Privacy Policy
1. INTRODUCTION
Gritrax ("Gritrax", "we", "us", or "our") respects your privacy and is committed to protecting the information entrusted to us.
This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, how your files and other data are stored, when information may be disclosed, how long information is retained, and your privacy rights.
By accessing or using our services, you acknowledge the practices described in this Privacy Policy.
2. INFORMATION WE COLLECT
2.1 Account Information
When you create or use an account, we may collect:
• Email address
• Name
• Password credentials in protected form
• Profile information
• Profile image or avatar, where provided
• Authentication and account-security information
2.2 Workspace and Account Administration Information
Depending on how you use the service, we may collect:
• Workspace names
• Workspace configuration
• Workspace membership information
• User roles and permissions
• Account and workspace activity required to operate the service
2.3 Billing and Transaction Information
Where applicable, we may collect:
• Billing information
• Transaction identifiers
• Payment status
• Subscription or usage information
• Information necessary to process refunds, disputes, or billing requests
Payment card information is processed through our payment service providers and is not stored by Gritrax as raw payment-card data.
2.4 Content and User Data
You may provide information and content through the service, including:
• Files
• Documents
• Images
• Videos
• Notes
• Tasks
• Financial records
• Comments
• Metadata associated with uploaded or created content
We process this information only as necessary to provide, maintain, secure, and operate the services.
3. INFORMATION WE DO NOT INTENTIONALLY COLLECT FOR PROFILING
Gritrax does not intentionally collect or use the following information for behavioral profiling:
• Device fingerprints
• Browsing activity outside the service
• Information about unrelated websites you visit
• Operating-system information for advertising or behavioral profiling
• IP addresses for advertising profiles
Technical information may nevertheless be processed temporarily where necessary for security, authentication, abuse prevention, troubleshooting, fraud prevention, or operation of the service.
4. HOW WE USE INFORMATION
We use information for legitimate operational purposes, including:
• Creating and managing accounts
• Authenticating users
• Managing workspaces and permissions
• Storing and delivering user content
• Synchronizing information between authorized sessions and devices
• Processing transactions and billing
• Sending authentication codes and security notifications
• Providing customer support
• Detecting and preventing unauthorized access
• Preventing fraud, abuse, and attacks
• Maintaining system reliability
• Diagnosing technical problems
• Maintaining backups and disaster-recovery systems
• Complying with applicable legal obligations
We do not sell personal information to third parties.
5. FILES AND USER CONTENT
5.1 Access to File Contents
Gritrax is designed so that user files are handled by automated storage and delivery infrastructure rather than routinely accessed by Gritrax personnel.
Gritrax personnel do not routinely inspect, read, or review the contents of user files.
We may technically process user content where necessary to:
• Provide the requested service
• Deliver or retrieve content
• Maintain storage systems
• Detect security threats
• Investigate abuse or service incidents
• Perform required maintenance
• Comply with legal obligations
We do not use user files for advertising profiles or sell user content to third parties.
5.2 Storage Architecture
User files are stored using distributed cloud storage infrastructure.
Files may be:
• Uploaded in chunks or parts
• Stored across separate storage objects
• Reassembled when required for authorized retrieval or delivery
• Replicated or backed up for reliability and disaster recovery
Accordingly, a user's complete file is not necessarily stored as one single object in one physical location.
5.3 File Encryption
Data is protected using encryption:
• During transmission between the user's device and our services
• While stored within supported storage infrastructure
Encryption does not eliminate every possible security risk, but it provides an additional layer of protection against unauthorized access.
6. ACCESS CONTROLS AND SECURITY
Gritrax uses technical and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction.
These measures include, where applicable:
• Authentication controls
• Role-based authorization
• Workspace-level access controls
• Database row-level security
• Restricted service credentials
• Encryption in transit
• Encryption at rest
• Secure storage infrastructure
• Audit logging
• Backup and recovery mechanisms
• Access restrictions between system components
• Security monitoring and maintenance
• Regular security reviews and audits
Access to administrative or infrastructure systems is restricted according to operational requirements.
No internet-based service can guarantee absolute security. We continuously work to identify and address security vulnerabilities.
7. BACKUPS AND DISASTER RECOVERY
Gritrax maintains backups and recovery mechanisms designed to protect against:
• Accidental deletion
• Hardware failure
• Infrastructure failure
• Data corruption
• Service interruptions
• Other operational incidents
Backups are maintained separately from active operational data where appropriate.
Backup copies may remain available after information has been deleted from active systems until the applicable backup-retention period expires.
8. DATA RETENTION
We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required by law.
Retention periods may differ depending on the type of information.
8.1 Account Information
Account information may be retained while an account remains active and for a reasonable period following account deletion where necessary for:
• Security
• Fraud prevention
• Legal compliance
• Dispute resolution
• Financial or accounting requirements
8.2 User Content
User content is generally retained while the relevant account or workspace remains active, subject to deletion and recovery mechanisms.
Deleted content may remain temporarily available through recovery systems or backups before permanent deletion.
8.3 Financial and Transaction Records
Certain financial and transaction records may be retained for periods required by applicable tax, accounting, financial, or legal requirements.
8.4 Security and Audit Records
Security records and audit logs may be retained for as long as reasonably necessary to:
• Maintain system security
• Investigate incidents
• Prevent abuse
• Meet legal obligations
• Maintain an accurate security history
8.5 Backup Data
Backup copies may remain for a defined backup-retention period after corresponding active data has been deleted.
Once applicable retention periods expire, information is securely deleted, anonymized, or otherwise rendered unusable where technically and legally appropriate.
9. SHARING OF INFORMATION
We do not sell or rent personal information.
We may disclose information only when reasonably necessary for legitimate operational or legal purposes.
9.1 Service Providers
We use carefully selected third-party infrastructure and service providers to operate our systems.
These providers may assist with:
• Cloud infrastructure
• Storage
• Authentication
• Payment processing
• Email delivery
• Security
• Infrastructure monitoring
• Other necessary technical services
Service providers receive only the information reasonably necessary for the service they provide and are expected to maintain appropriate security and confidentiality protections.
9.2 Legal Requirements
We may disclose information when required by applicable law or valid legal process, including:
• Court orders
• Warrants
• Legally valid government requests
• Regulatory requirements
• Other legally binding obligations
Where legally permitted, we may notify affected users of such requests.
We seek to limit disclosures to information that is legally required.
9.3 Security and Protection
We may disclose information where reasonably necessary to:
• Prevent fraud
• Prevent abuse
• Protect the security of our systems
• Investigate security incidents
• Protect users or other persons
• Protect our legal rights
10. INTERNATIONAL DATA TRANSFERS
Gritrax may use infrastructure and service providers located in countries other than the country in which you reside.
Where personal information is transferred internationally, we take reasonable measures to ensure that the information receives appropriate protection in accordance with applicable law.
11. COOKIES AND SIMILAR TECHNOLOGIES
Gritrax may use cookies or similar technologies that are necessary to operate the service.
11.1 Essential Technologies
These may include:
• Authentication and session management
• Security controls
• User preferences
• Service functionality
These technologies are necessary for core features of the service and may not function correctly if disabled.
We do not use essential authentication or security cookies to create advertising profiles.
12. CHILDREN'S PRIVACY
Our services are not intended for children under the minimum age permitted by applicable law.
We do not knowingly collect personal information from children where such collection is prohibited by applicable law.
If we become aware that information has been collected from a child in circumstances where it should not have been collected, we will take reasonable steps to delete it.
13. YOUR PRIVACY RIGHTS
Depending on your location and applicable law, you may have rights relating to your personal information.
These may include:
• The right to access personal information
• The right to correct inaccurate information
• The right to request deletion
• The right to request portability of certain information
• The right to object to certain processing
• The right to withdraw consent where processing is based on consent
• The right to lodge a complaint with an applicable data-protection authority
Some rights may be subject to legal limitations or exceptions.
14. ACCOUNT AND DATA DELETION
You may request deletion of your account and associated personal information.
When an account or workspace is deleted:
• Active data is removed according to our deletion procedures
• Deleted content may temporarily remain in recovery systems
• Backup copies may remain until their applicable retention period expires
• Certain information may be retained where required by law
• Security, fraud-prevention, accounting, or dispute records may be retained where legally or operationally necessary
Deletion does not necessarily mean immediate destruction of every backup copy.
15. DATA ACCURACY
We take reasonable measures to maintain accurate account and service information.
You are responsible for keeping information you provide to Gritrax accurate and up to date.
You may contact us if you believe information associated with your account is inaccurate.
16. THIRD-PARTY SERVICES
Our services may rely on third-party providers for infrastructure, authentication, payments, email, storage, and other technical functions.
Those providers may process information according to their own privacy policies and contractual obligations.
Gritrax is not responsible for the independent privacy practices of third-party services that you access directly.
17. SECURITY INCIDENT NOTIFICATION
If we determine that a security incident has affected personal information and applicable law requires notification, we will provide notification in accordance with the applicable legal requirements.
Notifications may be provided by:
• An in-service notice
• Other legally permitted communication methods
18. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time.
When we make material changes, we may notify users through:
• An in-service notice
• Other appropriate communication methods
The "Last Updated" date at the beginning of this policy indicates when the policy was most recently revised.
19. CONTACT US
For privacy questions, data-access requests, deletion requests, or privacy complaints, contact:
Privacy: [privacy@gritrax.com](mailto:privacy@gritrax.com)
Legal: [legal@gritrax.com](mailto:legal@gritrax.com)
Support: [support@gritrax.com](mailto:support@gritrax.com)
Location: India
Gritrax will take reasonable steps to review and respond to privacy requests within the period required by applicable law.