Privacy Policy

1. Who we are

This Privacy Policy ("Policy") explains how GRIDPEERS INC. ("Gridpeers", "we", "us", or "our"), a corporation incorporated under the laws of the Province of Nova Scotia, Canada, with registered address at 87 Millbrook Avenue, Unit 101, Cole Harbour, NS B2V 0A1, collects, uses, discloses, and otherwise processes personal information in connection with the Gridpeers websites, applications, and related services (the "Platform" or "Services").

For privacy purposes, GRIDPEERS INC. is the organization responsible for personal information processed under this Policy (the controller, where that term applies).

Privacy-accountable person: Privacy Officer, GRIDPEERS INC.. Contact: privacy@gridpeers.com. Legal inquiries: legal@gridpeers.com.

Use of the Platform is also governed by our Terms of Service. Capitalized terms used but not defined here have the meanings in the Terms where the context fits.

2. Scope

This Policy applies to personal information we process when you visit or use the Platform, create an account, communicate with us, submit a legal or privacy report, or otherwise interact with Gridpeers as a visitor or member.

It does not apply to third-party websites or services we do not control, including payment processors' own pages, linked external sites, or tools you choose to use outside Gridpeers. Those parties process information under their own policies.

3. Personal information we collect

Depending on how you use the Platform, we may collect:

• Account and identity data: email address, username/handle, display name, password or authentication credentials (handled via our auth provider), account tier, preferences, and locations or regions you provide.
• Profile and organization data: public profile fields, photos or logos you upload, company or institution profile information you choose to publish, and professional details you add.
• User content: posts, listings, comments, messages, tags, uploads, reports, and other content you create or transmit on the Platform. Where you use anonymous posting features, other members may not see your identity on that post, but the content remains associated with your account for operation, safety, and legal compliance. We do not solicit or structure special-category (sensitive) personal data as product fields. User Content may nonetheless include information users choose to provide, including information that may be sensitive under applicable law. We do not use such content for special-category profiling or advertising.
• Usage, device, and technical data: pages and features viewed, approximate timestamps, device/browser type, referring surfaces, IP address, and derived country or region (including from IP or edge headers) for security, abuse prevention, and geo/sanctions compliance.
• Analytics and visit data: engagement and visitor-related metrics for content and profiles, including (where offered) identifiers of logged-in members who viewed another member's content or profile. See Section 7.
• Compliance and enforcement data: IP-derived or edge-derived country / region signals used for geo and sanctions controls, enforcement and moderation records, administrative audit records, and legal-intake submissions.
• Payment and billing metadata: customer and subscription identifiers, plan, status, and transaction metadata from our payment processor. We do not store full payment-card numbers on Gridpeers systems; card data is handled by the processor.
• Communications: emails and messages you send to privacy, legal, or support contacts, and transactional notifications we send you.
• Cookies and similar technologies: as described in Section 13.

We collect information directly from you, automatically when you use the Platform, from other users when they interact with your public content or you interact with theirs, and from service providers that process data on our behalf.

4. Purposes of use

We use personal information to:

• Provide, operate, secure, and improve the Platform and its features.
• Create and administer accounts, authenticate users, and personalize experience.
• Host, display, distribute, and operate User Content as described in the Terms.
• Enable paid features, process payments and subscriptions, and manage billing-related records.
• Provide analytics and insights to eligible account owners about their own content and profile traffic (Section 7).
• Send transactional and service messages (for example authentication, security, billing, and product notices required to operate the account).
• Enforce the Terms, prevent fraud and abuse, moderate content, and operate legal intake and internal workflows. Where reasonably necessary for abuse investigation, legal compliance, security, sanctions or export review, support, or platform integrity, authorized Gridpeers personnel may access otherwise private areas (such as private team spaces or direct messages) and may keep records of such access. This does not create a duty to access or review private content.
• Comply with law, respond to lawful requests, and manage geo-restriction, sanctions, and export-control related controls.
• Investigate security incidents and support breach containment and notification where required.
• Communicate about material changes to this Policy or the Terms where appropriate.

We do not sell personal information as a standalone data product, and we do not use personal information for third-party advertising networks. Where we offer licensed machine access to information you choose to make public on the Platform (through documented Gridpeers APIs), that access is described in the product and any applicable licence terms. If we introduce commercial marketing email, we will do so only with an appropriate consent or other valid basis under applicable law (including CASL where it applies) and will describe that practice here.

5. Legal bases (where GDPR / UK GDPR or similar apply)

If you are in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction that requires a stated legal basis, we process personal information where one or more of the following applies (as relevant to the processing):

• Contract: processing needed to provide the Services you request (account, Platform features, paid subscriptions).
• Legitimate interests: operating a professional networking Platform; security, fraud prevention, and integrity; product improvement; providing owners with analytics about visits to their own content where we do not rely on consent for that processing; and similar interests that are not overridden by your interests or fundamental rights in the circumstances.
• Legal obligation: compliance with applicable law, including responding to lawful requests and retaining records where required.
• Consent: where we rely on consent (for example optional visit and named-viewer analytics in EEA/UK, Québec, and other configured consent regions, or certain non-essential cookies or marketing communications if introduced). You may withdraw consent where consent is the basis, without affecting prior lawful processing.

For Canadian users, we process personal information for the purposes identified in this Policy and with meaningful consent or other bases permitted under applicable Canadian privacy law, including PIPEDA-style accountability and openness expectations.

6. Recipients and service providers

6.1 Categories of recipients

We may disclose personal information to:

• Service providers (subprocessors) that host, store, authenticate, send email, process payments, stream media, monitor errors, or provide AI-assisted processing on our instructions.
• Other members and the public for information you choose to make public (profile, posts, listings, and similar). When public browse is enabled, visitors without an account may read that public information on Field Feed, Solutions, and eligible detail pages; participation features still require a verified account.
• Licensed API customers who, where we offer External API access, retrieve public profile and content metadata through documented Gridpeers APIs under the access terms shown for that licence (not for third-party model training under this Policy).
• Content and profile owners when named-viewer or similar analytics features apply (Section 7)—typically limited to owners viewing traffic on their own property.
• Professional advisors (such as lawyers or accountants) under confidentiality where needed.
• Data protection representatives we appoint for certain jurisdictions (see Section 12.3), so they can receive and forward relevant requests.
• Authorities and counterparties when required by law, legal process, or to protect rights, safety, and the Platform.
• Successors in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.

6.2 Service providers

We use third-party service providers to help operate the Platform (for example hosting, storage, authentication, email delivery, payments, media delivery, error monitoring, and AI-assisted processing when those features are enabled). Where AI-assisted features are enabled, limited content needed for that feature (for example text submitted for classification, tagging, or summarization) may be processed by an AI provider on our instructions to operate the feature; we do not grant an unrelated AI-training licence for User Content beyond that operational processing. Providers and subprocessors may change over time. Where required, we use contractual or other means appropriate to their role to provide a comparable level of protection for personal information they process for us. Material changes to how we use service providers for personal information will be reflected in this Policy.

7. Analytics and named viewers

Depending on account type, tier, feature availability, configuration, and applicable privacy rules, Gridpeers may provide analytics to paid account owners about traffic to their own listings, posts, profile, tags, and related surfaces.

• Named viewers: where offered, owners may see logged-in Gridpeers members who viewed their content or public profile (for example username/display name and a profile link when available).
• Guests: guest or logged-out browsing is counted in aggregates where applicable but is not shown as a named individual in named-viewer lists.
• Scope: owners see visitors to their own property only. There is no site-wide directory of who viewed whom.
• Lookback windows: how far back named lists and analytics charts go depends on plan and product configuration. Exact windows, presets, and availability are shown in the product interface and may change.
• Audience breakdowns: higher tiers may receive aggregate breakdowns (for example device, country, or entry surface) as shown in the product. We do not claim that every aggregate is anonymous in all circumstances.
• Bot filtering: we attempt to exclude bots where technically applied; we do not promise perfect detection.
• Opt-out / consent: In EEA/UK, Québec, and other configured consent regions, optional visit and named-viewer analytics require your prior choice (banner or Personal data settings) and are not activated merely because you failed to opt out. Outside those regions, the Platform's configured default may allow optional analytics unless you Reject them under Personal data settings (you can Allow again later). If you do not want an owner to see that you visited and you have not rejected optional analytics, do not view that content while logged in. Owners may see thinner named lists when viewers decline optional analytics.
• CSV exports: eligible owners may download report files (for example Listings, Visitors, Marketing, and Traffic reports). Owners are responsible for using exported data lawfully and for securing files they download.

By using the Platform while logged in, you understand that owners of content or profiles you view may receive analytics that identify your member account as a visitor, subject to the consent, settings, and other limits described above and in the Terms.

8. Retention

We retain personal information only as long as needed for the purposes described in this Policy, including:

• Account and content: while your account is active and thereafter as needed to complete deletion workflows, resolve disputes, enforce Terms, or meet legal requirements. Deletion may not remove content from every backup or system instantly, and content already shared with others may remain visible to them.
• Analytics events and named-viewer history: generally aligned with product lookback and retention configuration (including profile-visit windows). Aggregated or de-identified analytics may be kept longer.
• Legal intake, moderation, and audit logs: longer where needed for compliance, security, dispute resolution, or legal obligation.
• Billing records: as needed for accounting, tax, chargeback, and legal requirements.

Specific day counts in the product (lookbacks, purge schedules) may change; this Policy describes principles rather than a fixed operational schedule for every table.

9. International transfers

Gridpeers is operated from Canada and targets global professional use. Personal information may be processed in Canada, the United States, and other countries where our service providers operate. Those countries may have privacy laws different from yours.

Where required by applicable law, we use appropriate safeguards for cross-border transfers (for example contractual protections with providers). By using the Platform, you understand that your information may be transferred internationally as described here.

We may also use IP address, country headers, and related signals to enforce geographic, sanctions, and export-control related restrictions as described in the Terms.

10. Security

We implement technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration, appropriate to the nature of the data and our operations (including access controls, encryption in transit where appropriate, and administrative audit practices). No method of transmission or storage is completely secure. We do not warrant absolute security.

You are responsible for safeguarding your credentials and for configuring devices and exports you control.

11. Security incidents and breach response

If we become aware of a security incident affecting personal information, we will investigate and take steps we consider appropriate to contain and remediate the issue.

Where applicable law requires notification to individuals or regulators, we will provide notice as required. This Policy does not create contractual notification timelines beyond those legal duties.

12. Your rights and choices

Depending on your location and applicable law, you may have rights to access, correct, delete, or obtain a portable copy of personal information, and (where applicable) to object to or restrict certain processing, withdraw consent, or lodge a complaint with a regulator. We may need to verify your identity before acting on a privacy request.

12.1 In-product paths

• Download your personal data (JSON export for signed-in members).
• Delete your account.
• Submit a privacy report about content or privacy concerns on Gridpeers (no login required). For routine abuse such as spam or harassment, use in-app Report controls where available.
• Contact privacy@gridpeers.com for access, correction, objection, restriction, or other privacy requests where the law provides those rights and the in-product tools are not sufficient.

Export scope today: account identity, profile fields, activity summaries and counts, and related pointers. It does not currently include full post/comment/DM body text, payment-card or full Stripe objects, Pro/Power/Enterprise analytics CSV files, other users' personal data, or raw server/access logs. Scope may expand over time; we describe what the export contains when you download it. This self-service export is a convenience feature and does not limit any broader access or portability rights you may have under applicable law. For those requests, contact us using the methods in this Section 12.

12.2 Complaints

If you have a privacy concern, contact us first at privacy@gridpeers.com. We will handle privacy complaints in accordance with applicable law.

You may also have the right to complain to a supervisory authority. In Canada, that may include the Office of the Privacy Commissioner of Canada (and, where applicable, a provincial privacy commissioner). In the EEA or UK, you may complain to your local data protection authority. In Switzerland, that may include the Federal Data Protection and Information Commissioner (FDPIC), where applicable.

12.3 Data protection representatives

GRIDPEERS INC. is established in Canada. We have appointed an external data protection representative for the EEA, the United Kingdom, and Switzerland. That representative is not our data protection officer and is not a general customer-support or billing channel.

Please use the contacts below only if you are an individual or a competent authority in the EEA, the United Kingdom, and Switzerland, and only for matters relating to our processing of personal data under the GDPR, UK GDPR, and Swiss FADP (as applicable). For other privacy questions, contact us first at privacy@gridpeers.com.

Representative: Data Protection Representative Limited (trading as DataRep). Online form: www.datarep.com/data-request. Email: datarequest@datarep.com (please quote "Gridpeers Inc" in the subject line, as requested by the representative). If you write by post, address the envelope to "DataRep" (not Gridpeers) and clearly identify GRIDPEERS INC. in the correspondence.

EEA (GDPR Art. 27) postal address: 77 Camden Street Lower, Dublin, D02 XE80, Ireland.

United Kingdom (UK GDPR) postal address: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom.

Switzerland (FADP) postal address: DataRep, Leutschenbachstrasse 95, Zurich, 8050, Switzerland.

Additional local postal locations may be available from the representative. We do not publish a response-time commitment for requests routed through the representative.

13. Cookies and similar technologies

Gridpeers primarily uses browser local storage and session storage on our domain rather than first-party HTTP cookies for authentication. As of our current product inventory, we do not set first-party marketing or advertising cookies, and we do not load third-party advertising, tag-manager, or marketing-pixel scripts in the web app.

13.1 What we store in your browser

• Authentication (local storage): access and refresh tokens and related expiry/lock keys so you stay signed in securely. Cleared on sign-out or when credentials are invalidated; browser local storage is not automatically cleared merely because a browsing session ends.
• Preferences and drafts (local / session storage): for example theme preference, onboarding tag drafts, field-composer prefill, and short-lived auth or verification UX signals.
• Analytics consent preference (local storage): where you choose Allow or Reject for optional analytics, we may store that preference locally so it can apply before or without an account sync.
• First-party analytics session (session storage): an anonymous session identifier used with our own APIs to support visit and engagement analytics for eligible owners (Section 7), including deduplicating events in a browser tab. This is Platform functionality, not a third-party ad tracker.

13.2 Third parties

• Payments: paid checkout and billing portal flows redirect to our payment processor. That processor may set cookies on its domains under its own policies.
• Error monitoring: when enabled, our error-monitoring provider may use SDK storage or cookies for reliability and performance diagnostics. It is not used for advertising.
• Hosting / edge: infrastructure providers may set operational cookies or use network headers (for example approximate country) for security and delivery. We do not use those mechanisms as an advertising profile.

Transactional email is sent server-side; the web app does not embed marketing email open pixels.

13.3 Consent controls

Essential authentication and security-related storage is always active and is not offered as a disable toggle. Optional visit analytics (including the first-party analytics session identifier and named-viewer related recording) requires prior opt-in where our configured consent regions apply (EEA/UK and Québec by default). You can Allow or Reject analytics in the banner when shown, or later under Settings → Personal data. Refusal is as easy as acceptance. If you reject optional analytics, we do not use that path to create owner-facing named-viewer analytics for your visits going forward. This is not an advertising cookie preference center; we do not operate an advertising cookie program.

14. Children

The Platform is intended for professionals and is not directed to children under 18. We do not knowingly collect personal information from children under 18. If you believe we have collected such information, contact privacy@gridpeers.com and we will take appropriate steps to delete it.

15. Changes to this Policy

We may update this Policy from time to time. When we publish changes, we will update the effective date below. For material changes, we may provide additional notice through the Platform or by email where appropriate. Continued use after the effective date of an updated Policy constitutes acceptance where permitted by law; where law requires a different form of consent or acceptance, we will follow that requirement.

See also our Terms of Service and Legal hub.

16. Contact

Privacy: privacy@gridpeers.com
Legal: legal@gridpeers.com
Mail: GRIDPEERS INC., 87 Millbrook Avenue, Unit 101, Cole Harbour, NS B2V 0A1
Data protection representative contacts: see Section 12.3.