This Privacy Policy explains how gridOS ("gridOS," "we," "us," or "our") collects, uses, and protects information when you use the gridOS agency management application (the "Service"). It applies to the marketing site and the app at gridos.cc. This policy is written to meet the requirements of the EU General Data Protection Regulation ("GDPR") and Brazil's Lei Geral de Proteção de Dados ("LGPD").
gridOS as controller. For your account-level information — your name, email address, password, phone number, and technical/log data — gridOS is the data controller under the GDPR, and the controller ("controlador") under the LGPD. gridOS is operated by [Legal entity name and registered address to be added].
Your workspace as controller, gridOS as processor. gridOS is a tool your team uses to run its own agency or business. The client and company records, project details, contacts, payment records, and other business content that you and your teammates choose to enter into a workspace belongs to, and is controlled by, that workspace — meaning your workspace's members decide what data to collect, why, and for how long. In that relationship, gridOS acts only as a data processor (an "operador" under the LGPD): we process workspace content solely to provide the Service, on your workspace's instructions, and we don't use it for our own purposes. If your workspace stores personal data about your own clients or contacts in gridOS, your workspace — not gridOS — is responsible for having a lawful basis for that processing and for responding to that person's rights requests.
Account information. When you create an account, we collect your name, email address, phone number, and password. Passwords are handled by our authentication provider (Supabase) and stored in hashed form — we never see or store your password in plain text. If you choose to sign in with Google, we receive your name, email address, and profile photo from your Google account instead.
Workspace company profile. Workspace members can add a company profile for their workspace, including the company name, company logo, industry, and country of operation. Like other workspace content, this information is entered by your workspace's members (see Section 1).
Workspace content. gridOS is a tool for running your agency, so it stores what you and your teammates enter into it: company records, project details, calendar entries, payment records, member profiles, and any files you upload — attachments, avatars, company/workspace logos, and workspace documents.
Automatically collected information. Our hosting and infrastructure providers automatically log standard technical data such as IP address, browser type, and access timestamps, used for security and reliability purposes.
Local device storage. gridOS stores your language preference in your browser's local storage. Your sign-in session is kept in memory only and is not persisted to your device — you'll need to sign in again each time you open gridOS in a new browser session.
We do not sell your personal information, and we do not use your data for advertising or third-party marketing.
Under the GDPR (Article 6), and the equivalent legal bases under the LGPD (Article 7), we rely on the following grounds to process your personal data:
gridOS is a shared-workspace product: any information you enter is visible to the other members of the same workspace — teammates you've invited, or who've invited you. Please keep this in mind when deciding what to store in a shared workspace.
Files opened by link. Files sent in chat, images placed in notes, profile pictures and deliverables shared with clients are stored at a long, random web address. Anyone who has that exact address can open the file without signing in; the address cannot be guessed or listed. Please do not forward such a link to anyone who should not see the file.
Error reports. When something fails in the app, we keep a technical record for up to 30 days: the error message, the screen it happened on, the type of browser and device, and the account it happened in. We do not keep what you typed or the content of your workspace. We use it only to fix the problem.
Depending on where you live, data protection law gives you rights over your personal data — as a "data subject" under the GDPR, or a "titular" under the LGPD. These include the right to:
How to exercise these rights. Several of these are already self-service: you can edit your name, phone number, and avatar in your account Settings, and edit your workspace's company profile (company name, logo, industry, country) in the workspace Settings, at any time. You can also permanently delete your own account and its data at any time from account Settings → Delete Account and Data. If you're the only member of your workspace, this deletes the entire workspace and everything in it (clients, projects, tasks, payments, files, and messages); if you share the workspace with teammates, it deletes your own account and access while leaving the workspace and its data with them. For a full export of your data, or if you need help with a deletion request another way, email contact@gridos.cc — we'll process the request within a reasonable time, except where we're required to retain certain data by law.
gridOS relies on infrastructure providers — including Supabase, Netlify, Resend, Stripe and, if you use them, Google and Microsoft — that may process and store data in countries other than your own, including outside the European Economic Area or Brazil. Where this occurs, we rely on those providers' own safeguards for cross-border data transfers, such as Standard Contractual Clauses where applicable, and their compliance with applicable data protection frameworks.
We retain your account and workspace data for as long as your account is active. You can permanently delete your own account and its data at any time from account Settings → Delete Account and Data (see Section 6). If you need help with a deletion request another way, contact us at contact@gridos.cc and we'll process the request within a reasonable time, except where we're required to retain certain data by law.
When a plan ends. If a trial ends without a plan being chosen, or a subscription is cancelled or remains unpaid, the workspace is paused and we keep its data for 90 days. We email the workspace owner before anything is removed. After that period the workspace, its files and any login that belongs to no other workspace may be permanently deleted.
We use industry-standard safeguards, including encrypted connections (HTTPS), database-level access controls (row-level security) that restrict each workspace's data to its own members, and hashed password storage. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.
gridOS does not use tracking cookies, third-party analytics, advertising, or cross-site tracking of any kind. The only client-side storage we use is your browser's local storage, to remember your language preference on this device. No advertising identifiers, tracking pixels, or analytics scripts are loaded by gridOS.
gridOS is not directed at children. You must be of legal age to form a binding contract in your jurisdiction to create a gridOS account, and we do not knowingly collect personal information from anyone under that age. If you believe a child has provided us with personal information, contact us at contact@gridos.cc and we will delete it.
If you're in the European Union or European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal data doesn't comply with the GDPR. If you're in Brazil, you have the right to lodge a complaint with the ANPD (Autoridade Nacional de Proteção de Dados), Brazil's national data protection authority. We'd welcome the chance to address your concerns directly first — email contact@gridos.cc — but you're not required to contact us before contacting your supervisory authority.
If a personal data breach occurs that's likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay, and, where legally required, the relevant supervisory authority — for example, within 72 hours of becoming aware of the breach where feasible under the GDPR.
We rely on a small number of infrastructure providers to operate gridOS, each of which processes data on our behalf, solely to provide their service to us, as a subprocessor:
We may update this policy from time to time. If we make material changes, we'll notify you by posting a notice in the app or by emailing you. The effective date above reflects the latest revision.
Questions about this policy or your data? Email contact@gridos.cc. If you're in the EU/EEA or Brazil and would rather lodge a complaint with a supervisory authority, see Section 12 above.
This policy is a good-faith description of gridOS's data practices, kept accurate and up to date as the product changes — but it isn't a substitute for advice from a qualified lawyer in your own jurisdiction.
