Graypie — Privacy Policy

Last updated: October 13, 2026 Effective date: October 1, 2026

This Privacy Policy explains how Graypie ("Graypie," "we," "us," or "our") collects, uses, shares, and protects personal information in connection with the Graypie platform at https://graypie.com and related applications and services (the "Service"). It applies to our websites, our web and mobile applications, and our communications with you.

1. Scope & Our Roles

1.1 Graypie is a Business Operating System for retail and commerce. This Policy covers two kinds of relationships:

• When you use Graypie as a customer (a business owner, administrator, or team member), Graypie is the controller of your account and usage information described below.
• When your business uses Graypie to run its operations, you may input information about your own customers, employees, and suppliers ("Business Data," including "End-Customer Data"). For that information, your business is the controller and Graypie acts as a processor that handles the data on your instructions under our Terms of Service and any Data Processing Addendum. If you are an end-customer of a business that uses Graypie, please contact that business directly to exercise your rights.

1.2 This Policy does not govern the independent privacy practices of businesses that use Graypie, or of third-party services you connect.

2. Information We Collect

2.1 Information you provide directly

• Account & profile: name, email address, phone number, password (stored only as a secure hash), business name, role, avatar, and preferences.
• Business & workspace setup: branches, registers, currency, timezone, tax settings, and similar configuration.
• Business Data you enter: products and catalog, inventory and stock counts, suppliers and purchase orders, sales, returns, exchanges, payments and cash movements, expenses, accounting entries, payroll and employee records, attendance, customers and loyalty data, and online-store content.
• Payments & billing: billing contact and, for paid plans, payment details processed by our payment provider. We do not store full payment-card numbers on our systems.
• Support & communications: messages, requests, and feedback you send us.

2.2 Information we collect automatically

• Usage & device data: pages and features used, actions taken, approximate timestamps, browser and device type, operating system, and referring pages.
• Log & technical data: IP address, request metadata, and error/diagnostic logs used for security, debugging, and reliability.
• Approximate location: we may infer your country from your IP address (for example, to pre-fill a phone country code at sign-in and to localize defaults).
• Cookies & similar technologies: see Section 5.

2.3 Information from third parties

• We may receive information from service providers (such as payment processors confirming a transaction, or messaging providers confirming delivery) and from integrations you choose to enable.

3. How We Use Information

We use information to:

• Provide and operate the Service — authenticate you, run your Business's workspace, process transactions, and deliver the features you use;
• Secure the Service — verify identity, enable two-factor authentication and trusted devices, detect and prevent fraud, abuse, and unauthorized access, and enforce our Terms;
• Support you — respond to requests and provide customer service;
• Bill and administer — manage subscriptions, invoices, and payments;
• Improve and develop — understand how the Service is used, troubleshoot, and build new features (using aggregated or de-identified data wherever practical);
• Communicate — send service, security, and transactional messages, and, where permitted, product updates (you can opt out of non-essential marketing);
• Comply with law — meet legal, tax, accounting, and regulatory obligations and respond to lawful requests.

Legal bases (where GDPR/UK GDPR or similar applies): performance of a contract; our legitimate interests (e.g., securing and improving the Service); compliance with a legal obligation; and consent (e.g., certain cookies or marketing), which you may withdraw at any time.

4. AI & Automated Features

The Service may include intelligent, assistive features. Where these are used, inputs may be processed by us and/or a trusted provider acting as our sub-processor solely to deliver the feature. We do not use your Business Data to train third-party foundation models without your instruction or consent. We do not make decisions producing legal or similarly significant effects about individuals solely by automated means without a lawful basis and appropriate safeguards.

5. Cookies & Similar Technologies

We use strictly necessary cookies (for example, to keep you signed in and to remember your active business, branch, and register) and, where applicable, functional and analytics cookies to understand and improve the Service. You can control cookies through your browser settings; disabling strictly necessary cookies may break core functionality. Where required, we present a cookie notice or consent tool.

Website chat and contact form. Reading graypie.com sets no chat cookie and loads no chat provider. When you send your first message in the website chat or use the contact form, we set one cookie, "gp_chat", on graypie.com only. It holds a random identifier so we can show you your conversation again; we store only a hash of it, and it lasts up to 180 days or until you clear it. We also record the country and language your connection suggests, the page you were on, how you arrived at the site (the referring site's name only), and a one-way hash of your IP address that changes every day, so it cannot be used to follow you from one day to the next. We do not use advertising or tracking scripts for the chat.

6. How We Share Information

We do not sell your personal information. We share it only as follows:

• Service providers / sub-processors — vendors who host, operate, and support the Service under contract (e.g., cloud hosting and database providers, email and SMS/OTP delivery, payment processing, error monitoring, and intelligent- feature providers), limited to what they need and bound by confidentiality and data-protection terms.
• Within your Business — information is visible to your Authorized Users according to the roles and permissions you configure.
• Legal & safety — when required by law, legal process, or to protect the rights, property, or safety of Graypie, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy or a successor policy.
• With your direction — when you enable an integration or otherwise instruct us to share.

7. Sub-Processors

We engage sub-processors to provide the Service, which may include providers of: cloud application hosting; managed PostgreSQL database hosting; transactional email and SMS/OTP delivery; payment processing; logging/monitoring; and intelligent, assistive features. For the website chat and contact form, this includes Cloudflare (Turnstile, a bot check that runs when you send a message) and our AI provider (which may read the text of a chat to answer it). A current list of sub-processors is available on request at privacy@graypie.com. We remain responsible for our sub-processors' handling of personal data.

8. International Data Transfers

We may process and store information in countries other than your own. Where we transfer personal data across borders, we use appropriate safeguards required by applicable law (such as standard contractual clauses) to protect it.

9. Data Retention

We retain personal information for as long as needed to provide the Service and for legitimate business and legal purposes. Business Data is retained for the life of your account and, after termination, for a limited export window before deletion or anonymization (see our Terms, Section 12), subject to legal retention requirements. Backups expire on a rolling schedule. You can delete much of your data within the Service at any time.

Website chat and contact messages. Chats with our assistant and messages sent through the contact form may be read by our support team and answered by our AI assistant; please do not include passwords, card numbers or sign-in codes (we remove card numbers and codes before a message is stored). A chat that has no email address and was never answered by a person is erased 90 days after you were last seen. A chat where you gave us an email address is kept as support history and is handled like other support conversations. You can delete a conversation yourself from the link in our email, or ask us to delete it by writing to privacy@graypie.com. If you later sign up, the chats you started from that browser are attached to your new account so you do not have to repeat yourself.

Emails to support. Emails you send to our support address are processed by our email provider and kept in your support thread, where our support team can read them. We keep the sender's address and the subject for 30 days and the message text under the same retention as other support conversations. Please do not email passwords, card numbers or sign-in codes.

10. Security

We apply administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, strict tenant isolation, access controls, and authentication safeguards. No method of transmission or storage is completely secure, but we work to protect your information and to detect and respond to incidents. See our Security Policy for details.

11. Your Rights & Choices

Depending on where you live, you may have rights to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your information ("right to be forgotten");
• port your information to another provider;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a supervisory authority.

To exercise rights regarding information for which Graypie is the controller, contact privacy@graypie.com. We will respond within the timeframe required by law and may need to verify your identity. If your request concerns data that a business controls (End-Customer Data), we will refer you to, or assist, that business as the controller.

U.S. state privacy rights (e.g., California): where applicable, you have rights to know, delete, correct, and to opt out of "sale" or "sharing" (we do not sell or share personal information for cross-context behavioral advertising), and not to be discriminated against for exercising your rights.

12. Children's Privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children under the age required by applicable law. If you believe a child has provided us information, contact privacy@graypie.com and we will take appropriate steps to delete it.

13. Your Responsibilities as a Business Using Graypie

If you use Graypie to process information about your own customers, employees, or others, you are the controller of that information. You are responsible for having a lawful basis and any required notices and consents, for honoring individuals' rights, and for configuring access appropriately. Where required, a Data Processing Addendum governs our processing on your behalf; contact privacy@graypie.com to request one.

14. Third-Party Links

The Service and our websites may link to third-party sites or services we do not control. Their privacy practices are governed by their own policies.

15. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice (for example, by email or in-product) and update the "Last updated" date above. Your continued use after the effective date constitutes acceptance.

16. Contact Us

For privacy questions or to exercise your rights:

Graypie — Attn: Privacy Email: privacy@graypie.com Web: https://graypie.com