Privacy Policy

This policy explains what personal data Gravi collects, why, how long we keep it and what rights you have. The controller for the data described here is [Company legal name], [Registered address]. Privacy questions: [Privacy contact email].

It covers people with a Gravi account, visitors of pages published with Gravi, and people who answer forms on those pages.

1. Data we collect

If you have an account

• Account data: email address, password (stored only as a hash), name and avatar if you add them, language, and — if you sign in with Google — your Google account ID and email.
• Content: projects, pages, blocks, uploaded files, themes, and settings. Published content is public by design.
• Team data: invitations you send (the invitee's email) and project roles.
• Billing data: the plan of each project and subscription status. Payment details are handled by the payment provider, not by us.
• API and connections: API keys and connected apps (we store only a hash of each key), their scopes and when they were last used.
• Security and logs: sign-in events, audit records of important actions in a project, and technical logs needed to run and protect the Service.

If you visit a page published with Gravi

We count visits and clicks so page owners can see statistics. We do not use cookies for analytics, do not store IP addresses, and do not track you across sites. A visit is counted with a short-lived anonymous identifier derived from your IP address and browser, mixed with a secret that changes every day and is deleted after two days, so visits cannot be linked across days. From the request we keep only coarse data: the country (looked up on our own server), browser and device type, and the referring site.

If you answer a form on a page

We store your answers and the time you sent them, plus the page's statistics data above. The page owner decides what the form asks and is the controller of your answers; Gravi stores them on the owner's behalf as a processor. Contact the page owner about your answers; if you can't reach them, write to us.

2. Why we use it

• To provide the Service: accounts, editing, publishing pages, custom domains, forms, teams, the API (performance of a contract).
• To keep the Service secure and prevent abuse, spam and fraud, and to handle reports (legitimate interests).
• To send service emails: confirmations, password resets, invitations, plan changes and form notifications (performance of a contract). We do not send marketing emails without your consent.
• To meet legal obligations, for example accounting for payments.

We do not sell personal data and do not use it for advertising.

3. Who we share it with

We use a small number of providers to run the Service, each bound to process data only on our instructions:

• Hosting and storage: [Hosting provider and server location].
• Email delivery: Resend.
• Sign-in with Google: Google (only if you choose it).
• Error monitoring: [Error monitoring provider].
• Payments: [Payment provider] (when paid plans are available).

Link previews are fetched by our own server from the address you add. We may disclose data when the law requires it or to protect people from harm. If data is transferred outside your country, we use the safeguards the law requires.

4. How long we keep it

• Account data and content: while your account exists. When you delete your account it is disabled immediately and permanently erased with your projects, pages, files and form responses after 30 days.
• Form responses: until the page owner deletes them or the project is deleted.
• Page statistics: daily totals for up to 25 months, hourly totals for about 35 days, anonymous visitor identifiers for 2 days.
• API keys and connections: until revoked or expired; revoked keys are removed.
• Backups and logs: [Backup and log retention period].

5. Cookies

The Gravi dashboard uses strictly necessary cookies to keep you signed in and to remember your language. Published pages and the website do not use tracking or advertising cookies, so there is no cookie banner. Your theme and banner choices are stored in your browser's local storage.

6. Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, to restrict or object to its use, and to withdraw consent. Most of this you can do yourself in the dashboard: edit your profile, export your data, or delete your account. For anything else write to [Privacy contact email]; we answer within 30 days. You can also complain to your data protection authority.

7. Children

Gravi is not meant for children under 16, and we do not knowingly collect their data. If you think a child has given us personal data, contact us and we will delete it.

8. Security

Passwords and API keys are stored only as hashes, connections use HTTPS, and access to production data is limited to the people who need it. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

9. Changes

We will announce material changes to this policy by email or in the dashboard before they apply. The date at the top shows the latest version.