Privacy Policy

• Account information — your name, email address, and the settings used to sign in and secure your account, such as enrolled authentication factors. Sign-in credentials themselves are handled by our identity provider.
• Organization information— your organization’s name, profile, locations, members, and roles.
• Deal and contract records — the offers, contracts, deliveries, quantities, prices, terms, notes, and workflow history you and your counterparties create in the workspace.
• Documents — files you upload, such as specifications, contracts, and delivery tickets, together with their metadata.
• Communications — messages and notifications sent through the workspace, and the support requests you send us.
• Usage and technical information — log and device data such as IP address, browser type, pages viewed, and actions taken, used to operate, secure, and improve the service.

We use the information we collect to:

• provide, maintain, and improve the service and its features;
• authenticate you, secure your account, and enforce our Terms;
• coordinate deals between you and the organizations you choose to share with;
• send service, security, and notification messages by email or SMS, according to your and your organization’s settings;
• monitor performance, diagnose problems, and prevent fraud and abuse;
• comply with legal obligations and enforce our agreements.

We do not sell your personal information, and we do not use your deal records, documents, or messages for advertising.

With counterparties. When you share a record, document, or message with another organization as part of a deal, the information you share becomes visible to that organization and its authorized members. Quantities, prices, locations, and notes stay within your organization until you choose to share them.

With service providers. We use trusted providers to run Grain. They process information only to provide services to us and are bound by confidentiality and data-protection obligations:

• Vercel — application hosting and privacy-friendly, cookieless web analytics.
• Neon — managed database hosting.
• Clerk — authentication and identity.
• Novu — notification workflows, preferences, and the in-app notification inbox.
• Resend — notification email, delivered through Novu.
• Sentry — error monitoring and diagnostics.
• DocuSign — electronic signature for documents you choose to sign.
• Mapbox — maps and location display.

For legal and safety reasons. We may disclose information if required by law, to respond to lawful requests, or to protect the rights, property, or safety of Grain, our users, or the public.

Business transfers. If Grain is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

We use Vercel Web Analytics to understand aggregate usage, such as which pages are viewed. It is privacy-friendly and cookieless: it does not set cookies, does not track you across other sites, and does not build advertising profiles. Our error monitoring is configured to avoid collecting the contents of your records, documents, or messages.

We keep information for as long as your account and organization are active and as needed to provide the service. Deal records and documents are retained while they are part of an active workspace and shared record. When you or your organization delete content or close an account, we delete or de-identify the associated information within a reasonable period — except where we must retain it to comply with legal, accounting, audit, or security obligations, or to resolve disputes.

We protect information with measures including encryption in transit, access controls, tenant isolation between organizations, and audit logging of sensitive actions. We require additional authentication factors for privileged access. No method of transmission or storage is completely secure, but we work to protect your information and to promptly address issues we identify.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can update much of your account and organization information directly in the workspace, and you can adjust your notification email and SMS preferences in your settings.

For other requests, contact us and we will respond as required by applicable law. Because much of the information in Grain belongs to your organization, some requests may be directed to your organization’s administrators.

Grain is operated using providers that may process and store information in the United States and other countries. Where information is transferred across borders, we rely on appropriate safeguards as required by applicable law.

Grain is a workspace for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18.

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice.

Questions about this Policy or your information? Contact us at support@grainwave.com. You can also review our Terms of Service.