Privacy notice

Draft for review before the first paying customer. Last updated 4 September 2026. Controller: [the founder's full name], trading as Gridwyn, France. Contact: hello@gridwyn.co.uk.

What we collect

• Account data: your email address, name, organisation and role, to sign you in and deliver the service. Sign-in uses one-time links; we store no passwords.
• Usage data: sign-in times, pages requested, API calls made with your organisation's keys, and emails sent to you with their delivery status. There is no third-party analytics and no advertising tracking.
• Billing data: your organisation's billing address and VAT number, processed by Stripe. Card details never reach us.
• Reviewer activity (staff only): decisions taken in the review queue, attributed to the reviewer.

Why, and on what basis

To perform the contract with your organisation (delivering the digest, feed and API), to meet legal obligations (invoicing, tax), and for our legitimate interest in keeping the service secure and improving it. We do not sell or share personal data for marketing.

Who processes it for us

• Hetzner Online GmbH (Germany): hosting and storage.
• Postmark (ActiveCampaign, United States): transactional and digest email.
• Stripe Payments Europe: subscriptions, invoices and tax.
• Anthropic: processing of public regulatory documents for extraction. No personal data about subscribers is sent to it.

Transfers outside the EU and UK rely on the providers' standard contractual clauses or adequacy decisions.

Retention

Account and usage data for the life of the subscription and 12 months after; invoicing records for the period French law requires (10 years). Public regulatory documents and the records derived from them are retained indefinitely: they are the product.

Your rights

Access, rectification, erasure, restriction, portability and objection, under the GDPR and the UK GDPR. Write to hello@gridwyn.co.uk. You may complain to the CNIL (France) or the ICO (United Kingdom).

Cookies

One session cookie, set when you sign in, strictly necessary for the service. Nothing else.