Privacy Notice

1. Who is responsible

Raja Ratna Prakash Padala, trading as Open Minds, operates GRID. Contact [email protected] or write to the correspondence address in the Terms and Conditions. This notice describes actual categories of processing across enabled features; it is not a claim that every feature collects every category from every user. When an organization controls the purposes of its work-related processing, it may have separate controller or equivalent responsibilities. Contact that organization for its instructions and notices as well as contacting us for GRID’s own processing.

2. Information GRID handles

Account and identity information can include name, username, email, email-verification status, optional profile picture, bio, contact information and organizational membership. Authentication information includes a password hash where password login is used, verified identity-provider identifiers, session identifiers and security events; we do not need your Google password.

Work information includes threads, phases, posts, Flowboard cards and groups, Flowdocs, images and other attachments, connections and permissions, version identifiers, sharing and lock states, invitations and work-related messages. GitHub connections can provide authorized repository, contributor and commit/change information. Dev Monitor, when installed and enabled, can provide scoped code changes, errors, outputs, activity and project/device context described in section 10 of the Terms.

Derived information can include work episodes, source attribution, summaries, ledgers, skills, explanations, suggestions and routing proposals. These are interpretations of evidence, can be inaccurate and are not factual certifications. Technical information can include IP address, connection/device status, browser or operating-system details, request logs, performance and security diagnostics. Support correspondence and billing/order information are handled where relevant. A payment provider may collect payment details directly.

3. Purposes and lawful grounds

We process information to create and secure accounts, provide requested collaboration and sharing, store and display work, synchronize authorized devices and integrations, run enabled AI interpretations, deliver invitations and service email, provide support, prevent fraud and abuse, measure and improve service reliability, administer orders and comply with applicable legal obligations.

The legal ground depends on the purpose and applicable law: performance of a requested service or contract, a legal obligation, a lawful legitimate interest where that basis exists, or valid consent where required. A contract or legitimate interest is not a substitute for a separate consent that the law requires. Optional monitoring, marketing or other additional purposes must have the required notice, choice and authorization. We do not treat accepting the terms as unrestricted consent to every processing purpose.

4. Visibility, recipients and organizations

Public profiles and material made public are accessible without login. Private work is provided to authorized collaborators, recipients and organization administrators according to permissions and enabled sharing. A skill made visible from private work does not itself open the private source thread. Recipients can retain authorized shared group copies and downloaded material; later changes may not recall those copies.

We use providers for hosting, databases, media delivery, authentication, communications, AI inference and payments where enabled. Current integrations include OpenAI and TypeSafe Jev for eligible AI processing, Cloudinary for media, Google for optional sign-in, and Zoho/ZeptoMail for transactional email. The information sent depends on the task; these providers are not granted general permission by these terms to publish private work. We remain responsible for the provider arrangements and safeguards that applicable law requires.

Access by our personnel must be limited to a legitimate support, operational, safety or legal need. We may disclose information for a valid legal demand, protection of rights or safety, or a lawful business transfer, subject to applicable safeguards. We do not obtain a right through these terms to sell private code, publicly advertise private projects or train general-purpose models on private content.

5. Device capture and your controls

Dev Monitor should be installed only on authorized devices and capture only an enabled, lawful scope. Project files, output and error text can contain secrets or third-party personal data. Review permissions and exclusions and report accidental capture promptly. This notice is not a representation that every secret is automatically removed.

Pausing capture, revoking an integration, unlinking a device and deleting existing server-held information are separate actions. Remote instructions require the device to receive them; an offline device cannot apply them immediately. Locally buffered data and previously transmitted evidence can therefore require separate handling. Where the application provides a review period, use it to correct or delete eligible information before it locks, without losing later statutory rights.

6. AI processing and consequential decisions

Eligible source evidence, attribution context and task instructions may be sent to the configured AI providers to prepare the interpretations you enable. Deduplication and caching may reduce repeated processing; they do not change the original evidence. Outputs may be re-evaluated, corrected, marked pending or superseded. Public display remains subject to the permitted projection.

You can contest incorrect personal attribution or a skill explanation through support. Candidate discovery, if enabled, must use permitted information and applicable user choices. Organizations must provide meaningful human review before consequential recruitment or employment decisions and establish their own applicable legal grounds. This notice is not consent to sole automated decisions producing legal or similarly significant effects.

7. Retention and deletion

Retention depends on the data and purpose: active account and work records while needed for the service; authentication and security records for an appropriate protection period; billing records for applicable accounting law; and limited information for valid disputes, legal holds or obligations. Local drafts, browser caches, shared copies and provider backups can have different lifecycles.

A lock preserves application integrity but does not create an unlimited retention right. We will assess deletion, correction and restriction requests against applicable law, the specific record, other participants’ rights and any necessary retention ground. Where retention is required, access and use must be limited to that ground; backup copies should not be restored into ordinary use after a valid deletion without applying that deletion again. We do not promise immediate removal from every backup or another recipient’s independent copy.

Contact support for the retention or deletion treatment of a particular category or record. Retention is assessed by the particular purpose, applicable legal requirements, the need to resolve a dispute and the rights of the people involved; a lock alone does not set a permanent retention period.

8. Security and international processing

GRID uses account authentication, authorization and other safeguards intended to protect information. No system can guarantee absolute security. Use strong credentials, protect device-pairing commands, review recipients and report suspected exposure to support. We do not claim that all messages are end-to-end encrypted or that all information stays in India.

Providers or infrastructure may process information in other countries. Where the law requires a transfer mechanism, contractual protection, notice, consent, representative or assessment, that requirement must be satisfied for the relevant processing. Accepting these terms does not itself implement such a mechanism. Applicable security-incident and breach-notification obligations remain in force and cannot be waived by this notice.

9. Cookies and device storage

GRID uses session cookies and browser storage for authentication, security, theme and layout preferences, navigation state, cached previews and recovery of unsynced work. Private cached data can be present on a shared device; sign out and use the available clearing controls when appropriate. Blocking necessary storage can prevent sign-in or recovery features from working.

This notice does not give blanket consent to advertising cookies or optional cross-site tracking. Any non-essential tracking that requires consent must be separately disclosed and controlled before it is used. External embeds and identity or media providers may operate their own storage under their policies.

10. Requests, complaints and updates

Depending on applicable law, you may have rights to information and access, correction, erasure, restriction, objection, portability, withdrawal of consent, a grievance or nomination. Request them at [email protected] and identify the account or record and the requested action. We may need proportionate verification before disclosing or changing information; we will not request unnecessary identity information. Rights apply as provided by the law currently in force and its commencement provisions.

Withdrawing optional consent does not invalidate prior lawful processing, but the affected optional feature may stop. Essential processing may continue on another valid legal ground where the law allows; we will explain any applicable refusal or retention ground. An organization-controlled record may also require the organization’s response. You may complain to the competent privacy authority or use applicable statutory remedies without first waiving those rights.

Self-service GRID accounts are for people aged 18 or older. Report suspected underage use promptly so it can be assessed and addressed lawfully. We may update this notice with a new version and provide appropriate notice of material changes; a new purpose requiring consent needs a separate lawful choice. Grievance Officer: Raja Ratna Prakash Padala. Email: [email protected]. Correspondence: GITAM University, Yendada, Andhra Pradesh 530045, India.