Privacy policy

1. Scope and roles

This policy applies to gridhand.ai, the GridHand owner app, and the callback and message-approval workflows. A participating business controls the customer information it enters. GridHand processes that customer information to provide the service. GridHand acts as the business or controller for owner-account and website information it collects for its own operations.

2. Information we collect

• Owner account: name, email, authentication identifiers, and business profile details.
• Callback records: customer name, phone number when provided, due time, notes, completion state, and timestamps.
• Message workflow: customer name and phone, message drafts, approval or rejection state, delivery status, and audit timestamps.
• Connected tools: provider name, granted permissions, connection status, pseudonymous provider-account identifier, and connection timestamps. Provider access and refresh tokens are encrypted in a server-side tenant vault and are not returned to the phone.
• Missed-call events: calling number, provider event identifier, and the tenant needed to create a draft.
• Privacy requests: email, request type, verification state, and correspondence needed to complete the request.
• Technical data: IP address, browser and device information, request logs, security events, and limited performance measurements.

3. How we use information

• Authenticate the owner and isolate each business tenant.
• Store, display, update, and complete callback reminders.
• Create customer-message drafts and enforce the owner-approval queue.
• Connect an owner-selected provider using only the permissions shown during authorization, test the connection, and display its status.
• Validate provider webhooks, prevent duplicate events, investigate abuse, and maintain security.
• Respond to support, access, export, correction, and deletion requests.
• Meet legal obligations and enforce our agreements.

The current product does not use customer content for advertising or train an AI model on customer content.

4. When information is disclosed

We disclose information only to service providers needed to run GridHand, to the participating business that supplied the information, when a person directs us to, or when legally required. The current provider list is maintained on our subprocessors page. We do not sell personal information or share it for cross-context behavioral advertising.

5. Customer messages

A draft in GridHand does not establish that a customer consented to receive it. The participating business must have the legally required consent and honor opt-outs before approving a message. See the SMS terms.

6. Retention and deletion

We keep information while the pilot account is active and as reasonably needed for the workflow, security, dispute resolution, and legal obligations. Deleting a tenant removes its stored provider credentials from the GridHand vault. A provider may keep its own grant, security, or API records under its terms, so disconnecting or deleting GridHand data may also require a provider-side request. Verified requests may be submitted at /privacy/request. We may retain limited audit, fraud-prevention, backup, or legal records after operational data is deleted when permitted or required.

7. Security

GridHand uses encrypted transport, server-side secrets, authenticated access, tenant-scoped database rules, provider-signature validation, and fail-closed message approval controls. No security method is perfect; please report concerns to security@gridhand.ai.

8. Your choices and rights

Depending on where you live, you may have rights to know, access, correct, export, delete, or restrict certain processing, and to appeal a decision. We honor Global Privacy Control signals for applicable website opt-out rights. We will verify requests before disclosing or deleting information.

9. Children

GridHand is a business service and is not directed to children under 13. Do not enter children's personal information into the pilot unless it is lawful and necessary for the participating business.

10. Changes and contact

We may update this policy when the product or law changes. Material changes will be dated here and communicated when required. Contact privacy@gridhand.ai or GridHand AI LLC, Milwaukee, Wisconsin.