1. Who we are and when this policy applies
This policy applies to the GridFlow website, application, support, purchase activation and related services. Our launch scope is the United Kingdom; we do not claim universal worldwide compliance.
GridFlow is normally the controller for account, security, purchase, support, service telemetry and its own prospect data. For workspace data that a customer chooses to upload or create, GridFlow may act as a processor on that customer’s instructions. The Data Processing Addendum covers that processor activity.
2. Data we handle
- Account and organisation: name, work email, password hash, role, organisation, age/authority confirmations and policy acceptance evidence.
- Security: session and device records, login attempts, MFA configuration, truncated device/browser information, IP address and security audit events. We do not store readable passwords, raw session tokens or raw recovery codes.
- Athlete and commercial workspace: profile, goals, companies, contacts, opportunities, tasks, meetings, correspondence, proposals, contracts, delivery evidence and renewal records.
- Public-source research: business contact details, job role, employer, public profiles, source URL, provenance, confidence and suppression/objection records.
- Integrations and AI: Gmail account identifiers and authorised message data; encrypted OAuth tokens; encrypted customer-provided Gemini keys; prompts, inputs, outputs, review decisions and usage/cost telemetry.
- Purchases and support: quote/invoice details, Wise payment reference, entitlement, activation status, receipt, support messages and privacy requests. GridFlow does not store card or bank-login credentials.
3. Where data comes from
We receive data from you, authorised organisation members, connected Gmail accounts, public company websites and professional profiles, public registers, search/research providers, AI providers, Wise payment evidence checked by an authorised administrator, and technical events produced when the service is used.
If we obtain a business contact’s personal data from a public source rather than from that person, we keep provenance and aim to provide appropriate transparency at first communication or within the period required by law. Public availability does not remove data-protection obligations.
4. Why we use data and our lawful bases
We do not use special-category data as a normal part of GridFlow. Do not upload it unless necessary, lawful and agreed with us.
5. AI, Gmail and automated assistance
GridFlow uses AI to assist research, drafting and commercial organisation. AI output can be incomplete or wrong and remains subject to human review. The model is never the authority for access, credits, payments, sending, legal commitments or tenant boundaries.
When a user connects Gmail, GridFlow processes only the authorised data needed for the requested mailbox features. OAuth tokens are encrypted and access can be disconnected. Some Core functions use a customer-provided Gemini key, encrypted at rest; managed research can use GridFlow’s configured providers. Relevant inputs may be sent to those providers to perform the requested task. Do not place unnecessary confidential or sensitive personal data in prompts.
6. Sharing and international transfers
We share data only with authorised organisation members, service providers needed to run GridFlow, professional advisers, authorities where legally required, or a business successor subject to appropriate safeguards. Current provider categories and purposes are listed in our Subprocessor List.
Some providers may process data outside the UK. Where restricted transfers occur, we will use an available lawful safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement/Addendum, or another valid mechanism, and review relevant transfer risks.
7. Retention, deletion and account closure
We keep data only for a documented business, contractual, security or legal need. The Retention Schedule explains current periods. Account closure starts a controlled deletion workflow: active access and integrations are revoked, customer data is deleted or anonymised subject to legal holds, and limited suppression, transaction, security and acceptance evidence may be retained. Backups expire through their normal protected rotation; we do not promise instantaneous deletion from every backup copy.
8. Your choices and rights
Depending on the law that applies, you may ask for access, correction, deletion, restriction, portability, or object to processing, and may withdraw consent without affecting earlier lawful processing. Business contacts can object to direct marketing at any time. GridFlow keeps a minimal suppression record so an opt-out is not accidentally undone.
Use the Privacy Centre or email gridflowsupport@gmail.com. We may need proportionate identity verification. We will not ask for your password, MFA code, recovery code, activation token or API key.
9. Complaints
GridFlow provides a clear electronic complaint route through the Privacy Centre. We record the complaint, acknowledge it promptly and in any event within 30 days where the UK statutory complaint duty applies, investigate it, provide updates where appropriate and respond without undue delay. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
10. Cookies and changes
GridFlow currently uses only strictly necessary authentication and trusted-device cookies and does not run advertising pixels or optional analytics cookies. See our Cookie Notice. If our practices or the law change, we will update the version/date and seek renewed acceptance where a change materially affects the contract or processing.
Contact
GridFlow Support
gridflowsupport@gmail.com