Legal
Last updated: [DATE].
Account data (name, email, company); the brand details and intake you provide; data you connect (e.g. GA4 — read-only); the diagnoses we generate for you; payment metadata (handled by our processor — we never store card numbers); and basic product analytics.
To provide the Service (run your diagnosis, deliver results), to bill you, to support you, to improve the product in aggregate, and to send service emails. We do not sell your personal data, and we do not show ads.
Performance of contract (providing the Service), legitimate interests (security, product improvement), consent (marketing emails, non-essential cookies), and legal obligation (tax records).
We share data only with the vendors needed to run the Service, each under a data-processing agreement. See the DPA & subprocessor list.
We retain your diagnoses and brand memory for [12] months to power cross-refresh trends, then delete or anonymize them. You can request export or deletion at any time at privacy@begrasp.com; we honor it within [30] days, subject to legal retention (e.g. invoices).
Data is encrypted in transit and at rest. Each customer's data is isolated (row-level security) so no customer can access another's. Access is least-privilege. SOC 2 is [in progress].
We use a small number of cookies. Essential cookies (login/session, security, and your consent choice) are always on — the site can't function without them. Analytics cookies stay off until you accept them via the consent banner, and you can change your mind anytime by clearing site data.
Current cookies: begrasp.cookieConsent (essential — remembers your choice), session/auth tokens (essential — only after you log in to the app), and product analytics (non-essential — set only with consent). We set no advertising or cross-site tracking cookies.
You may access, correct, export, or delete your data, and object to or restrict processing. Contact privacy@begrasp.com. Data controller: [LEGAL ENTITY], [JURISDICTION].