Gridly
Privacy policy
Last updated 18 October 2026. Gridly is operated by Gridly ("we"). Contact: support@gridlypaper.com.
The short version: we hold as little as possible. We do not store your shop's orders, products or customers. We keep your sign-in email, your store address, your store's access key (encrypted) and a log of the changes you approved.
What we collect and why
| Account | Your email address, plan, usage counts (how many changes per month) and sign-in events. To let you sign in and to apply plan limits. |
|---|---|
| Connected stores | The store address, currency, timezone and the WooCommerce access key. The key is encrypted at rest (AES-256-GCM) and is never shown to you, to the AI or in our logs. To read and change your store on your behalf. |
| Change log | For each change you approve: which store, which products or order, the old and new values (for example old and new price), and a short description — which can include text you asked us to add, such as an order note. To let you undo changes and see history. |
| Your preferences | Whether you want summary and low-stock emails (off by default), your saved writing styles, and any changes you scheduled for later (the time and a short description). To do what you asked, when you asked. |
| Billing | Handled by Dodo Payments, our merchant of record. We receive your plan and subscription status, never your card number. |
What we do not store
When you ask a question, we fetch the answer live from your store and hand it to your AI app. We keep a copy only in memory for up to 5 minutes to make repeat questions fast, then it is gone. We don't build profiles, sell data, show ads or use third-party advertising or analytics trackers.
Customer personal data
Lists show customers' names shortened (for example "Anna K."). Full names, emails and addresses are returned only when you ask about a specific order or customer. That information is passed to the AI app you are using (Claude or ChatGPT) as part of your conversation, and is then handled under that provider's own terms and privacy policy.
Who else handles data
- Contabo — the server company that hosts Gridly and its database.
- Cloudflare — DNS for our domain and forwarding of support email.
- Resend — sends our emails to you: sign-in links and, if you turn them on, summaries, low-stock alerts and results of scheduled changes (these contain shop figures such as sales totals and product names).
- Dodo Payments — takes payments and handles sales tax.
- Anthropic / OpenAI — the AI app you choose to use Gridly in.
Cookies
One essential cookie keeps you signed in. We don't use marketing or analytics cookies.
How long we keep things
Sign-in links expire after 15 minutes. Access tokens last one hour, refresh tokens 30 days. Everything else is kept while your account exists and deleted when you delete it. Backups, when enabled, are kept for a limited time and then overwritten.
Your rights
You can see, correct or delete your data at any time. Deleting your account is self-service — see Delete your data — or email us. If you are in the EU/UK (GDPR) or India (DPDP Act) you may also complain to your data protection authority.
Security
All traffic uses HTTPS. Store keys are encrypted. Sign-in uses one-time links, and AI-app access uses short-lived tokens. We will tell affected users promptly if a breach affects them.
Children
Gridly is for business use and not directed at children.
Changes
If we change this policy in a meaningful way we will update the date above and tell account holders by email.