GrumpiPrivacy policy
This policy explains what personal data Grumpi collects, why, and what your rights are, in accordance with the General Data Protection Regulation (GDPR). This English version is a translation provided for convenience; the French version prevails.
1. Data controller
Brice Mourlon, Head office: in redaction. Contact: support@getgrumpi.com.
2. Data collected and purposes
Customer account: email address, creation date, role. Purpose: providing the customer area and the reports. Legal basis: performance of the contract.
Orders: product purchased, amount, date, Stripe payment identifier. Card details are processed by Stripe only. Purpose: sales and invoicing. Legal basis: performance of the contract and accounting obligations.
Custom report: keywords and industry provided by the customer. Purpose: producing the report. Legal basis: performance of the contract.
Newsletter: email address. Purpose: sending the newsletter. Legal basis: consent, which can be withdrawn at any time via the unsubscribe link.
Technical logs: IP address and connection data, for the security of the service. Legal basis: legitimate interest.
3. Retention periods
Account: until it is deleted, then up to 3 years for commercial correspondence.
Invoices and accounting data: 10 years (legal obligation).
Newsletter: until you unsubscribe.
Technical logs: up to 12 months.
4. Processors
Your data is processed by the following service providers, who are bound by confidentiality and security commitments:
Infomaniak Network SA: Hosting of the website and the application (VPS server) (Switzerland).
Supabase Inc.: User accounts, database and report storage (Servers in the European Union).
Stripe Payments Europe Ltd: Online payment (Ireland (European Union)).
Brevo (Sendinblue SAS): Sending the newsletter and emails (France (European Union)).
Anthropic PBC: Automated analysis of public reviews (no customer data shared) (United States).
Transfers outside the European Union are covered by an adequacy decision (Switzerland, and the United States for certified companies) or by the European Commission's standard contractual clauses.
5. Cookies and local storage
The website uses no advertising cookies and no third-party audience measurement. Only strictly necessary items are stored in your browser: the sign-in session and your display preferences (language, theme, menu state). They do not require consent.
6. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. To exercise these rights, write by email at support@getgrumpi.com. You will receive a response within one month.
You may lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.