Legal

Privacy Policy

Version 2026-10-14-draft · Effective [EFFECTIVE DATE]

Draft for legal review. This document hasn't been approved by counsel yet, and the bracketed details are still to be filled in. It describes how THE GRID works today.

This policy explains what personal information [LEGAL ENTITY NAME] ("THE GRID", "we") collects when you use enterthegrid.co, why, who helps us process it, and the choices you have. We collect only what the service needs, we don't sell personal information, and we don't use advertising trackers.

1. What we collect

Account details: your name, email address and a one-way hash of your password (never the password itself), your role, when you confirmed your email, and when you confirmed you are 21 or older and accepted our terms.
Business information you publish: your headquarters profile, logos and images, categories, location (city and region), social and website links, listings, events, Field Notes, network connections and announcements.
Activity on THE GRID: follows, saves and collections; inquiries you send or receive through The Exchange; notifications and your notification settings; reports you file; feedback you send.
Usage information: which pages and listings are viewed and clicked, recorded with the page, an anonymous de-duplication key and, if you're signed in, your account. We use it for the activity counts businesses see, rankings such as The Pulse, and to improve the service. We don't record your IP address with these events.
Security information: sign-in attempts are counted per account and per network to stop password guessing; the counters hold keyed hashes, not your email or IP address. Security events and an audit log record important account actions by account id. Our hosting provider's logs include IP addresses for a limited time.
Two-step verification (administrators): an encrypted authenticator secret and hashed recovery codes.

2. Cookies

THE GRID uses only cookies it needs to work:

sign-in cookies that keep you signed in (up to 14 days) and protect forms against forgery;
a cookie that remembers you confirmed you are 21 or older (30 days).

There are no advertising, cross-site tracking or third-party analytics cookies.

3. Why we use it

To run THE GRID: your account, your headquarters and Plot, the network, The Exchange and notifications.
To keep it safe: preventing abuse and fraud, enforcing our Terms and Acceptable Use Policy, and securing accounts.
To send account emails: confirming your address, password resets, security notices and the notifications you choose. We don't send marketing email without your consent.
To understand and improve the service using the usage information above.
To meet legal obligations.

4. What other people can see

Business profiles, Field Notes, listings, events, genetics records and public network connections are public.
The business contact channels an operator chooses to publish (website, social profiles, business email and phone) are public. Account (sign-in) email addresses are never shown.
When you send an inquiry through The Exchange, the listing's owner sees your message, your name, the business you represent (if any) and your account email, so they can reply.

5. Who processes it for us

Amazon Web Services hosts THE GRID, its database and uploaded images, and sends its email (Amazon SES), under contract and only on our instructions. Stripe processes Plot Owner payments; card details go to Stripe directly and never reach THE GRID. [Counsel: list any other processors before launch.] We share information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply. We don't sell or rent personal information.

6. How long we keep it

Account and business information: while your account is open.
Raw page-view and click events: [90 days], after which only daily totals remain.
Email links (confirmation, reset): [30 days] after use or expiry.
Audit and security records: [2 years], identified only by account id.
Backups: up to [35 days].

7. Your choices and rights

Access and export: download a copy of your data from your account page.
Correction: edit your account and business details at any time.
Deletion: delete your account from your account page. We remove your personal information except what we must keep by law. Content others have already shared, and audit entries identified only by account id, may remain.
Notifications: choose which notification emails you get.
Depending on where you live, you may have more rights, for example to know, delete or correct information, or to object to or limit some uses. Contact us to use them. We won't treat you differently for doing so.

8. Security

Connections are encrypted (HTTPS). Passwords and recovery codes are stored only as one-way hashes. Authenticator secrets are encrypted. Sign-in is rate-limited, and sessions are signed out everywhere after a password reset. No system is perfectly secure, so please use a strong, unique password.

9. Age

THE GRID is only for adults aged 21 and over. We don't knowingly collect information from anyone younger. If you believe someone underage has an account, tell us and we will delete it.

10. Changes and contact

We will post changes here and, if they are material, tell you before they take effect. Questions or requests: [PRIVACY / LEGAL CONTACT EMAIL], or [LEGAL ENTITY NAME], [REGISTERED BUSINESS ADDRESS].