Privacy policy

The controller of your personal data is:

• Thinktier OÜ (hereinafter, “Thinktier”)
• Estonian registry code: 17249293
• VAT: EE102949399
• Registered office: Lõõtsa tn 5, 11415 Tallinn, Estonia
• Contact: privacy@granel.io

We process the following categories of personal data:

• Account data: name, email, password (stored as a hash by the authentication provider), organisation and role within it.
• Product usage data: deals, counterparties (including the names and contact details of people at those companies), products and documents that you or your organisation enter into Granel.
• Captured messages: if your organisation connects WhatsApp or Telegram, or forwards messages by email, Granel receives and stores the full text of each message, the sender’s phone number (WhatsApp) or username (Telegram), and the chat and message identifiers. The same applies to text a user pastes into manual capture. The people who write those messages — usually your organisation’s counterparties — have not visited this site or accepted this policy: see the paragraph below.
• Billing data: whatever you provide when you purchase a plan (for example, company name, address and VAT number) and the payment method. Payments are processed by Stripe; Granel does not store card details.
• Technical data: IP address, browser, access logs and security events.
• Communication data: what you write in the contact form (name, email, company and message) or send us by email, together with the form’s attribution data: landing page, referring page and campaign parameters (utm_*, gclid, fbclid).

Data we process on your organisation’s behalf. Deals, counterparties, documents and captured messages are decided on by your organisation: for that data, your organisation is the controller and Thinktier acts as processor, under the data processing agreement. It is for your organisation to inform its counterparties and to have a legal basis for forwarding their messages to Granel.

We process your data in order to:

• Provide the contracted service (legal basis: performance of the contract).
• Invoice and meet tax obligations (legal basis: legal obligation).
• Keep the service secure and prevent fraud (legitimate interest).
• Prevent abuse of the free trial: when an organisation is created we keep a hash (SHA-256) of the normalised email, not the email itself, to know that address has already used its trial even after the account is closed (legitimate interest; period in the retention table).
• Extract deals from captured messages and pasted text, with the help of an AI model, on your organisation’s behalf (processing on behalf of a controller; the legal basis is your organisation’s).
• Answer your enquiries sent through the contact form and follow them up commercially in our CRM (consent, which you give by submitting the form).
• Improve the product through aggregated usage analysis (legitimate interest) and, only if you accept it, web analytics (consent; see cookies).

Each category of data has its own period. This table is the reference for any period mentioned elsewhere on the site or in the application.

To provide the service we share data with the following providers, which process it on our behalf:

• Supabase — database, document storage and authentication infrastructure.
• Vercel — hosting and delivery of the application and the site.
• Stripe — payment processor.
• Resend — transactional email delivery and receipt of the capture-by-email inbox.
• Upstash — caching and rate limiting.
• Sentry — error monitoring.
• Groq, Inc. (United States) — main provider for AI-assisted extraction: it receives the full text of captured messages and pasted text, including any names, phone numbers or other personal data they contain, together with an extract of the organisation’s catalogue (name, type and country of up to 20 counterparties, and name, category and unit of up to 20 products, those the message names and the most recent) to match them, and returns the deal fields.
• Google (Gemini API, United States) — fallback provider for the same extraction, used when Groq is not configured or cannot handle the extraction (for example, if it withdraws the model or is down).
• Vera OS (os.nvdigital.es) — external CRM where contact form submissions are recorded (name, email, company, message, attribution data and proof of consent) so we can reply and follow up commercially. It is the only destination of that form.

Whether an AI provider may use the content it receives to train or improve its models depends on the terms of the service contracted with that provider, not on Granel. You can ask us which terms currently apply by writing to privacy@granel.io.

Input channels. If your organisation connects WhatsApp (Meta’s WhatsApp Business Platform) or Telegram, messages reach Granel through those platforms. Meta and Telegram are not Thinktier’s processors: their handling of the messages is governed by the terms your organisation accepts when using those services.

International transfers. Text sent for extraction is transferred to the United States, where it is processed by Groq, Inc. or Google. Google Analytics, if you accept it, may also process data in the United States. The other providers on the list may process data outside the European Economic Area depending on their own infrastructure. These transfers rely on the EU–US adequacy decision where the provider participates in it or, failing that, on the Article 46 GDPR safeguards each provider offers (for example, the European Commission’s Standard Contractual Clauses). You can ask for each provider’s location and a copy of the applicable safeguard by writing to privacy@granel.io.

As the data subject, you may exercise the following GDPR rights:

• Access to your personal data.
• Rectification of inaccurate data.
• Erasure (“right to be forgotten”).
• Restriction of processing.
• Data portability.
• Objection to processing.
• Withdrawal of consent where consent is the applicable legal basis.

To exercise them, write to privacy@granel.io. You may also lodge a complaint with the Estonian data protection authority (Andmekaitse Inspektsioon, www.aki.ee).

We use two kinds of cookies, by purpose:

• Strictly necessary (no consent required, always on): keeping you signed in, remembering your theme (light/dark) and language preferences, and protecting sign-in against brute-force attempts: after you sign in we store a “trusted device” cookie in your browser (90 days, HTTP-only, with a signed identifier derived from your email) so that other people’s failed attempts do not lock you out. We also remember in the browser’s local storage that you dismissed the app install prompt.
• Analytics (require your prior consent): we use Google Analytics 4 to understand how the public site is used. Google’s script is not loaded until you accept the cookie banner; if you reject or ignore it, it is not loaded. It is not used in the application or on the sign-in, sign-up and invitation screens, and for each page we send the path without the URL parameters (except, where present, the utm_* campaign parameters). On the transfer to the United States, see section 5.

We do not use advertising cookies. You can change your analytics decision at any time from the Cookie preferences link in the footer: when you withdraw consent we delete the Google Analytics cookies (_ga) and the banner asks you again. If your browser sends the Global Privacy Control signal, we treat it as a refusal: we do not ask and analytics stays off. Consent is required in every country; the only thing that changes depending on where you visit from is the format of the notice. The page you arrived on and that visit’s campaign parameters (utm_*, gclid, fbclid) are kept in the tab’s memory —and, only if you accept analytics, in the browser’s session storage, which is cleared when you close it— and are only sent to us if you submit the contact form.

We may update this policy to reflect changes in the service or in applicable law. Registered users will be notified by email at least 30 days in advance when the changes are material.