Privacy Policy

How Grawl collects, uses and protects your information.

Last revised on: 23 October 2026

This policy is a template prepared for launch. Have it reviewed by a lawyer before relying on it, and complete the bracketed details.

Grawl (“we”, “us”) is operated by [OPERATOR LEGAL NAME], an individual based in [CITY, STATE], India, and is the data controller for the hosted service at https://app.grawl.net and the website at https://grawl.net. If you run a self-hosted copy of the open-source software, the operator of that deployment controls the data processed there and this policy does not apply.

1. Information we collect

Account information. Name, email address, password hash or Google sign-in identifier, workspace name, and role.

Billing information. Our merchant of record, Paddle, collects your payment details, billing address and tax information. We never see your full card number. We receive your Paddle customer id, subscription status, and transaction amounts so we can grant credits and show invoices.

Product data you create or connect. Projects, domains, keywords, rank-tracking configurations, audits, saved content, chat sessions with the in-app agent, and any Google Search Console or Google Analytics data you choose to connect.

Usage and device data. Pages viewed, features used, approximate location derived from IP address, browser and device type, and error reports. We use PostHog for product analytics and may use Cloudflare logs for security.

Support communications. Emails you send us.

2. How we use information

  • To provide and operate the service, including fetching SEO data for your requests and metering credits.
  • To process payments, grant credits, prevent fraud and send billing emails (through Paddle).
  • To send transactional emails (verification, password reset, invitations) and, if you opt in, product updates.
  • To understand how the product is used and to fix bugs.
  • To comply with legal obligations and enforce our Terms.

We do not sell personal information and we do not use your data to train AI models.

3. Google user data

When you connect Google Search Console or Google Analytics, we request read-only access and use the data only to display your own search and analytics performance inside Grawl and to your connected AI agents. We store access tokens encrypted at rest and cache reports to serve them faster. You can disconnect at any time from Settings, which deletes the stored tokens. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Processors and third parties

We share data with providers who process it on our behalf:

ProviderPurpose
Paddle.comPayments, invoicing, tax, refunds (merchant of record)
CloudflareHosting, storage, security
DataForSEOSEO, SERP, backlink and AI-visibility data requests (we send the keywords, domains and prompts you query)
OpenRouter and the model providers it routes toAI features and the in-app agent (we send the content you ask it to process)
GoogleSearch Console and Analytics data you connect; Google sign-in
Resend / LoopsTransactional and product emails
PostHogProduct analytics and error tracking
DubReferral attribution for partner links

We may also disclose information when required by law or to protect our rights and users.

5. International transfers

We are based in India and our providers operate in the United States, the European Union and other countries. Where required, transfers are protected by standard contractual clauses or equivalent safeguards offered by the provider.

6. Retention

Account and product data are kept while your account is active. Chat sessions, audit scratch data and cached reports are pruned on a rolling basis. When you delete your account we erase your personal data within 30 days, except billing records Paddle and we must retain for tax purposes (typically 7 years) and backups that expire on their own schedule.

7. Your rights

Depending on where you live you may have the right to access, correct, export, restrict or delete your personal data, to object to certain processing, and to lodge a complaint with a supervisory authority. Email support@grawl.net to exercise these rights. We respond within 30 days.

8. Cookies

We use strictly necessary cookies for sign-in and session security, and analytics cookies for PostHog. Partner links may set a referral cookie (dub_id) for up to 90 days. You can block analytics cookies in your browser without affecting sign-in.

9. Security

Data is encrypted in transit (TLS) and OAuth tokens are encrypted at rest. Access to production systems is limited to the operator. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as required by law.

10. Children

The service is not directed to anyone under 18 and we do not knowingly collect their data.

11. Changes

We will post updates here and, for material changes, notify you by email or in-app at least 14 days before they take effect.

12. Contact

Grawl, [OPERATOR LEGAL NAME], [POSTAL ADDRESS], India. Email: support@grawl.net.

Grawl