Privacy statement
This statement explains what personal data Gridfloo handles, why, where it is kept and what you can ask of us. We have tried to write it plainly and to describe only what the product actually does.
1. Who we are
Gridfloo is provided by Leworks International AB, Bellmansgatan 22C, 118 47 Stockholm, Sweden (“we”, “us”). Questions about privacy go to privacy@gridfloo.com.
2. Our role: controller or processor
- Your own account and personal space. For your Gridfloo account itself (who you are, how you sign in) and anything you keep in your personal space, we are the controller.
- A company or group workspace. When an organisation uses Gridfloo, the work its people put in its workspace belongs to that organisation. For that data the organisation is the controller and we process it on its behalf, under its instructions. If you are a member of a company’s workspace, questions about that data are best directed to the company first. Organisations can ask us for a data processing agreement.
3. What we collect
| What | Where it comes from |
|---|---|
| Name, email address, profile photo and account identifier | The Microsoft or Google account you sign in with |
| Profile details you choose to add (about text, time zone, address name at gridfloo.com) | You |
| Work you create: flows, items, comments, documents, files, time entries, forms | You and the people you work with |
| Email from mailboxes you connect: messages, attachments, folders or labels, and whether you have dealt with them | Microsoft Graph or the Gmail API, only for mailboxes you connect |
| Calendar events from calendars you connect, and events you create in Gridfloo | Microsoft Graph or Google Calendar, only for calendars you connect |
| Zoom meetings you make from Gridfloo: the meeting’s id and join link, and your Zoom user id and email address | Zoom, only if you connect a Zoom account |
| Contacts you save or that appear in your work | You and connected mail |
| Technical data: sign-in times, basic request logs, language preference | Your browser and our hosting |
Connecting a mailbox or calendar is always a separate choice you make, and Microsoft or Google shows you exactly which permissions Gridfloo asks for before you agree. You can disconnect it at any time.
4. Why we use it (and the legal basis)
- To provide Gridfloo — signing you in, showing and syncing your work, mail and calendar, sending notifications you asked for. Basis: performance of our agreement with you or with your organisation.
- To keep it secure and working — preventing abuse, fixing faults, keeping logs. Basis: our legitimate interest in running a safe service.
- To meet legal obligations — for example bookkeeping. Basis: legal obligation.
We do not sell personal data, we do not use it for advertising, and we do not use the content of your mail, calendar or work to train AI models.
5. AI features
Some features (the Assistant, suggestions, briefs, translation, summaries, writing help in documents, and transcripts of voice messages) send the content needed for that one task to an AI provider and show you the answer. The content can be text, a document or a picture you ask about.
- Who: Anthropic and OpenAI, and Moonshot AI only where a workspace admin has allowed it (section 6). Workspace admins choose which of them may be used, and Gridfloo never switches to one that is not allowed.
- Training: Anthropic and OpenAI process it on our behalf under their business terms and do not use it to train their models. Moonshot AI’s terms do not clearly rule this out, which is why it is off unless a workspace admin chooses to allow it.
- Kept by the provider: Anthropic and OpenAI may keep a request for up to 30 days to detect abuse, then delete it. Moonshot AI does not state how long it keeps requests.
- Kept by Gridfloo: your conversations with the Assistant are kept in your Gridfloo account, like your other chats, for as long as you have the account.
Google user data
When you connect a Google account, Gridfloo reads, labels, drafts and sends Gmail messages and reads calendar events only to show them to you in Gridfloo and to carry out what you ask it to do there. Gridfloo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and no person reads it unless you ask us to (for support), it is needed for security, or the law requires it.
Zoom
When you connect a Zoom account, Gridfloo uses it only to create, update and delete the meetings you book in Gridfloo and to fetch your cloud recordings of those meetings. Gridfloo does not read your other Zoom meetings, contacts or chats. Disconnecting in Gridfloo, or removing the Gridfloo app in Zoom, deletes the stored connection.
6. Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Supabase | Database: accounts, work, mail and calendar data | Japan (Tokyo) |
| Cloudflare (R2) | File storage: uploaded files, mail attachments, chat files, profile photos, receipts and logos | Asia-Pacific |
| Amazon Web Services | Nightly off-site backups, encrypted with our own key before they leave, so Amazon cannot read them | Singapore |
| Amazon Web Services (SES) | Sending workspaces’ campaign mail, and the reports of whether it was delivered, opened or clicked | EU (Stockholm, Sweden) |
| GitHub | Runs the nightly backup job; data passes through briefly, and is encrypted before it is stored | United States |
| Vercel | Hosting the application | Global, including the United States |
| Microsoft | Sign-in, and mail and calendar for accounts you connect | According to your Microsoft account |
| Sign-in, and mail and calendar for Google accounts you connect; web fonts | Global | |
| Anthropic | AI features (section 5) | United States |
| OpenAI | Voice message transcripts, and AI features where a workspace allows it | United States |
| Moonshot AI (Kimi) | AI features, only where a workspace admin allows this provider | Outside the EU; the China service in mainland China |
| Stripe | Payments and subscriptions | United States and EU |
| Zoom | Creating, moving and deleting the meetings you book with Zoom, and your cloud recordings and transcripts of them, for Zoom accounts you connect | According to your Zoom account |
| Resend | Sending notification email, and campaign mail when Amazon is not available | United States |
7. Transfers outside the EU/EEA
Some of these providers keep data outside the EU/EEA. Japan is covered by an EU adequacy decision. For transfers to the United States and elsewhere we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses. AI providers outside these frameworks, such as Moonshot AI, receive data only when a workspace admin has chosen to allow them for that workspace.
8. How long we keep it
- Your account and personal space: for as long as you have the account.
- An organisation’s workspace: for as long as the organisation uses Gridfloo, then deleted or returned as agreed with the organisation.
- Campaign mail statistics (who received, opened or clicked a workspace’s mail): deleted 24 months after each mail was sent; an address that unsubscribed is kept, so it is never mailed again.
- Mail and calendar data: while the mailbox or calendar is connected. Disconnecting stops syncing; you can ask us to delete what was synced.
- Deleted files wait in the bin until you empty it, so they can be restored.
- Records we must keep by law (for example invoices) for the period the law requires.
- Backups: copies are kept for 180 days, then deleted. Something you delete therefore disappears from backups within 180 days.
- Audit log: for as long as the workspace exists, and after it is deleted, as a record of what happened.
- AI providers: see section 5.
9. Your rights
Under the GDPR you can ask to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable form. Write to privacy@gridfloo.com; we answer within one month. For data in an organisation’s workspace we may pass your request to that organisation, as it decides about that data.
You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or to the authority where you live.
10. Security
Data is encrypted in transit and at rest (see Encryption on the security page). Access inside Gridfloo is enforced in the database itself, so each person sees only what they are allowed to see. Access tokens for connected mailboxes and calendars are stored server-side and never sent to the browser. Everything is backed up every night to a separate provider, encrypted with our own key, and restores are tested. More on the security page.
11. Cookies and storage in your browser
Gridfloo uses only the cookies it needs to work: keeping you signed in and remembering your language. There are no advertising or tracking cookies.
To open pages faster, Gridfloo also keeps a copy of pages you have recently viewed (such as flows, My day and your mail list) in your own browser, and shows it while it fetches the current version. This copy stays on your device, belongs only to the person who is signed in, is deleted when you sign out or after a week, and is never sent anywhere else. Small preferences, such as light or dark mode and the views you last used, are also remembered in your browser.
12. Changes
When this statement changes in a way that matters, we will say so in Gridfloo before the change takes effect. The date at the top shows the current version.