Privacy
Policy.

Controller and scope

This Privacy Policy explains how personal data is processed in connection with the Grip website, application, APIs and Model Context Protocol interface (the “Service”). It is information provided under Articles 13 and 14 of the General Data Protection Regulation (“GDPR”); it is not a request for blanket consent.

The controller for account administration, authentication, Service security, the waitlist, support and our own business operations is 6S Jakub Sadowski, a sole trader established in Poland. No Data Protection Officer has been appointed. Privacy requests can be sent to contact@grip.do.

The details are collapsed to reduce unnecessary exposure of a residential business address. They remain directly accessible without creating an account or running JavaScript.

Our privacy roles

For account, security, waitlist and support data, we decide why and how the data is processed and act as the controller.

When a user or organization places personal data about other people in notes, files, conversations or Company and My work spaces and decides the purpose of that use, that user or organization is normally the controller and Grip processes the content on its instructions. The user or organization is responsible for having a lawful basis, providing required notices and respecting the rights of those people.

No standard Data Processing Agreement is currently published for the private release. An organization that needs an Article 28 GDPR agreement should contact us and should not place personal data requiring such an agreement in Grip until one has been agreed.

Data we process

Depending on how you use Grip, we may process:

• Account data: email address, display name, job title, avatar, account identifiers, sign-in and multi-factor authentication records, preferences and suspension status.
• Organization data: organization name and profile, membership, role, invitation and join-request details, former-member status and administrator actions.
• Knowledge and collaboration content: spaces, folders, notes, titles, bodies, properties, tags, comments, versions, conversations, messages, reactions, templates and relationships.
• Inbox and import data: text, links, fetched webpage content, PDFs, text files, file metadata, import source and processing status.
• Agent and connection data: connection names, permissions, token prefixes and hashes, creation and last-use times, OAuth client and grant records, context sets, sessions and agent activity.
• Sharing data: the folders shared, destination space, access mode, who shared them and revocation details.
• Waitlist and email data: email address, subscription status, signup time, invitations and the delivery metadata handled by our email providers.
• Technical and security data: IP address, request time, host, browser or client information, rate-limit events, authentication events and server logs created by Grip or its infrastructure providers.
• Communications: messages, requests and feedback sent to us, together with related contact details and metadata.

The Service is not intended for payment-card data, government identification numbers, children’s data or special-category data such as health, biometric, political, religious or sexual-life information. Do not place such data in Grip unless you have confirmed that doing so is lawful and appropriate for the current release.

Where data comes from

Most data comes directly from you when you join the waitlist, sign in, create content, import a file, connect an agent or contact us.

Organization administrators and other members may provide your email address when inviting you, assign a role, create membership records, mention you or add information about you to organization content. External agents acting with a user’s authorization may read or write content through MCP.

Our hosting, authentication, email and security providers generate technical records when a browser, app or agent connects. When you save a public web link, Grip may retrieve the page from its server and store readable text from it.

Purposes and legal bases

• Provide the Service: create and authenticate accounts, store content, manage organizations, export data and run requested features. Basis: performance of a contract or steps requested before entering one—Article 6(1)(b) GDPR.
• Operate agents and sharing: apply your permissions, issue and revoke connection credentials, record agent actions and transfer selected content to a destination you authorize. Basis: contract performance—Article 6(1)(b).
• Manage invitations: send and administer organization or early-access invitations, including for people who do not yet have an account. Basis: contract performance where applicable and our legitimate interest in securely administering access—Article 6(1)(f).
• Protect the Service: prevent abuse, rate-limit requests, investigate incidents, maintain audit records and establish or defend claims. Basis: our legitimate interests in security and integrity—Article 6(1)(f).
• Support and essential notices: answer requests and send account, invitation, legal or security messages. Basis: contract performance, legal obligations and legitimate interests—Articles 6(1)(b), 6(1)(c) and 6(1)(f), as applicable.
• Waitlist and product email: keep your address on the waitlist and send early-access or product updates. Basis: your consent—Article 6(1)(a). You can withdraw it at any time without affecting earlier lawful processing.
• Legal compliance: respond to lawful requests and meet obligations under applicable law. Basis: legal obligation—Article 6(1)(c).

Grip does not currently use account or content data for advertising, behavioural profiling or training an AI model operated by Grip.

Workspaces, organizations and agents

Your Personal workspace is separate from organizations. My work and Company content belongs to the relevant organization’s environment and is available according to membership, role, folder sharing and access settings. When a membership ends, that person loses access, but their My work space remains archived for the organization and may be opened by its owners.

A connected agent can access only what its user and token permissions allow, including whether Personal content is included and whether a note is visible to agents. Grip records agent actions associated with the account. Token secrets are shown once; Grip stores their cryptographic hashes and identifying prefixes.

When you authorize ChatGPT, Claude, Codex, Cursor or another external client to receive content, that provider processes the content under its own terms and privacy rules. It is selected by the user and is not automatically a Grip subprocessor. Revoking a connection stops future access but does not delete copies already received by the external provider.

Recipients and service providers

We do not sell or rent personal data. Data is disclosed only where needed for the Service, according to access settings, at your direction, or when required by law. Current main providers are:

• Supabase: account authentication, PostgreSQL database and private file storage. The production project is configured in Ireland.
• Vercel: hosting for the public website and application, server functions, delivery network and operational request logs. Application functions are configured in Dublin.
• Resend: sign-in, invitation and Service email delivery, and storage of waitlist contacts. Grip’s sending region is configured in Ireland.
• Cloudflare: DNS and security services, rate limiting where enabled, and Turnstile bot protection on waitlist and sign-in forms.

Other recipients can include organization members and administrators, people given shared access, external clients you connect, professional advisers, and public authorities where disclosure is legally required.

Processing locations and transfers

Grip’s production database, authentication and file project are configured in Ireland, and the application’s server functions are configured in Dublin. This does not make the Service “EU-only”. Providers operate global infrastructure and may process or permit access from countries outside the European Economic Area, including the United States.

Where GDPR Chapter V requires a transfer safeguard, we rely on the mechanism available under the applicable provider agreement, such as an adequacy decision or the European Commission’s Standard Contractual Clauses. The exact mechanism depends on the provider, service plan and data route. You may request information about the safeguards applicable to your data at contact@grip.do.

An external destination selected by you may be located anywhere. You are responsible for assessing that destination and any transfer it causes.

Retention and deletion

Account and workspace data is generally kept while the account or relevant organization is active. Notes placed in Trash are kept for the period selected in account settings—30 days by default, configurable between 7 and 365 days—and can be permanently removed sooner by emptying Trash.

Organization membership and My work data may remain after a person leaves because the organization retains its work content. Invitation links normally expire after 7 days, although related membership, invitation or audit records may remain where needed to administer access and handle security or disputes.

Waitlist data is kept until you withdraw consent, unsubscribe, or the waitlist is closed. We may retain a minimal suppression record so that an opt-out is respected. Support, security and administrative records are retained for as long as reasonably needed for the issue, security, legal obligations or claims.

Account closure and deletion are currently handled manually through contact@grip.do. Grip does not yet have an automated full-account purge or a complete category-by-category retention schedule, so we do not promise a fixed technical deletion period. We will assess each verified request without undue delay and explain any data that must remain. Provider logs and backups may persist for their normal limited lifecycle after production data is removed.

Security

Measures currently used include HTTPS, passwordless email authentication, optional TOTP, restricted production secrets, application and database access controls, row-level database policies, private file storage, hashed agent credentials, rate limits and security headers.

Note titles and bodies, comments and note versions are encrypted by the application before storage in the production database. The Grip server can decrypt them to provide search, sharing and agent access; this is not end-to-end encryption. Fields, tags, folder names, Inbox content, conversations and uploaded files are not covered by that application-level note encryption.

No system can guarantee absolute security. If you believe data or an account has been compromised, contact us promptly at contact@grip.do.

The current controls and limitations are described in more detail on the Security page.

Cookies and local storage

The application uses essential authentication cookies managed through Supabase to keep you signed in and protect sessions. Cloudflare Turnstile may use browser signals, cookies or similar storage to distinguish people from automated traffic on protected forms.

Grip also stores interface preferences locally in your browser, including theme, layout, panel, editor and onboarding choices. Some temporary editing and undo state uses session storage. These browser-only preferences are not advertising trackers.

The public site and application do not currently run Google Analytics, advertising pixels, session replay or behavioural marketing trackers. Infrastructure providers still process ordinary request logs. If non-essential analytics or marketing technology is added, this policy and the consent interface will be updated before it is activated where consent is required.

Your data protection rights

Subject to the conditions in GDPR, you may request access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time.

Send a request to contact@grip.do. We may ask for information needed to verify that the request concerns you. We will respond without undue delay and normally within one month; GDPR permits an extension for complex or numerous requests.

You may lodge a complaint with the supervisory authority in your country. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych): uodo.gov.pl.

Children and automated decisions

Grip is intended for people aged 18 or older. We do not knowingly offer accounts to children. If you believe a child has provided personal data through the Service, contact us so we can investigate.

Grip does not currently make decisions based solely on automated processing that produce legal or similarly significant effects, and it does not perform behavioural profiling for advertising.

Changes and contact

We may update this policy when the Service, providers or law changes. The version and effective date will be shown on this page. If a change materially affects how registered users’ personal data is processed, we will provide notice by email or in the Service before it takes effect where practical or legally required.

Privacy questions and requests can be sent in English or Polish to contact@grip.do. The Terms of Service govern use of Grip.