Privacy Policy

This Privacy Policy describes the privacy practices of Gridset. When we speak of "Gridset", "we", "us" and "our", we are referring to Gridset by Nitrolabs Limited. This Privacy Policy applies to the Site and Service (as defined below).

Please read this Privacy Policy carefully before using gridset.app and associated Gridset websites and any other associated websites (together, the "Site") operated by Gridset. Gridset is committed to protecting the privacy of its online guests, customers, and members. We believe that maintaining privacy while using the Gridset Service and software (collectively, the "Service" or "Services") and the Site is very important and hope that you will read this Privacy Policy carefully so that you will understand both our commitment to you and your privacy and our method of collecting and using information. Gridset takes your privacy seriously. Gridset sees it as our duty of care to keep personal data safe and to ensure that all personal data is used and stored in accordance with applicable data protection laws. Our culture of respect means we do not misuse personal data in our possession.

This Privacy Policy has been incorporated by reference into the Gridset Terms of Service. You should also carefully read the Terms of Service prior to using the Site.

This Privacy Policy applies to all of the Services offered by Gridset or its subsidiaries or affiliates. If you have any questions about this Privacy Policy, please feel free to contact us through our website or email us at support@gridset.app.

1. What Gridset Collects

1.1. Gridset collects and uses the following information to provide, improve, and protect the Services:

1.1.1. Account Information. When you first use the product, Gridset creates an anonymous demo account so your documents and usage limits can be kept separate from other users. If you sign up or connect an identity provider, we collect the information needed for that account, such as your email address and, where provided by you or the identity provider, your name and profile image. We may also collect optional onboarding responses such as your role, use case, and how you heard about Gridset. Gridset does not currently collect payment-card information.

1.1.2. Your Content. Our Services are designed for you to upload, import, create, generate, edit, and export brand-compliant documents and presentations. Your Content may include source drafts and files you upload or import (such as documents, notes, and other files), brand assets you provide (including logos, fonts, colours, brand photos, and brand guideline documents), prompts and instructions you give to our AI features, the documents and presentations generated for you, the charts and images contained in them, and related metadata. To provide the Service, we store, process, and transmit Your Content as well as information related to it. The related information may include your profile name, content metadata, edits, generation and export history, AI interaction history, timestamps, device and usage activity, and audit or security events. See Sections 4, 5, and 12 of the Terms of Service for additional information regarding your Content.

1.1.3. Cookies and Local Storage. When you visit the Site, Gridset uses cookies and similar browser storage for authentication, security, preferences, and product operation. We also use analytics to understand product usage. You can control cookies through your browser, although disabling required cookies may prevent parts of the Service from working. Signed-in users can turn usage analytics off in Settings → Privacy.

1.1.4. Logs, Analytics, and Session Replay. When you access the Service, our systems may record your requests and interactions, IP address, browser and device information, dates and times, and account or document identifiers. We use PostHog for product analytics, error reporting, and session replay. Session replay masks text by default; document text is included only when you enable the corresponding privacy setting. Usage analytics and masked replay run by default; signed-in users can turn them off in Settings → Privacy. Necessary crash and exception reporting may continue after analytics is turned off so we can keep the Service secure and reliable.

1.1.5. Your Communications. When you send emails or other communications to Gridset, we may retain those communications to process your inquiries, respond to your requests, and improve our Services. We may also use your email address to send authentication, security, support, and other necessary Service communications.

1.1.6. Sensitive Personal Data. Where required by law, we will seek any required permissions from you prior to collecting any sensitive personal data, as those items are defined under applicable law.

1.2. Gridset collects and uses the personal data described above in order to provide you with the Service in a reliable and secure manner, and for legitimate business needs. To the extent we process your personal data for other purposes, we will ask for your consent in advance.

1.3. Gridset adheres to a "data minimization" approach with respect to the information we collect from you, such that we restrict the collection and processing of personal information to that which is reasonably necessary and proportionate to achieve the purposes for which the personal information was collected from you or processed.

2. How Gridset Stores Your Content and Personal Data

2.1. Gridset is dedicated to keeping your content secure. We use secure encryption techniques to protect your content and personal data. We are fully transparent about the way we manage your content and personal data:

2.1.1. Except as set out in Section 5 entitled "Information Gridset Discloses", Gridset will not willfully disclose or sell your content or personal data to anyone. Nor will we willfully allow any third party to access your content or personal data except as set out in Section 5.

2.1.2. In the course of providing the Service, your content is transferred to and from Gridset's servers and trusted infrastructure providers. Transfers are encrypted in transit. Gridset takes the security of your content and personal data seriously – please see Section 6 entitled "Gridset Security Measures" below for further details.

2.1.3. In addition to displaying your content in the Service, we also process it for the following purposes:

2.1.3.1. to read, parse, and understand the drafts, notes, and source documents you upload or import, so that we can turn them into designed documents and presentations;

2.1.3.2. to generate, lay out, and render designed documents, presentations, charts, and images on your behalf;

2.1.3.3. to prepare your content for efficient loading, preview, editing, and export;

2.1.3.4. to allow for integrations with other Services (such as cloud storage providers you connect); and

2.1.3.5. to allow for integrations with AI providers, model providers, and other configured service providers that the Service relies on to generate and process content.

2.1.3.6. Gridset does not use your Content to train its own AI models. Third-party AI providers process Content to generate your requested output under their applicable terms and privacy commitments.

2.1.4. When you delete your account through the Service, deletion is immediate and irreversible. Gridset removes the account's active documents, brands, uploaded assets, usage records, connector grants, and associated account records, subject only to narrow records we may be required to retain for legal or security purposes. Gridset also requests deletion of associated analytics records; provider-side deletion may complete asynchronously.

2.1.5. You can get access to all of your data stored by Gridset by filing a subject access request. Please see Section 7 entitled "Your Data Protection Rights" below for further information.

2.1.6. You can request that all of your personal data, as stored by Gridset, be deleted, forgotten, or removed by submitting a request with Gridset as set forth in Section 7 entitled "Your Data Protection Rights", or by logging into the Service and deleting your account.

2.1.7. We only retain a minimum amount of personal data to ensure Gridset can provide a high-quality service. We retain content where you upload, import, create, generate, edit, or ask Gridset to process that content as part of the Service.

2.1.8. Content and the entities within it are given unique identifiers. We use those identifiers to record edits, generations, exports, AI interactions, and other activity within the Service.

2.1.9. Uploaded content and the documents and presentations generated for you are encrypted when stored on Gridset servers and encrypted in transit.

2.2. By opening an account, you hereby acknowledge and agree that Gridset may transfer your personal data across national borders and to other countries where Gridset and its partners and providers operate, including the United States and New Zealand. The privacy protections and rights of authorities to access your information in these countries may not be equivalent to those in your country. We will only transfer your personal data to these countries if permitted to do so by law and we will attempt to ensure that your personal data continues to receive appropriate protections.

3. How Gridset Uses your Personal Data

3.1. Gridset uses the information we collect about you for the following purposes:

3.1.1. To open accounts and provide the Services. When Gridset creates an anonymous demo account or you sign up, we use your personal data to: (a) provide the Services; (b) verify and protect your identity and account; (c) enforce usage limits; (d) send necessary authentication, security, and Service communications; and (e) provide customer service or support.

3.1.2. As required to conduct our business. In the course of operating our business, we will use your personal data to: (a) analyze your use of the Services to ensure the Services are being delivered effectively and to continually improve the Services and our delivery of them; (b) analyze your use of the Services and your Content to detect and prevent fraudulent or illegal activity or misuse of the Services; (c) diagnose problems with the Services; and (d) investigate and address any comments or complaints from you.

3.1.3. Where required, when you have given Gridset your consent. If you have given Gridset your consent, we will use your personal data to: (a) send you information about Gridset products and services, special offers and similar information; and (b) access information on your computer or other device relating to crash reports.

3.1.4. For legal reasons. Gridset will disclose your personal data: (a) to respond to lawful requests from government agencies, law enforcement agencies and regulators; and (b) as required by legal process or litigation.

4. Content stored by Cloud Storage Providers and Integrations

4.1. Connecting cloud storage providers, AI providers, model providers, and other integrations can make it easier and more secure to use the Service. Content may remain with those providers unless you import, upload, generate, or otherwise use it through Gridset. Connections with supported providers are encrypted where the integration protocol supports encryption.

5. Information Gridset Discloses

5.1. Gridset will never sell your personal information data to advertisers or third parties. Gridset only shares personal data as follows:

5.1.1. If required for future payment processing. Gridset is currently free during beta and does not collect payment-card information. If Gridset introduces paid plans, we will identify the payment provider and disclose the relevant processing before collecting payment information.

5.1.2. If we have your consent. We require opt-in consent for the sharing of any sensitive personal data. If you are less than 18 years of age, opt-in consent for the sharing of any sensitive personal data must be obtained from your parent or guardian. We provide such information to our employees, subsidiaries, affiliated companies or other trusted businesses or persons for the purpose of processing personal data on our behalf. We require that these parties agree to process such information based on our instructions and in compliance with this Privacy Policy and any other appropriate confidentiality and security measures.

5.1.3. If it is permitted by law. We will only share your personal data if we have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, (b) enforce the Terms of Service, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address fraud, security or technical issues, and (d) protect against harm to the rights, property or safety of the Service and Gridset, its users, or the public, as required or permitted by law.

5.1.4. In the context of a merger. If Gridset becomes involved in a merger, acquisition, or any form of sale of some or all of its assets or ownership interests, we will ensure the confidentiality of any personal data involved in such transactions and provide you notice before personal data is transferred and becomes subject to a different privacy policy.

5.1.5. To other users. If you explicitly choose to share content with another person via the Service, we will share that content accordingly, along with the information necessary to display it to them (such as your name and the relevant content).

5.1.6. To service providers. We disclose only the information reasonably necessary for the providers described in Section 10 to perform their contracted functions.

6. Gridset Security Measures

6.1. Gridset takes appropriate security measures to protect against unauthorized access to, or unauthorized alteration, disclosure, or destruction of, data. Gridset takes the security of your data seriously and undergoes security auditing with third-party security firms to ensure the security of the Service. This includes internal reviews of our data collection, storage and processing practices and security measures, including appropriate encryption and physical security measures to guard against unauthorized access to systems where we store personal data. We restrict access to personal data to Gridset employees, contractors, professional advisors, and agents who need to know that information to process it on our behalf or advise us. These individuals, advisors and third-party security firms are bound by confidentiality obligations and may be subject to discipline, including termination and criminal prosecution, if they fail to meet these obligations.

6.2. If you believe your account or personal data may have been compromised, contact support@gridset.app promptly.

7. Your Data Protection Rights

7.1. Gridset would like to ensure you are fully aware of all your data protection rights. Every user is entitled to the following when provided for by applicable law:

7.1.1. The right to access. You have the right to request copies of your personal data. We kindly ask that you identify yourself and the information requested to be accessed before we process the request. We will fulfil this request free of charge, except if doing so would require a disproportionate effort.

7.1.2. The right to correct. You have the right to edit, correct or complete your personal data if you believe it is inaccurate or incomplete. We kindly ask for you to identify yourself and the information requested to be corrected or completed before we process the request. We will fulfill this request free of charge, except if doing so would require a disproportionate effort.

7.1.3. The right to delete. You have the right to request we delete and erase your personal data, subject to the conditions set forth below in "Deleting Your Information".

7.1.4. The right to restrict processing. You have the right to request we restrict the processing of your personal data, subject to Gridset's legitimate business needs.

7.1.5. The right to object to processing. You have the right to object to our processing of your personal data, subject to Gridset's legitimate business needs.

7.1.6. The right to data portability. You have the right to request that we transfer your personal data that we have collected directly to you so that it may be transferred by you to another organisation.

7.2. Whenever feasible, we will match the identifying information provided by you in your request to your personal information that we already maintain, or use a third-party identity verification service.

7.3. You may be entitled to additional rights based on applicable data privacy laws in your jurisdiction.

7.4. If you make a request regarding your personal data, we will endeavor to respond to you within thirty (30) days. If you would like to access any of these rights, please contact us at support@gridset.app. If we have not responded to your request within thirty (30) days, please contact support@gridset.app.

7.5. If we deny a request from you, please contact us at support@gridset.app, as the denial may have resulted from our inability to confirm your identity. If you are a resident of California, and we have not responded to your denial inquiry within thirty (30) days, you can file a complaint with the California Privacy Protection Agency (https://cppa.ca.gov/webapplications/complaint) and the California Attorney General (https://oag.ca.gov/contact/consumer-complaint-against-business-or-company).

8. Deleting Your Information

8.1. When you register for an account to use the Services, we retain your provided personal data so long as you have an open account. We delete certain personal information we collect about you when we no longer have a business reason to retain it. Additionally, there is certain personal information we need to retain even after you close your account to comply with business and legal requirements, such as personal information related to our contract and business transactions with you, which we retain for ten (10) years after your last interaction with us.

8.2. Deleting your account through Settings → Privacy immediately starts permanent deletion of the account and its Content from Gridset's active systems and requests deletion of associated analytics records. Provider-side analytics deletion may complete asynchronously. There is no deactivation or reactivation period and the action cannot be undone.

8.3. Gridset may retain narrowly limited records after account deletion only where required for legal compliance, fraud prevention, dispute resolution, or security. Those records are not available for account reactivation.

8.4. Content opened from a cloud storage provider or integration is not copied to our servers unless you import, upload, generate, or otherwise use that content through Gridset. Connections with supported providers are encrypted where the integration protocol supports encryption.

9. Marketing

9.1. Gridset would like to send you information about products and services of ours that we think you may like. If you agreed to opt-in to receive our marketing during the signup process, you are always free to opt out at a later date by going to the settings page in your account. You also have the right at any time to stop us from contacting you for marketing purposes.

10. Third Party Use of Information

10.1. We share your information with third-party service providers only as reasonably necessary to provide, secure, support, and improve the Service, or where you direct us to use an integration. We require providers to process information consistently with their contracted purpose and applicable law.

10.2. Current providers include Supabase (authentication, database, and file storage); Vercel (application hosting); OpenRouter and the upstream AI model providers selected for generation; PostHog (analytics, error reporting, and session replay); Resend (authentication email delivery); Brandfetch and Firecrawl (brand information retrieval); Pexels (image search); Google (Drive imports and web fonts); Notion (page imports when connected); and Sanity (marketing-site content management). Gridset may also use Upstash for distributed abuse prevention when that integration is enabled. Provider availability and the specific upstream AI model may change as the Service evolves.

10.3. Gridset does not sell or rent the information we collect directly from you or about you from third parties.

11. Privacy Policies of Other Websites

11.1. The Site may contain hyperlinks to other websites of interest. However, once you have used these links to leave the Site, you should note that Gridset does not have any control over the other website. Therefore, we cannot be responsible for the protection and privacy of any information that you provide while visiting such websites and such websites are not governed by this Privacy Policy. You should exercise caution and look at the privacy policy applicable to the website in question, and you hereby waive any claim against Gridset for any damage or liability you may incur as a result of visiting any such website.

12. Personal Data Incorporated into Content

12.1. If in your Content you include personal data, by opening an account you hereby acknowledge and agree that Gridset is not responsible or liable for that personal data (other than Gridset's general security relating to Content) or the manner in which it is collected. You hereby indemnify Gridset for any and all costs, losses or damages incurred by Gridset resulting from such collection or recording.

13. Changes to this Privacy Policy

13.1. Please note that this Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent. We will post any Privacy Policy changes on this page and, if the changes are significant, we will provide a more prominent notice (including, in some cases, email notification of Privacy Policy changes). We will also keep prior versions of this Privacy Policy in an archive for your review.

14. Contact Us

14.1. If you have any questions about this Privacy Policy, or your personal data that we hold, or if you would like to exercise one of your data protection rights, please do not hesitate to contact us at support@gridset.app.