Privacy Policy

This policy covers two kinds of people: the staff at a business using Grip (a “Workspace”), and that business's own clients, whose details a Workspace collects through Grip's forms.

For a Workspace's clients, the Workspace itself is the data controller. We act as their processor, handling data on their instructions. Questions about a specific business's use of your data should go to that business first.

• Account details you give us when creating or joining a Workspace: name, email, password (stored hashed, never in plain text).
• Whatever a Workspace configures its forms to collect from its own clients, which we store on that Workspace's behalf.
• Basic technical data (sign-in times, IP address, device) kept for security and the audit log.

• Every Workspace's data is isolated at the database level, enforced by row-level security, not just filtered in the interface.
• Passport and national ID numbers are encrypted and masked by default, visible only to staff a Workspace specifically allows.
• Every meaningful action, sign-ins, edits, document downloads, sensitive-field reveals, is recorded permanently in an audit log nobody can quietly edit.
• Uploaded documents are stored privately and served through short-lived links that expire.

We don't sell your data, share it between Workspaces, or use it to train anything. We don't look at a Workspace's data except to provide support, on request, for a limited time, and that access is itself recorded in the Workspace's own audit log.

We use a small number of cookies required to keep you signed in and to remember your interface preferences (like light/dark mode). We don't use third-party advertising or tracking cookies.

You can ask to see, correct, export or delete the personal data we hold about you. For data a Workspace collected from you as their client, start with that business, since they control it; we'll support them in fulfilling that request.

We keep data for as long as a Workspace exists and for a reasonable period after closure to meet legal obligations (audit and financial records, for example), then delete it.

If we make a material change to this policy, we'll let Workspace owners know before it takes effect.

Questions about this policy: [email protected].