Privacy Policy

This Privacy Policy explains how Gripp ("Gripp," "we," "us," or "our") collects, uses, shares, and protects information when you use our website, web application, and related APIs or integrations (collectively, the "Service"). Gripp is procurement and accounts payable software — not a health product. We do not collect protected health information (PHI).

1. Information we collect

1.1 Information you provide

• Account information: a work email and a sign-in link, plus your company, whether you buy, sell, or both, and a short note on what you buy or sell. Phone number is optional. A password is optional and can be added later. Vendor registration can still collect a company name, contact name, and email on the vendor form.
• Procurement content: purchase requests, purchase orders, invoices, contracts, vendor records, quotes, shipments, and related messages and attachments.
• Billing information: when you subscribe to Pro, Stripe collects payment details. We receive limited billing metadata (last four digits, card brand, subscription status). We do not store full card numbers.
• Communications: support requests, feedback, and messages you send us.

1.2 Information from integrations

When you connect a third-party service, we receive data according to the permissions you grant. Examples:

1.3 Information collected automatically

• Usage data: pages viewed, features used, and timestamps.
• Device and log data: IP address, browser type, and crash logs.
• Cookies and similar technologies, including Vercel Analytics and Speed Insights. You can control cookies in your browser.

2. How we use information

• To provide, maintain, and improve the Service;
• To run AI parsing, vendor matching, and other features you request;
• To authenticate users, prevent fraud, and secure the Service;
• To process Pro payments and send billing communications;
• To send transactional messages (approvals, status updates) and, with consent, product updates;
• To comply with legal obligations.

3. AI processing

We use machine learning models, including models from Anthropic, to parse free-text procurement requests and related features. Customer data sent to these providers is processed to deliver the Service. It is not used to train Gripp's or our providers' general-purpose models.

4. How we share information

• Your organization: workspace members can access Customer Data according to their role.
• Service providers: Supabase (database and auth), Railway and Vercel (hosting), Resend (email), Stripe (payments), Anthropic (AI), Slack and Meta (messaging). They may use data only to provide their services.
• Integrations you enable: we exchange data with connected providers as you direct.
• Legal: we may disclose information when required by law or to protect Gripp, our users, or the public.

We do not sell personal information.

5. Retention

We retain Customer Data while your account is active. After closure we retain data for up to 90 days for backup, audit, and legal purposes, then delete or anonymize it except where longer retention is required by law (for example, billing records).

6. Security

We use TLS in transit, encryption at rest for sensitive fields, hashed passwords, role-based access, optional two-factor authentication, and audit logging. We do not currently publish a SOC 2 report. No system is 100% secure; we will notify you of incidents as required by law.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, or to object to certain processing. Email hello@gripp.run from the address associated with your account.

8. Children

The Service is not directed to children under 16. We do not knowingly collect personal information from children.

9. Changes

We may update this policy. Material changes will be announced by email or in the Service before they take effect.

10. Contact

Questions: hello@gripp.run.