How Grein collects, uses, shares, and protects personal information.
Effective date: 9 October 2026
This Privacy Policy explains how the operator of Grein, an unincorporated software service operated from Ghana (“Grein”, “we”, “us”, or “our”), handles personal data when you use the Grein website, applications, workspaces, collaboration tools, AI features, support channels, and related services.
This policy is intended to support compliance with applicable privacy and data-protection law, including Ghana’s Data Protection Act, 2012 (Act 843), and, where applicable, the EU General Data Protection Regulation (“GDPR”).
1. Who is responsible for your data
For personal data Grein determines how and why to process, Grein acts as the data controller. In some business or team arrangements, Grein may process certain workspace content on behalf of a customer acting as controller. The roles depend on the context and applicable law.
Grein is currently operated as an unincorporated service from Ghana. For personal data for which Grein determines the purposes and means of processing, the Grein operator acts as the data controller. Privacy and data-protection enquiries may be sent to [email protected].
2. Information we collect
Account and profile information
We collect account and profile information such as your name, email address, avatar, authentication identifiers, plan status, and account settings. Grein uses a custom JWT-based authentication system and supports Google authentication.
Workspace and collaboration information
We process information needed to operate projects, boards, comments, invitations, permissions, collaboration presence, activity history, public sharing, and similar workspace features. Workspace content may include personal data depending on what users choose to add.
AI interaction data
When you use Grein AI, we process your prompt and the canvas context made available to the assistant, including blocks on the canvas where the AI is called and, where relevant to the requested task, text, images, uploaded files, links, and other canvas content. AI features may return responses and may take supported actions on the canvas, including creating, moving, editing, or deleting blocks. When a request needs it, AI features may also open links and documents that are on the canvas or in your message, follow links from those pages, and search the web. Peek, the optional thinking partner, may open links on the canvas when its suggestion depends on them.
Billing information
Paid subscriptions are processed through Paystack. Grein does not need to store full payment-card details in order to operate subscriptions. We may receive transaction identifiers, billing status, plan details, payment status, country or tax-related information, and other limited payment metadata needed to administer your subscription. Paystack handles payment processing and may handle applicable taxes or payment-related charges.
Device, log, and usage information
We may collect IP address, browser and device information, operating system, timestamps, diagnostic logs, feature usage, error information, and similar technical data used to operate, secure, troubleshoot, and understand the Service. Grein uses PostHog for product analytics and error-related diagnostic information. PostHog session recording is not enabled.
Support and communications
We process information you provide when you contact support, send feedback, participate in research, respond to surveys, or communicate with us.
3. How we use personal data
- Provide, maintain, synchronise, and secure the Service.
- Create and administer accounts, subscriptions, permissions, and collaboration features.
- Process payments and manage billing and plan entitlements.
- Operate AI features when you request them.
- Respond to support requests and communicate service-related information.
- Detect fraud, abuse, security incidents, and violations of our policies.
- Diagnose problems, measure performance, and improve Grein.
- Comply with legal obligations and enforce our agreements.
- Send marketing communications where permitted by law and subject to applicable opt-out rights.
4. Legal bases where GDPR applies
Where the GDPR applies, Grein relies on one or more legal bases depending on the processing: performance of a contract (to provide the Service), legitimate interests (such as security, service improvement, fraud prevention, and appropriate business operations), consent where required, and compliance with legal obligations. Where we rely on legitimate interests, we consider the effects on your rights and interests.
5. AI processing and third-party providers
Grein may use third-party AI infrastructure or model providers to process requests submitted through AI features. When necessary to fulfil a request, relevant prompt content and selected workspace context may be transmitted to those providers.
Grein’s AI features may use models hosted or selected by Grein, including through third-party AI infrastructure. To fulfil an AI request, Grein may transmit the user’s prompt and relevant canvas context to the applicable infrastructure provider and model provider. In supported Grein desktop experiences, users may also connect their own Claude or ChatGPT account and use models available through that account. Those requests are sent through the connected provider’s service and are subject to that provider’s privacy policy, retention practices, terms, and model availability. Grein does not receive or store the user’s Claude or ChatGPT password. Grein does not use User Content, prompts, AI responses, or other private workspace data to train its own models, and does not intentionally enable provider-side model training on Grein-controlled AI processing. Processing locations and provider retention may depend on the selected provider and can change over time; Grein therefore does not represent that AI processing occurs only in the EU.
When Grein's own AI opens a link or searches the web, Grein uses Jina AI (Jina AI GmbH, part of Elastic) to read the page or run the search. The address of the page, or the search query, is sent to Jina AI, which fetches the page and returns its text. If Jina AI is unavailable, Grein's servers fetch the page directly. Files uploaded to Grein are read by Grein's own servers, and are sent to Jina AI only when Grein can't read the file format itself (for example, older .doc, .xls, and .ppt files). Jina AI states that it does not use request data to train its models. When you use your own connected Claude or ChatGPT account in the desktop app, that assistant opens links and searches the web with its provider's own tools, under that provider's terms; those requests do not go through Jina AI.
Grein does not treat an AI response as a human decision about you. We do not intentionally use Grein’s general-purpose creative assistant to make solely automated decisions that produce legal or similarly significant effects about users.
6. When we share information
We may disclose personal data in the following circumstances:
- With collaborators and recipients you intentionally invite or share content with.
- With service providers that process data on Grein’s behalf or provide infrastructure needed to operate the Service: Contabo for server hosting, Cloudflare for file storage, Resend for transactional email, PostHog for analytics, Paystack for payments, OpenRouter and the AI model providers it routes requests to, and Jina AI for reading web pages and searching the web for AI features. When you connect your own Claude or ChatGPT account, the applicable provider receives the request through your connected account and processes it under its own terms and policies.
- With professional advisers where reasonably necessary and subject to confidentiality obligations.
- To comply with law, legal process, or valid governmental requests, or to protect rights, safety, and security.
- As part of a merger, acquisition, financing, reorganisation, bankruptcy, or sale of assets, subject to appropriate safeguards.
- With your consent or at your direction.
We do not sell personal data for money, and we do not use Grein user data for behavioural or cross-site retargeting advertising. We do not disclose personal data to advertising networks for cross-site behavioural advertising. This does not prevent Grein from using service providers that process data on our behalf to provide the Service.
7. Public and shared content
When you intentionally make a project public, anyone who receives the active share link may be able to view that project. Anonymous public visitors are provided view-only access and are not given editing, export, or other workspace actions through Grein. Public links can be revoked by the project owner. Because recipients may forward a link or independently capture information they can view, do not make confidential material public unless you accept that risk.
8. International data transfers
Grein’s primary application server, PostgreSQL database, and authentication infrastructure are hosted by Contabo in Germany, and uploaded files are stored with Cloudflare in Western Europe. Some service providers process personal data outside the European Economic Area: Resend (transactional email), PostHog (analytics), and OpenRouter (AI request routing) process data in the United States, and payment processing through Paystack, AI processing through underlying model providers, web reading and search through Jina AI, and connected-account providers may involve processing in other countries or regions. Where the GDPR applies to these transfers, we rely on the European Commission’s Standard Contractual Clauses, incorporated in our data processing agreements with those providers where available, or on another transfer mechanism recognised by law.
9. Data retention
We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including providing the Service, maintaining security and backups, resolving disputes, complying with legal obligations, and enforcing agreements. Retention periods vary by data type and context.
Retention depends on the type of data. When you delete your account, Grein soft-deletes the account and associated account data for up to 30 days to allow account recovery; you can recover it by signing back in during that period, and if you do not, the account data is permanently deleted from the active database. When you separately delete boards, uploaded files, or stored AI prompts and responses, Grein deletes those items from the active Service immediately. Login and security logs, analytics records, and payment records are not automatically deleted when an account is deleted and may be retained for security, fraud prevention, accounting, tax, legal, and service-analysis purposes for as long as reasonably necessary. Database backups may retain copies of deleted data for up to 14 days, after which they are deleted.
10. Security
We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, or disclosure. Grein uses HTTPS/TLS for data in transit, maintains database backups, and restricts access to production systems and user data to authorised persons. No system is completely secure, and we cannot guarantee absolute security. Users should protect their credentials and use appropriate sharing permissions.
11. Data breaches
If we identify a personal-data breach, we will investigate and take steps required by applicable law. Grein follows a written breach-response procedure covering containment, assessment, notification, and remediation. Where legally required, this may include notifying the Ghana Data Protection Commission or other competent authorities within applicable timeframes. Where the GDPR applies, we will notify the competent supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to your rights and freedoms, and we will inform affected individuals without undue delay where the breach is likely to result in a high risk to them. We keep a record of personal-data breaches and the steps taken in response.
12. Your privacy rights
Depending on where you live and the law that applies, you may have rights to request access to personal data, correction, deletion, restriction, objection, portability, withdrawal of consent, or information about processing. Grein also provides in-app account deletion and data-export functionality, under Settings > Profile. You may also have the right to complain to a data-protection authority.
We respond to rights requests within one month of receiving them. Where a request is complex or we receive many requests, we may extend this by up to two further months, and we will tell you if we do. We may need to verify your identity before acting on a rights request. Some rights are subject to legal exceptions, including where we must retain information to meet legal, security, or contractual obligations.
13. Children
Grein is intended for users aged 13 and older. We do not knowingly permit children under 13 to create accounts. Where local law requires parental or guardian consent for a user aged 13 or older to use the Service or consent to particular data processing, the user must have that consent. If you believe a child has provided personal data contrary to applicable law, contact us so we can investigate and take appropriate action.
14. Cookies and similar technologies
Grein uses cookies, local storage, and session storage for authentication, security, preferences, application functionality, and session management. Grein also uses PostHog for analytics. We do not use PostHog session recording and do not currently use behavioural-retargeting advertising technologies. Where consent is required for non-essential technologies, Grein uses a cookie-consent banner to request or manage that consent.
The specific cookies, local-storage entries, session-storage entries, and analytics identifiers used by Grein may change as the Service evolves. Grein does not currently use these technologies to sell personal data or conduct behavioural retargeting. You can use the available cookie controls to manage non-essential technologies where applicable.
15. Changes to this policy
We may update this Privacy Policy as our Service, technology, or legal obligations change. If an update materially changes how we process personal data, we will provide reasonable notice where required.
Contact
Questions, requests, or legal notices may be submitted through Grein Support: https://grein.studio/support
Grein is currently operated as an unincorporated software service from Ghana. Privacy, legal, and data-rights requests may be sent to [email protected]. Support is also available at https://grein.studio/support.