Privacy policy
Last updated: [DATE OF PUBLICATION]
1. Who is responsible for your data
The controller of your personal data is [COMPANY LEGAL NAME], [REGISTERED ADDRESS], Poland, NIP (VAT ID): [NIP] ("GrandNode", "we", "us"). For anything about your data write to [PRIVACY E-MAIL] or support@grandnode.com.
2. What we collect
- Account: name, e-mail address, password (stored only as a one-way hash), company name and, for invoices, billing address and VAT ID.
- Orders: what you bought, when and for how much. Card and PayPal payments are handled by the payment provider; we do not receive your card details.
- Newsletter: your e-mail address and the date you confirmed the subscription.
- Requests you send us: the contents of the contact form, migration quote requests (for example your current platform and store address), early-access sign-ups (including the role you choose) and certification orders.
- Certification and migration work: while we review or migrate a store, we may see personal data that store holds about its own customers. For that data we act as a processor on behalf of the store owner (see section 7).
- AI-readiness check: the store address you enter, to run the check.
- Technical data: IP address, browser, pages visited and the time of the visit, kept in server logs and needed to run and secure the Website.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account, carrying out orders, delivering downloads and services, answering your requests | Contract, Art. 6(1)(b) |
| Invoices and accounting records | Legal obligation, Art. 6(1)(c) |
| Newsletter with new articles and GrandNode releases | Your consent, Art. 6(1)(a) - given by ticking the box when you register or by confirming the link we e-mail you |
| Security of the Website, preventing abuse, server logs | Our legitimate interest, Art. 6(1)(f) |
| Statistics on how the Website is used (only if you accept analytics cookies) | Your consent, Art. 6(1)(a) |
| Establishing or defending legal claims | Our legitimate interest, Art. 6(1)(f) |
Giving data is voluntary, but without the data marked as required we cannot open an account or carry out an order.
4. Who receives your data
We do not sell your data. We share it only with providers that help us run the Website, under agreements that oblige them to protect it:
- hosting: [HOSTING PROVIDER AND LOCATION];
- e-mail delivery: [E-MAIL / SMTP PROVIDER];
- payments: Stripe and Braintree (a PayPal service), which process payment data as independent controllers under their own privacy policies;
- Google Analytics (Google Ireland Ltd.), only if you accept analytics cookies;
- GitHub: some pages show the number of GitHub stars and the latest GrandNode release. Your browser loads these figures directly from GitHub's API, so GitHub receives your IP address when you open those pages;
- accounting and legal advisers, and public authorities where the law requires it.
5. Transfers outside the EEA
Some providers above (Stripe, PayPal, Google, GitHub) may process data in the United States. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
6. How long we keep it
- Account data: while the account exists; when you delete your account (or ask us to), we delete or anonymise it, except what we must keep for orders.
- Orders and invoices: for the period required by tax law (in Poland, 5 years from the end of the year in which the tax payment was due).
- Newsletter: until you unsubscribe or withdraw consent.
- Requests and correspondence: up to 3 years after the matter is closed, unless a contract requires longer.
- Server logs: [LOG RETENTION, e.g. 30 days].
7. Data we process for store owners
When a store owner orders certification or a migration, we may access personal data of that store's customers. We process it only to perform the ordered service, do not use it for our own purposes, and delete our copies when the work is finished. The details are set out in the data processing agreement between us and the store owner [LINK OR "available on request"].
8. Your rights
You have the right to access your data and receive a copy, to correct it, to have it deleted, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. Where we rely on your consent, you may withdraw it at any time; this does not affect processing before the withdrawal. You can delete your account yourself in My account › Delete account; for anything else, write to [PRIVACY E-MAIL]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
9. Cookies
Cookies are small files your browser stores for the Website. We use:
| Cookie | What it does | Type |
|---|---|---|
| .Grand.Customer | Recognises your visit and session - keeps you signed in, remembers your cart and your cookie choice | Necessary |
| .Grand.Antiforgery | Protects forms against cross-site request forgery | Necessary |
| .AspNetCore.Mvc.CookieTempDataProvider | Carries a message from one page to the next, for example after you submit a form | Necessary |
| Google Analytics cookies (_ga, _ga_*) | Count visits and show which pages are used, without identifying you by name | Analytics - only with your consent |
You decide about non-necessary cookies in the cookie banner and can change your choice at any time in privacy preferences or by deleting cookies in your browser. Blocking necessary cookies will stop sign-in and ordering from working.
10. Security
The Website is served only over HTTPS. Passwords are stored as salted one-way hashes, access to data is limited to people who need it, and we keep the software up to date.
11. Newsletter
If you sign up in the newsletter box, we add you only after you confirm the link we send to your e-mail address. If you tick the newsletter box when you create an account, you are added right away. Every newsletter e-mail contains a link to unsubscribe, and you can also change your choice in your account.
12. Changes
We will update this policy when the way we process data changes; the date at the top shows the current version.