Privacy policy

Open Research Fund Ltd., a company limited by guarantee incorporated in Singapore, is the organisation responsible for your personal data. We handle it under Singapore's Personal Data Protection Act 2012 (PDPA) and, where you are in the European Union or the United Kingdom, under the GDPR and UK GDPR as well. Our Data Protection Officer, appointed under the PDPA, can be reached through the contact details on this site.

Your name, contact details, institution, and career stage. The research interests and prior work you tell us about. The content of applications we prepare for you, including drafts. Records of awards you win and correspondence with funders about them. Basic technical logs about how you use the site.

To work out which funding opportunities you qualify for, to fill in and draft applications, to track deadlines and reporting obligations, to manage awards and balances you hold with us, and to tell you about opportunities we think are worth your time.

We will never sell your data. We will never train publicly available models on your unpublished research or draft proposals. We will never share your profile or your work with another researcher, a funder, or your institution without your permission.

Funders see only what is contained in an application you have personally approved. Where an award legally requires institutional sign-off, the relevant person at your institution sees the application they are being asked to authorise. Our service providers, such as our hosting and banking partners, process data strictly on our instructions.

Where we hold awarded funds for you, our banking partners handle the money and the identity checks that financial regulation requires. We keep the records of what you were awarded and what remains, so we can report on it and so you can move it.

We keep your profile for as long as your account is open. Records tied to an award are kept for as long as the funder requires them to be retained, which is often several years after a grant closes. Everything else is deleted when you ask us to.

We are based in Singapore and use service providers in Singapore, the United States and the European Union. When personal data leaves Singapore we make sure the recipient is bound to protect it to a standard at least comparable to the PDPA, as its transfer limitation obligation requires, and for data from the EU or UK we rely on standard contractual clauses or an equivalent lawful mechanism.

You can see everything we hold about you, export it, correct it, or ask us to delete it. Under the PDPA you have the right to access and correct your personal data and to withdraw consent, and we respond to such requests within 30 days. Depending on where you live you may also have the right to object to certain processing. If you are unhappy with how we have handled a request you can complain to the Personal Data Protection Commission of Singapore or to your local data protection regulator. Write to us first and we will help.

The public site sets no cookies and uses no analytics, advertising trackers, tracking pixels, session-replay tools, or third-party chat widgets. Nothing on the page records your keystrokes, mouse movements, or browsing on other sites, and we do not load scripts from advertising networks. That is why there is no cookie banner: there is nothing to consent to. If you open an account we will use a single cookie to keep you signed in. If any of this changes we will update this page first and ask for consent where the law requires it. We honour the Global Privacy Control signal.

This section supplements the rest of the policy for California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA).

In the last 12 months we have collected these categories of personal information: identifiers (name, email, institution), professional and employment information (role, career stage, publications, prior funding), the content of applications you ask us to prepare, and limited internet activity (server logs). We collect it directly from you, from your institution when it engages us, and from public sources such as your publications. We use it for the purposes in section 2 and keep it for the periods in section 6.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information other than to provide the service. We have not done so in the last 12 months. Because we do not sell or share, there is no “Do Not Sell or Share” link to offer; the Global Privacy Control signal is honoured regardless.

You have the right to know what we have collected about you, to have it deleted, to correct it, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights. Submit a request through the contact details on this site. We verify requests by confirming control of the email address on the account, respond within 45 days, and accept requests from an authorised agent with written permission. Under California's “Shine the Light” law (Civil Code section 1798.83) you may also ask about disclosures to third parties for their direct marketing; we make none.

The service is for researchers and is not directed at anyone under 18. We do not knowingly collect personal information from children under 13 and will delete it if we learn we have.

When we change this policy we update the date at the top and, for changes that affect how we use your information, tell you by email before they take effect.