GRIDA Privacy Policy

Contact Information

If you create a GRIDA account or contact us, we may process:

• Name or nickname
• Email address
• Other contact information you choose to provide

Profile and Account Information

When you create or use a GRIDA account, we may process:

• User ID
• Username
• Profile image
• Profile settings
• User preferences
• Account settings
• Login and authentication information
• Other information you add to your profile

Communications Information

If you contact us or request customer support, we may process:

• Inquiry content
• Email or message content
• Customer-support records
• Attachments
• Error-related information
• Other information you provide

Rights-Infringement Complaints and Legal Requests

If a user, rights holder, or authorized representative submits a copyright infringement report, DMCA Notice, Counter-Notification, other rights complaint, or legal request, we may process:

• Name and contact information
• Address
• Company or organization information
• Copyright or other rights-related information
• Reported Content, URLs, Asset or Content identifiers, and GRIDA Copyright Case ID
• Electronic signatures and legal statements
• Original works, licenses, permissions, or other evidence of rights
• Attachments and supporting materials
• Communications relating to the complaint or legal request
• Other information reasonably necessary to handle the complaint, dispute, or legal obligation

Transaction Information

If you purchase paid GRIDA services, a Subscription, or Credits, we may process:

• Purchased product
• Plan
• Credits purchased
• Order number
• Transaction number
• Payment amount
• Payment date and time
• Payment status
• Subscription status
• Refund and cancellation records
• Subscription Upgrade or Downgrade records, Billing Cycle, and Billing Date
• Subscription Credit balance, unused value applied to an Upgrade, and payment adjustment amount

Payment Information

We use Stripe, Inc. and its affiliates (“Stripe”), together with other third-party payment service providers, to process payments, Subscriptions, Billing, refunds, Chargebacks, and related payment services.

Payment credentials such as full credit card numbers, debit card numbers, bank-account information, and other core payment-method details may be collected and processed directly by Stripe or another payment service provider. We may not receive or store those full payment credentials directly.

For payment and Subscription administration, we may receive from Stripe customer identifiers, limited payment-method identifiers, transaction IDs, payment amounts, transaction dates and times, payment status, refund and cancellation information, Chargeback information, and other transaction information reasonably necessary to provide and administer the Service.

Depending on the service and purpose of processing, Stripe may process personal information as a service provider or processor on our behalf and, in certain circumstances, as an independent controller of personal information. For more information about Stripe’s privacy practices, please review the Stripe Privacy Policy (https://stripe.com/privacy). If you use a separate consumer-facing service provided directly by Stripe, such as Link, additional terms applicable to that Stripe service may also apply.

Marketing Information

If you receive marketing or other communications from us, we may process:

• Marketing preferences
• Email delivery information
• Email-open or link-click information
• Campaign or promotion participation information

Multimedia Data You Share

When using GRIDA, you may upload or otherwise provide:

• Photos
• Images
• Videos
• Audio
• Reference Images
• Reference Videos
• Other media files

These files may include Metadata associated with creation, capture, or editing. Metadata may include file type, creation or modification time, size, technical information, and information you add to the content.

Query and Prompt Data

When you use AI features, we may process:

• Prompts
• Instructions
• Descriptions
• Requests
• Questions
• Messages
• Negative Prompts
• Prompt Enhance input
• Prompt Enhance output
• Other information entered in connection with AI generation

Generation settings may also include:

• AI Engine
• Model
• Resolution
• Quality
• Ratio
• Duration
• Number of generations
• Other AI generation parameters

Output and Generated Content

We may process content generated or edited through GRIDA, including:

• Images
• Videos
• Text
• Edited results
• Other generative AI Output
• Metadata associated with Output

Creative Choice Data

GRIDA may process user choices and actions that occur during the creative process, including:

• AI Engines used
• Generation and regeneration history
• Comparison of results from multiple AI Engines
• Selected results
• Likes or selections
• Prompt edits
• Content editing
• Image-to-video conversion
• Downloads
• Exports
• Project activity
• Asset usage
• Generation workflows
• Other usage behavior occurring during content creation

We refer to this information in this Privacy Policy as “Creative Choice Data.”

Feedback Information

If you provide feedback, we may process:

• Service ratings
• Survey responses
• Feature requests
• Bug reports
• User interviews
• Other feedback

Other Information You Provide

You may provide additional information through events, promotions, surveys, user research, or other activities.

Login and Authentication Services

If you sign in using Google or another external account, that service may provide information within the scope you authorize, such as:

• Name
• Email address
• Profile image
• External service user identifier

Available sign-in methods are shown in the GRIDA interface.

Connected External Services

If you connect cloud storage, social platforms, or other third-party services to GRIDA, we may receive information from those services within the scope you authorize.

Service Providers and Business Partners

We may receive information from service providers that support operation of GRIDA, including providers supporting payments, security, analytics, customer support, and other operational functions.

We, our service providers, or business partners may automatically collect information when you use GRIDA or our online services.

Device Data

• Operating system and version
• Device type
• Browser type and version
• Screen resolution
• Language settings
• IP address
• Device identifiers
• Network information
• Other device and technical information

Online Activity Data

• GRIDA access date and time
• Session duration
• Pages visited
• Clicks
• Screen navigation
• Feature usage
• AI Engine usage
• Generation requests
• Login history
• Error information
• Referring URL
• Service usage patterns
• Other activity within GRIDA

Communication Interaction Data

For emails or other electronic communications we send, we may collect:

• Whether an email was opened
• Whether a link was clicked
• Other communication interaction information

Location Data

We may use an IP address or similar data to estimate general location, such as:

• Country
• State, province, or region
• Approximate city-level location

As a general rule, GRIDA does not require precise GPS location to provide the Service.

Images, videos, audio, or other content you upload may contain personal information about other people. Before providing another person’s personal information, face, voice, or other identifiable information to us, you are responsible for obtaining any permission or consent required by applicable law.

We and our service providers may use Cookies, Local Storage, Pixels, and similar technologies to operate GRIDA.

These technologies may be used for:

• Maintaining login status
• Authentication
• Security
• Saving user settings
• Performance analysis
• Error analysis
• Usage statistics
• Service improvement
• Measuring communication effectiveness

You may be able to manage certain Cookies through your browser settings or Cookie controls we provide. Restricting essential Cookies may cause some GRIDA features not to function properly.

Because of the nature of GRIDA, images, videos, or audio uploaded by users may include a person’s face or voice.

As of the Effective Date of this Privacy Policy, GRIDA does not generally create or retain faceprints, voiceprints, or similar biometric identifiers for the purpose of uniquely identifying or authenticating users.

Processing a user-uploaded photo, video, or audio file as part of AI content generation or editing does not, by itself, mean that GRIDA is creating a biometric identification database for the depicted or recorded person.

If a future feature requires processing information that qualifies as biometric information under applicable law, we will provide any separate notice or consent required by law.

We may use personal information to:

• Provide the GRIDA Service
• Create and manage accounts
• Authenticate users
• Maintain user profiles
• Generate AI content
• Process images and videos
• Provide Prompt Enhance
• Run AI Engines
• Provide Project and Asset features
• Store and synchronize content
• Manage Subscriptions
• Manage Credits
• Process payments and refunds
• Send service notices
• Send security alerts
• Provide customer support
• Respond to inquiries and feedback
• Develop new services and features

We may use Creative Choice Data and other Service usage information to provide a more personalized creative experience. This may include analysis of:

• Preferred AI Engines
• Preferred styles
• Preferred image or video types
• Result-selection patterns
• Regeneration patterns
• Prompt usage patterns
• Generation and editing workflows
• Image-to-video conversion patterns

Inference and Creative Profile Data

We may analyze Creative Choice Data and other Service usage information to generate inferences about your creative preferences, preferred AI Engines, styles, Prompt patterns, production workflows, and other creative characteristics. These inferences may include Creative DNA and a personalization profile and may support:

• Creative DNA
• Personalized AI Engine recommendations
• Style recommendations
• Prompt recommendations and improvements
• Generation-option recommendations
• Content-production-path recommendations
• Personalized interfaces or features

We may analyze personal information or Service usage information to:

• Analyze Service performance
• Identify and fix errors
• Improve user experience
• Analyze AI Engine usage
• Develop new features
• Improve Service stability
• Measure effectiveness of services and features
• Improve content-generation workflows
• Conduct technology and product research and development

Where possible, we may use de-identified or aggregated information for these purposes.

GRIDA AI Training and Service Improvement Principles

GRIDA may use Creative Choice Data, de-identified information, aggregated information, and Service usage patterns for personalization, recommendations, quality analysis, and Service improvement.

We do not, by default, use a user’s non-public Input or Output as training data for a general-purpose generative foundation model operated by AREA72.

If we introduce such use in the future, we will provide any notice, controls, settings, or consent required by applicable law.

The way third-party AI Providers used by GRIDA process Prompts, Inputs, or Outputs may vary depending on the contractual terms between AREA72 and the Provider, API policies, and the Provider’s policies.

Information about major AI Providers and related processing may be made available through in-Service notices or a separate GRIDA AI Provider Directory.

Subject to applicable law, we may use personal information to communicate about:

• New services or features
• New AI Engines
• Events
• Promotions
• Discounts
• GRIDA-related news
• Other GRIDA marketing communications

You may unsubscribe using the unsubscribe option in a marketing email or by contacting help@grida-ai.com. Even if you opt out of marketing communications, you may continue to receive necessary communications concerning payments, security, account administration, or Service operations.

We may process personal information to:

• Comply with applicable law
• Respond to lawful requests from courts or government authorities
• Prevent fraud and abuse
• Prevent account takeover
• Protect Service security
• Detect and prevent system attacks
• Enforce the GRIDA Terms of Use and other policies
• Investigate rights-infringement complaints
• Process copyright infringement reports and DMCA Notices
• Process Counter-Notifications and notify relevant parties
• Prevent repeated intellectual property infringement and enforce related policies
• Investigate, exercise, or defend legal claims and disputes
• Protect the rights, safety, and property of the Company, users, and third parties

We may aggregate, de-identify, or anonymize personal information so that it cannot reasonably be linked directly to a particular person. Where such information is no longer treated as personal information under applicable law, we may use it for purposes such as:

• Service statistics
• Research and development
• Product improvement
• AI Engine performance analysis
• Market analysis
• Service operations analysis

Information that has been appropriately anonymized so that it can no longer be linked to a particular user may be retained as needed.

We may in the future use Cookies or similar technologies for advertising or marketing-effectiveness measurement. If a particular practice constitutes “Sale,” “Sharing,” or “Targeted Advertising” under an applicable U.S. state privacy law, we will provide the notices and opt-out mechanisms required by that law.

Selling personal information for monetary consideration is not GRIDA’s basic business model.

We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, including:

• Providing GRIDA
• Meeting legal, accounting, and tax obligations
• Resolving disputes
• Establishing or defending legal claims
• Preventing fraud and abuse
• Security

When determining an appropriate retention period, we may consider the amount, nature, and sensitivity of the information; risks of unauthorized use or disclosure; processing purposes; whether the purpose can be achieved by other means; and applicable legal requirements.

When personal information is no longer needed, we may delete, anonymize, or de-identify it. If immediate deletion is not possible, such as where information remains in backup archives, we may securely retain it and isolate it from ordinary processing until deletion becomes possible.

Account and Content Deletion

If you delete your GRIDA account, the account and related Content generally cease to be available through the Service.

We may maintain a limited recovery period of up to 30 days after account deletion. During that period, we may restore the account and related Content where technically feasible if you request recovery.

After 30 days, the Content may be deleted from active systems and generally may no longer be recoverable. The following information may be retained longer:

• Information required to be retained by law
• Accounting, tax, and transaction information
• Information relating to disputes or legal proceedings
• Fraud and abuse prevention records
• Security records
• Anonymized or aggregated data
• Information remaining in backup systems for a limited period

Backup information is deleted according to our ordinary backup rotation and deletion cycles.

Canceling or allowing a Subscription to expire is not the same as deleting your account. Canceling a Subscription stops future Billing, but your account and Content may remain unless you separately delete the account.

The following table describes our general retention criteria. Actual periods may vary depending on the feature, user choices, security needs, and applicable legal obligations. After the purpose ends, information is deleted, anonymized, or de-identified as appropriate.

We do not retain personal information for an unreasonably long period relative to the purposes originally disclosed. If applicable law requires a more specific retention period, that requirement applies.

If you have a GRIDA account, you may be able to review or change certain personal information through Account or Profile settings.

If your account information is inaccurate, you may correct it directly in the Service where available or ask us to correct it.

You may unsubscribe from marketing emails using the unsubscribe function in the message or by contacting help@grida-ai.com. We may continue to send operational, transactional, security, and other non-marketing communications.

You may restrict or delete certain Cookies through your browser or Cookie controls we provide. Disabling Cookies may cause some GRIDA features not to function properly.

Some email services and browsers allow you to block images in email. Using this setting may prevent us from collecting certain communication interaction data, such as whether an email was opened.

Where required by applicable U.S. state privacy law, we will process legally recognized opt-out preference signals such as Global Privacy Control (“GPC”).

You may choose not to provide personal information. However, if certain information is necessary for account creation, login, AI generation, content storage, Subscription, Credit purchases, payment, or customer support, you may be unable to use some or all of the Service without providing it.

If you connect an external platform to your GRIDA account, you may be able to disconnect it or modify access permissions through the external platform’s settings.

You may use deletion functionality provided by GRIDA to delete specific Content or request account deletion. If that functionality is unavailable, you may contact help@grida-ai.com. Account deletion is subject to the retention and deletion practices in Section 3.

This Section applies to residents of California and other U.S. states with comprehensive privacy laws to the extent those laws apply to us.

This Section is intended to provide information required at collection where the Company is subject to the California Consumer Privacy Act (“CCPA”). The personal information actually collected depends on the features you use and how you use the Service. We limit collection, use, and retention to what is reasonably necessary and proportionate to the disclosed purposes.

We do not sell personal information for monetary consideration as part of GRIDA’s basic business model. See Section 11.3 for additional information about Sale, Sharing, and Targeted Advertising.

When personal information is collected online, we may provide a link at or near the point of collection to this Section 11.2 or to the information required for the relevant collection.

As of the Effective Date of this Privacy Policy, we do not sell personal information for monetary consideration, and GRIDA does not operate Cross-Context Behavioral Advertising “Sharing” as a core feature.

If we introduce advertising or marketing technology that shares personal information with third-party advertising companies, the activity may be considered a “Sale,” “Sharing,” or “Targeted Advertising” under certain U.S. state laws. If so, we will provide required opt-out mechanisms.

Where we process information classified by law as Sensitive Personal Information, we use it within the scope necessary for Service delivery or as otherwise permitted by applicable law.

We process Sensitive Personal Information as necessary for Service delivery, security, fraud prevention, and purposes permitted by law. If we introduce uses or disclosures subject to California’s “Limit the Use and Disclosure of Sensitive Personal Information” right, we will provide a method to exercise that right.

Depending on applicable law and any required identity verification, you may have the right to:

• Know what personal information we hold
• Access personal information
• Request deletion
• Request correction of inaccurate information
• Opt out of Sale or Sharing
• Opt out of Targeted Advertising
• Limit certain uses of Sensitive Personal Information
• Receive a copy of personal information you provided in a portable format

We do not unlawfully discriminate against users for exercising privacy rights.

To the extent GRIDA operates online and collects personal information directly from users, privacy-rights requests may be submitted to help@grida-ai.com. If applicable law requires additional request methods, we will provide a web form, toll-free telephone number, or other required channel.

We may verify your identity before processing a request. Where permitted by law, you may submit a request through an authorized agent. If applicable state law provides a right to appeal our decision on a privacy request, we will provide information about that process.

If California Civil Code Section 1798.83 applies, California residents may request certain information regarding disclosure of personal information for direct marketing purposes. Requests may be sent to help@grida-ai.com.

As of the Effective Date, GRIDA’s Creative DNA and personalization features recommend AI Engines, styles, Prompts, or production paths and are not generally used to make employment, housing, financial-services, education, healthcare, or other decisions that produce legal or similarly significant effects concerning a user.

If we later use ADMT regulated by the CCPA to make significant decisions concerning users, we will provide any pre-use notice, opt-out, access rights, or explanation required by the law and applicable implementation dates.

This supplemental European notice applies to users located in the EEA or UK.

References to “Personal Information” in this Privacy Policy include “Personal Data” as defined by the GDPR or UK GDPR, as applicable.

AREA72, Inc. is generally the Controller of personal information processed in connection with GRIDA under this Privacy Policy.

If AREA72, Inc. is required to appoint a representative in the EEA or UK under GDPR Article 27 or the corresponding UK GDPR provisions, we will appoint an eligible representative in writing by the time the obligation applies and publish the representative’s name and contact information in this Privacy Policy or another privacy notice provided at collection.

The legal basis for processing personal information depends on the purpose and nature of the information.

Contractual Necessity

Processing is necessary to perform a contract with you or take steps at your request before entering into a contract.

Legitimate Interests

We may process personal information where we pursue a legitimate business interest, such as providing and improving the Service, maintaining security, preventing fraud and abuse, personalization, or improving user experience; the processing is necessary for that purpose; and we reasonably determine that your fundamental rights and freedoms do not override our interest. Where appropriate, we assess and document the purpose, necessity, and balancing of interests.

Consent

We rely on consent where applicable law requires it or where you voluntarily consent to optional processing.

Compliance with Law

We may process personal information where necessary to comply with a legal obligation applicable to the Company.

You are generally not required to provide personal information. However, if information is necessary for legal compliance or to provide GRIDA, you may be unable to use some or all of the Service if you do not provide it.

Except for information that may be contained in media you voluntarily upload to use GRIDA features, you should not provide unnecessary sensitive personal information to GRIDA, such as:

• Government-issued identification numbers
• Race or ethnicity information
• Political opinions
• Religion or beliefs
• Health information
• Criminal history
• Trade-union membership
• Genetic information
• Biometric information
• Financial account information
• Passwords or authentication information

You should also avoid including unnecessary personal information or another person’s sensitive information in a Prompt or other Input.

GRIDA may use Creative Choice Data to perform personalized Profiling that recommends AI Engines, styles, Prompts, or production paths.

As of the Effective Date, GRIDA does not generally use this personalization alone to make decisions that produce legal effects or similarly significant effects on a user. If such automated decision-making is introduced in the future, we will provide information required by applicable law.

See Section 7 for information about the security measures we use to protect personal information.

Subject to applicable data-protection law, users in the EEA or UK may have the right to:

• Access personal information
• Request correction
• Request deletion
• Restrict processing
• Data portability
• Object to certain processing
• Withdraw consent

Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

Privacy-rights requests may be submitted to help@grida-ai.com. We may verify your identity before processing a request.

Users in the EEA or UK may lodge a complaint with the data-protection supervisory authority in their place of residence, place of work, or the location where an alleged infringement occurred.

AREA72, Inc. is based in the United States. If you use GRIDA from the EEA or UK, your personal information may be accessed or processed in the United States. We may also use service providers or AI Providers located in other countries.

When personal information is transferred outside the EEA or UK, we use an appropriate transfer mechanism and safeguards required by applicable law. These may include:

• Transfers to a country covered by an EU or UK Adequacy Decision
• Standard Contractual Clauses (SCCs)
• A UK-recognized international data transfer agreement or Addendum
• An applicable privacy framework
• Other safeguards permitted by law
• Derogations recognized by law in limited circumstances

You may contact us to request additional information about transfer safeguards that apply to your personal information.