Privacy Policy

Grimblo ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at grimblo.com and our platform (collectively, the "Service"). Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

1. Information We Collect

Information You Provide

• Account data: Name, email address, and password when you register.
• Identity page data: Profile name, bio, avatar, links, and content blocks you add to your identity page.
• Payment data: Billing details processed by Stripe. We do not store full card numbers on our servers.
• Communications: Messages you send us via email or support channels.
• Affiliate data: Stripe Connect account details if you participate in the affiliate program.

Information Collected Automatically

• Usage data: Pages visited, links clicked, referral sources, and session duration.
• Device data: IP address, browser type, operating system, and device identifiers.
• Cookies and similar technologies: We use cookies to maintain session state, remember preferences, and track referral attribution.
• Click data: When visitors interact with your identity page, we record anonymous click events to power your analytics dashboard.

Information from Third Parties

• Stripe: Payment confirmation, subscription status, and Stripe Connect account status.
• Domain registrars: Domain availability and registration status for domain-related features.

2. How We Use Your Information

• To create and manage your account and identity pages
• To process payments and manage subscriptions
• To calculate and pay affiliate commissions
• To provide analytics on your identity page performance
• To send transactional emails (receipts, password resets, important account notices)
• To send product updates and marketing communications (you can opt out at any time)
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations
• To improve the Service through aggregated, anonymized analytics

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, we process your personal data under the following legal bases:

• Contract performance: To provide the Service you've signed up for.
• Legitimate interests: To prevent fraud, improve the Service, and communicate with you about your account.
• Consent: For marketing communications and non-essential cookies.
• Legal obligation: To comply with applicable laws and regulations.

4. Sharing Your Information

We do not sell your personal data. We may share it with:

• Stripe: For payment processing and affiliate payouts.
• Infrastructure providers: Cloud hosting and database providers who process data on our behalf under data processing agreements.
• Analytics providers: Aggregated, anonymized data only.
• Law enforcement: When required by law, court order, or to protect the rights, property, or safety of Grimblo, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to you.

5. Public Identity Pages

Your identity page (grimblo.com/@yourname) is public by default. This means your profile name, bio, avatar, and links are visible to anyone on the internet and may be indexed by search engines. You may set your page to unlisted in your identity settings, which will hide it from search engines but keep it accessible via direct link.

6. Cookies

We use the following cookies:

• Session cookies: Required for authentication and keeping you logged in.
• Referral cookies: A 30-day cookie to attribute affiliate referrals correctly.
• Preference cookies: To remember your settings.

You can control cookies through your browser settings, but disabling certain cookies may affect Service functionality.

7. Data Retention

We retain your account data for as long as your account is active. After deletion or termination, we retain data for up to 90 days for fraud prevention and legal compliance purposes, after which it is permanently deleted or anonymized. Billing records are retained for 7 years as required by law.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and associated data.
• Portability: Request your data in a machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Opt-out of marketing: Unsubscribe from marketing emails at any time via the link in any email we send.

To exercise these rights, contact us at privacy@grimblo.com. We will respond within 30 days.

9. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will delete it promptly.

10. Security

We implement industry-standard security measures including encryption in transit (TLS), hashed passwords, and access controls. However, no system is completely secure. We cannot guarantee the absolute security of your information and are not responsible for unauthorized access beyond our reasonable control.

11. International Transfers

We operate primarily in the United States. If you are accessing the Service from outside the US, your information may be transferred to and processed in the US. We rely on standard contractual clauses and other appropriate safeguards for such transfers where required by law.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or by a prominent notice in the Service. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact

Privacy questions or requests: privacy@grimblo.com