This policy explains how Cybentis Oy ("GrainQL", "we", "us") collects, uses and protects personal data when you use GrainQL, our analytics product, and our website at grainql.com (together, the "Services").
Cybentis Oy is a Finnish company, Business ID 3593125-1, PL 157, 00101 Helsinki, Finland. For privacy questions, write to privacy@grainql.com.
A shorter summary of the same facts is on our privacy page.
1. Who is responsible#
- For your GrainQL account and our website, we are the controller.
- For the analytics data the GrainQL tag collects on your website, you are the controller and we are your processor. Our data processing agreement covers that processing.
2. Data we collect#
2.1 Your account#
- Name and email address, to create and run your account.
- Workspace and team details, such as workspace names, website addresses and the roles of your teammates.
- Billing details, processed by Stripe, Shopify or AppSumo. We never see full card numbers.
- Sign-in data, handled by Auth0. If you sign in with Google or another provider, we receive your name, email address and profile picture.
2.2 How you use the dashboard#
- Pages you open and actions you take in the dashboard.
- Browser, device and operating system.
- IP addresses in security logs and in records of consent, export and deletion requests.
- Settings saved in your browser, such as layout choices and cached configuration.
2.3 Your website visitors#
When you install the GrainQL tag, it collects:
- The page path, without the query string, and the referrer.
- Campaign tags (UTM parameters).
- Device type, browser and operating system.
- Country, region, city and time zone, read from the request. The IP address is not stored with events.
- Clicks, with the position and up to 100 characters of the clicked element's text, and scroll depth.
- A pseudonymous visitor ID. Before consent it changes every day. After consent it stays the same across visits.
- After consent: screen and window size, browser language and time zone.
- Events, properties and user IDs your own code sends.
- If you turn on heatmap snapshots: one copy of each page's layout and text. Form fields are masked. Other text is kept as shown, unless you mark the element with the
grain-no-snapshotclass.
The tag sets no cookies. It saves a random key, the consent choice and, after consent, the visitor ID in the browser's local storage. Our Shopify integration sets one first-party cookie after consent.
What we receive depends on how you set up the tag. If you send names, email addresses or other personal data in events or identify calls, we process that data on your instructions.
2.4 Neo, our AI assistant#
When you use Neo, your questions, the query results Neo needs and Neo's answers are sent to an AI model through OpenRouter. Conversations are saved so you can return to them, and you can delete them in the dashboard. If you connect your own model key, the request goes to that provider under your account. We do not train AI models on your data.
During setup, Neo can open your public website in a cloud browser to suggest what to track.
3. How we use data#
| Purpose | Legal basis under the GDPR |
|---|---|
| Running the Services and your account | Contract, Art. 6(1)(b) |
| Billing and subscriptions | Contract, Art. 6(1)(b) |
| Service messages, such as billing or outage notices | Contract, Art. 6(1)(b) |
| Answering support requests | Contract, Art. 6(1)(b) |
| Running Neo and other AI features | Contract, Art. 6(1)(b) |
| Keeping the Services secure and stopping abuse | Legitimate interest, Art. 6(1)(f) |
| Improving the Services | Legitimate interest, Art. 6(1)(f) |
| Measuring our own advertising | Consent, Art. 6(1)(a), where the law requires it |
| Product news and marketing emails | Consent, Art. 6(1)(a) |
| Meeting legal duties | Legal obligation, Art. 6(1)(c) |
You can unsubscribe from marketing emails with the link in each email.
4. Our own website#
grainql.com uses cookies and browser storage to keep you signed in and to remember your settings. It also loads:
- Google Tag Manager and Google Ads, to measure our ads. For visitors in the EEA, the UK and Switzerland, Google tags start with consent denied.
- The Meta Pixel and the Meta Conversions API, to measure our ads. They do not run for visitors in the EEA, the UK and Switzerland, or when we cannot tell where a visitor is. Elsewhere, when you start or pay for a trial, we send Meta a hashed email address, your IP address and browser details.
- Featurebase, for support chat.
None of these run on your website through the GrainQL tag.
5. Who we share data with#
We do not sell personal data. We do not share it with advertisers, other than the ad measurement on our own website described in section 4.
These providers process data for us under data processing terms:
| Provider | What we use it for | Data it handles | Location |
|---|---|---|---|
| Hetzner | Servers for our APIs and databases, and event database backups | Analytics events, workspace and account data | Helsinki, Finland |
| Cloudflare | Network edge, TLS, DDoS protection, tag delivery, short links, the Shopify app, page snapshots and database backups | Visitor requests in transit, page snapshots, backups | Global edge |
| Vercel | Hosting for grainql.com and the dashboard | Dashboard sessions and requests in transit | Paris, Frankfurt, Washington, San Francisco and Hong Kong |
| Supabase | Neo conversations, memories, digests and reports | Chat messages and the answers Neo gives | Frankfurt, Germany |
| OpenRouter | Routes Neo requests to the model that answers them | Your question and the analytics results Neo works with | United States |
| Google (Gemini) | Models for Neo's Fast and Smart modes, through OpenRouter | Your question and the analytics results Neo works with | United States |
| Anthropic (Claude) | Model for Neo's Max mode and fallback, through OpenRouter | Your question and the analytics results Neo works with | United States |
| Groq | Autocomplete in the report editor | The report text you are writing | United States |
| OpenAI | Reads your public pages during setup | Content of your public website | United States |
| Browserbase | Cloud browser that opens your public pages for setup and audits | Content of your public website | United States |
| E2B | Sandbox where Neo runs calculations on query results | Aggregated query results | United States |
| Auth0 (Okta) | Sign-in and identity | Name, email address, sign-in history | European Union |
| Stripe | Card payments and invoices | Billing details. We never see full card numbers. | United States and EU |
| Shopify | Billing and data for stores that use the GrainQL Shopify app | Store details and order totals | Global |
| AppSumo | Lifetime deal licences | Email address and licence key | United States |
| Customer.io | Product and account emails | Email address and product events | European Union |
| Resend | Team invite emails | The invited person's email address | United States |
| Featurebase | Support chat | Messages, and the name and email address you give | European Union |
| Slack | Internal alerts, including new privacy and support requests | Name, email address and request details | United States |
| Better Stack | Application logs and error tracking | Server logs, which can include request details | United States |
| New Relic | Server monitoring | Metrics and logs of failed requests, which include IP addresses | European Union |
| Google Tag Manager and Google Ads | Measuring our own ads | Pages visited on grainql.com and ad clicks | United States |
| Meta Pixel and Conversions API | Measuring our own ads. Off for visitors in the EEA, the UK and Switzerland | Pages visited on grainql.com. When you start or pay for a trial: a hashed email address, IP address and browser details | United States |
We update this list when our providers change. The date at the top of this policy shows the last change.
6. Transfers outside the EU#
Analytics events are stored on our own servers in Helsinki, Finland, and their backups stay in Helsinki. Neo conversations are stored in Frankfurt, Germany.
Some providers are in the United States, as the table above shows. These include part of our dashboard hosting, the AI models behind Neo, support chat and our logging tools. For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses.
7. How long we keep data#
| Data | How long |
|---|---|
| Analytics events | Up to 2 years |
| Event database backups | 7 days |
| Other database backups | 14 days |
| Neo conversations | Until you delete them, or your account closes |
| Account data | While your account is open |
| Billing records | As long as accounting and tax law requires |
| Support messages | As long as we need them to support you |
| Server and security logs | Rotated on a schedule |
Retention limits by plan, and the retention setting in your workspace, are not enforced automatically yet. When you delete a workspace, it is hidden at once. To erase a workspace, a visitor or a date range for good, write to privacy@grainql.com and we delete it for you.
When a store uninstalls the GrainQL Shopify app, we delete its settings and order records from the app. Analytics events from the store stay until the store owner asks us to delete them.
8. Security#
- Analytics data is stored and backed up in ISO 27001 certified data centers in Finland.
- All connections are encrypted with TLS, and analytics backups are encrypted.
- Each workspace's data is kept separate, and every request is checked against it.
- Production systems are kept patched, monitored and open only to the people who run them.
- Passwords are handled by Auth0, and API keys are stored hashed.
Read the security page for more, and for how to report a problem.
9. Your rights#
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Correct data that is wrong or incomplete.
- Erase your data.
- Restrict how we process it.
- Move your data, in a machine-readable format.
- Object to processing based on legitimate interest.
- Withdraw consent at any time, where we rely on it.
Write to privacy@grainql.com or use the data request form. We answer within one month. If a request is complex, we can take two more months, and we tell you within the first month.
If you are a visitor to a website that uses GrainQL, that website's owner controls your analytics data. Contact them first. We help them answer your request.
You can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the authority in your own country.
10. US state privacy rights#
If you live in a US state with a privacy law, such as California, Colorado, Connecticut or Virginia, you can ask what personal information we hold, ask us to delete it, and use these rights without being treated differently. We do not sell personal information. Write to privacy@grainql.com.
11. Children#
The Services are not for people under 18. If we learn that we hold data from a child, we delete it.
12. Changes#
When we change this policy in a way that matters, we tell customers by email or in the dashboard at least 30 days before the change takes effect.
13. Contact#
Cybentis Oy Business ID 3593125-1 PL 157, 00101 Helsinki, Finland Phone: +358 41 725 0110
- Privacy: privacy@grainql.com
- Data requests: grainql.com/privacy/data-request
- Security: security@grainql.com
- Support: support@grainql.com