional two-step verification, required for wide roles in an organisation; encrypted nightly copies; the server accepts requests only from the delivery network.

Changes

We publish changes here with a new date and e-mail account holders about material ones.