This Privacy Policy explains how gridOS ("gridOS," "we," "us," or "our") collects, uses, and protects information when you use the gridOS agency management application (the "Service"). It applies to the marketing site and the app at gridos.cc. This policy is written to meet the requirements of the EU General Data Protection Regulation ("GDPR") and Brazil's Lei Geral de Proteção de Dados ("LGPD").
1. Who controls your data
gridOS as controller. For your account-level information — your name, email address, password, phone number, and technical/log data — gridOS is the data controller under the GDPR, and the controller ("controlador") under the LGPD. gridOS is operated by [Legal entity name and registered address to be added].
Your workspace as controller, gridOS as processor. gridOS is a tool your team uses to run its own agency or business. The client and company records, project details, contacts, payment records, and other business content that you and your teammates choose to enter into a workspace belongs to, and is controlled by, that workspace — meaning your workspace's members decide what data to collect, why, and for how long. In that relationship, gridOS acts only as a data processor (an "operador" under the LGPD): we process workspace content solely to provide the Service, on your workspace's instructions, and we don't use it for our own purposes. If your workspace stores personal data about your own clients or contacts in gridOS, your workspace — not gridOS — is responsible for having a lawful basis for that processing and for responding to that person's rights requests.
2. Information we collect
Account information. When you create an account, we collect your name, email address, phone number, and password. Passwords are handled by our authentication provider (Supabase) and stored in hashed form — we never see or store your password in plain text. If you choose to sign in with Google, we receive your name, email address, and profile photo from your Google account instead.
Workspace company profile. Workspace members can add a company profile for their workspace, including the company name, company logo, industry, and country of operation. Like other workspace content, this information is entered by your workspace's members (see Section 1).
Workspace content. gridOS is a tool for running your agency, so it stores what you and your teammates enter into it: company records, project details, calendar entries, payment records, member profiles, and any files you upload — attachments, avatars, company/workspace logos, and workspace documents.
Automatically collected information. Our hosting and infrastructure providers automatically log standard technical data such as IP address, browser type, and access timestamps, used for security and reliability purposes.
Local device storage. gridOS stores your language preference in your browser's local storage. Your sign-in session is kept in memory only and is not persisted to your device — you'll need to sign in again each time you open gridOS in a new browser session.
3. How we use information
- To provide, maintain, and secure the Service
- To authenticate you and manage your workspace membership
- To send service-related emails, such as password resets and sign-up confirmations
- To send in-app reminders and notifications you'd expect from a workspace tool, such as upcoming meeting and task reminders, @mentions, and messages from teammates
- To respond to support requests you send us
We do not sell your personal information, and we do not use your data for advertising or third-party marketing.
4. Legal bases for processing
Under the GDPR (Article 6), and the equivalent legal bases under the LGPD (Article 7), we rely on the following grounds to process your personal data:
- Contract performance. Most of what we do — creating your account, running your workspace, storing what you and your team enter — is necessary to provide the Service you've signed up for.
- Legitimate interests. We process technical/log data, and send meeting and task reminders, based on our legitimate interest in keeping gridOS secure, reliable, and useful — balanced against your rights and expectations.
- Consent. Signing in with Google is optional and based on your consent, which you can withdraw at any time by disconnecting it and using email/password sign-in instead. We do not currently send marketing communications; if that ever changes, we'll ask for your consent first.
- Legal obligation. In some cases we may need to process or retain data to comply with a legal obligation that applies to us.
5. Sharing within your workspace
gridOS is a shared-workspace product: any information you enter is visible to the other members of the same workspace — teammates you've invited, or who've invited you. Please keep this in mind when deciding what to store in a shared workspace.
Files opened by link. Files sent in chat, images placed in notes, profile pictures and deliverables shared with clients are stored at a long, random web address. Anyone who has that exact address can open the file without signing in; the address cannot be guessed or listed. Please do not forward such a link to anyone who should not see the file.
Error reports. When something fails in the app, we keep a technical record for up to 30 days: the error message, the screen it happened on, the type of browser and device, and the account it happened in. We do not keep what you typed or the content of your workspace. We use it only to fix the problem.
6. Your rights
Depending on where you live, data protection law gives you rights over your personal data — as a "data subject" under the GDPR, or a "titular" under the LGPD. These include the right to:
- Access the personal data we hold about you
- Rectify or correct inaccurate or incomplete data
- Erase or delete your data, subject to certain legal exceptions
- Port your data — receive a copy of your data in a portable format, or have it transferred
- Restrict processing of your data in certain circumstances
- Object to processing based on our legitimate interests
- Withdraw consent at any time, where processing is based on consent (this doesn't affect processing carried out before you withdrew it)
- Not be subject to solely-automated decisions that produce legal or similarly significant effects on you — gridOS does not perform automated decision-making or profiling of this kind
How to exercise these rights. Several of these are already self-service: you can edit your name, phone number, and avatar in your account Settings, and edit your workspace's company profile (company name, logo, industry, country) in the workspace Settings, at any time. You can also permanently delete your own account and its data at any time from account Settings → Delete Account and Data. If you're the only member of your workspace, this deletes the entire workspace and everything in it (clients, projects, tasks, payments, files, and messages); if you share the workspace with teammates, it deletes your own account and access while leaving the workspace and its data with them. For a full export of your data, or if you need help with a deletion request another way, email contact@gridos.cc — we'll process the request within a reasonable time, except where we're required to retain certain data by law.
7. International data transfers
gridOS relies on infrastructure providers — including Supabase, Netlify, Resend, Stripe and, if you use them, Google and Microsoft — that may process and store data in countries other than your own, including outside the European Economic Area or Brazil. Where this occurs, we rely on those providers' own safeguards for cross-border data transfers, such as Standard Contractual Clauses where applicable, and their compliance with applicable data protection frameworks.
8. Data retention
We retain your account and workspace data for as long as your account is active. You can permanently delete your own account and its data at any time from account Settings → Delete Account and Data (see Section 6). If you need help with a deletion request another way, contact us at contact@gridos.cc and we'll process the request within a reasonable time, except where we're required to retain certain data by law.
When a plan ends. If a trial ends without a plan being chosen, or a subscription is cancelled or remains unpaid, the workspace is paused and we keep its data for 90 days. We email the workspace owner before anything is removed. After that period the workspace, its files and any login that belongs to no other workspace may be permanently deleted.
9. Security
We use industry-standard safeguards, including encrypted connections (HTTPS), database-level access controls (row-level security) that restrict each workspace's data to its own members, and hashed password storage. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.
10. Cookies and local storage
gridOS does not use tracking cookies, third-party analytics, advertising, or cross-site tracking of any kind. The only client-side storage we use is your browser's local storage, to remember your language preference on this device. No advertising identifiers, tracking pixels, or analytics scripts are loaded by gridOS.
11. Children's privacy
gridOS is not directed at children. You must be of legal age to form a binding contract in your jurisdiction to create a gridOS account, and we do not knowingly collect personal information from anyone under that age. If you believe a child has provided us with personal information, contact us at contact@gridos.cc and we will delete it.
12. Right to lodge a complaint
If you're in the European Union or European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal data doesn't comply with the GDPR. If you're in Brazil, you have the right to lodge a complaint with the ANPD (Autoridade Nacional de Proteção de Dados), Brazil's national data protection authority. We'd welcome the chance to address your concerns directly first — email contact@gridos.cc — but you're not required to contact us before contacting your supervisory authority.
13. Data breach notification
If a personal data breach occurs that's likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay, and, where legally required, the relevant supervisory authority — for example, within 72 hours of becoming aware of the breach where feasible under the GDPR.
14. Subprocessors
We rely on a small number of infrastructure providers to operate gridOS, each of which processes data on our behalf, solely to provide their service to us, as a subprocessor:
- Supabase — database, authentication, and file storage
- Resend — transactional email delivery (e.g. password resets)
- Netlify — website hosting and content delivery
- Stripe — payment of your gridOS plan. Card details are entered on Stripe's own page and go straight to Stripe; we never see or store them
- Google — optional "Sign in with Google" authentication and, if you connect it, Google Calendar sync
- Microsoft — optional "Sign in with Microsoft" authentication and, if you connect it, Outlook calendar sync
- Your browser's notification service (Apple, Google or Mozilla, depending on your device) — delivery of notifications to your phone or computer, only if you switch them on
15. Changes to this policy
We may update this policy from time to time. If we make material changes, we'll notify you by posting a notice in the app or by emailing you. The effective date above reflects the latest revision.
16. Contact us
Questions about this policy or your data? Email contact@gridos.cc. If you're in the EU/EEA or Brazil and would rather lodge a complaint with a supervisory authority, see Section 12 above.
This policy is a good-faith description of gridOS's data practices, kept accurate and up to date as the product changes — but it isn't a substitute for advice from a qualified lawyer in your own jurisdiction.