This page explains what GridSlate collects, why, and what you can ask us to do with it. GridSlate is made by [seller’s legal name, address and, for a company, its number] (“we”), the controller of the data below. Contact: [email protected].
Your photos stay on your computer
GridSlate works on your files locally. Photos, catalogs, templates and exports are never uploaded to us. A photo can reach us only in a screenshot you choose to add to a problem report.
If you photograph other people, such as pupils, team members or event guests, their photos and the roster you import stay with you: we never receive them, so for that data you are the controller and GridSlate is a tool on your computer. You decide with the school, club or client who may see it, and how long you keep it.
No AI training on your photos
GridSlate’s AI features, such as face placement and culling, run on your computer. We do not train AI on your photos or your edits, and there is nothing to opt out of. We read a problem report only to fix the problem it describes.
What we collect
- Your account: your email address, and the name and picture your sign-in provider (Google, Microsoft or Apple) shares, shown on your account page. We never see a password.
- Your country, from your browser’s language, to show prices in your currency and put the right tax on invoices; your company name, address and tax ID if you add them.
- Your subscription and payments: plan, number of PCs, status, amounts and dates, and any invitation you sent or accepted. Card details are handled by Stripe, and MB WAY and Multibanco payments by easypay; they never reach us.
- Your computers: for each computer you sign in on, a one-way code the app computes from the system’s machine identifier (from which we cannot recover it), the computer’s name, its GridSlate version, and when it last checked in. This is how a plan’s number of PCs is kept.
- Downloads: which installer was downloaded, the country, and a one-way code of the IP address that changes every day, to count downloads.
- Your IP address when you connect: our network and hosting providers handle it to deliver the site, and our server holds it briefly in memory to limit abuse. We do not store it with your account.
- Problem and crash reports, only when you send one or allow crash reports to be sent. A problem report holds your description, system information, the app’s latest log, which can contain file and folder names, and a screenshot of GridSlate if you tick that box. A screenshot can show photos and names, so leave it out if they should not be seen.
Your settings
- Emails, on your account page: “Tell me when a new version is out” is on until you turn it off; “Send me occasional product news” is off until you turn it on. Receipts and payment notices always go out, because they are part of the service.
- Crash reports, in the app’s settings: you choose whether they are sent without asking. Otherwise the app asks you each time.
- Problem reports: the app sends one only when you press Send, and you can save it to a file instead.
- Your data, on your account page: download a copy at any time, and delete your account once no plan is running.
Why (legal bases)
- Account, subscription, computers and emails about them: to provide the service you subscribe to (contract).
- Invoices and tax records: legal obligation.
- Download counts, new-version emails, and keeping the service secure and free of abuse: legitimate interest.
- Product news and crash reports sent without asking: your consent, which you can withdraw in the settings above. Problem reports: your choice to send one, and our legitimate interest in fixing what it describes.
Who processes it
We do not sell your data, share it for advertising, or show ads. These providers process it for us or, where we say so, on their own account:
- Cloudflare (the network in front of this site), which sees your IP address and requests.
- Fly.io (hosting), in Amsterdam.
- Supabase (database, file storage and sign-in), in the European Union.
- Google, Microsoft and Apple, if you sign in with them, each a controller of your account with them.
- File hosting providers, which see your IP address when the app or your browser downloads GridSlate, its updates or its components from them.
- Stripe (card payments) and easypay (MB WAY and Multibanco), each also a controller of the payment data it handles, once you pay for a subscription.
- Resend (account and billing emails), when we send you one.
- [Invoicing provider] (certified invoices).
We may also disclose data when the law requires it, or to a buyer if GridSlate is sold, who would remain bound by this policy.
International transfers
We keep your account data in the European Union. Some providers above are based in or operate from other countries, including the United States. Where a provider processes data outside the EU, it does so under an adequacy decision or the European Commission’s standard contractual clauses.
How long
- Account and computers: while the account exists. Deleting the account deletes them, along with its problem and crash reports. Deleted data leaves our backups within [30 days].
- Invoices and payment records: as long as tax law requires, [10 years].
- Download counts: [24 months]. Problem and crash reports: 90 days.
Security
Connections to GridSlate are encrypted. We store no passwords and keep sign-in sessions only as one-way codes. Only staff who need it can see account data and reports, and we record what they do in the back office. If a breach puts your data at risk, we will tell you and the authorities as the law requires.
Your rights
You may ask for a copy of your data, correct it, have your account deleted, object to processing, restrict it, withdraw a consent, or take your data elsewhere. On your account page you can download a copy of your data and delete your account yourself; or write to [email protected], and we answer within one month. You may also complain to your data protection authority.
These rights are for every customer, wherever you live, and using them never changes your price or service. We make no decisions about you by automated means alone that have a legal or similarly significant effect.
Children
GridSlate is for adults, and we do not knowingly hold accounts of anyone under 18. Photos of children that a photographer works on stay on the photographer’s computer. If you think a child’s data has reached us, write to [email protected] and we will delete it.
Changes
We will say on this page when this policy changes, with the date at the top, and tell you by email or in the app about important changes before they apply.