Privacy policy

Effective October 13, 2026

Grantory is built to hold as little as possible. This policy explains what Grantory collects, why, how long we keep it, and what you can ask us to do with it.

1. Who is responsible

For your account and for visits to this website, Grantory is the controller of personal data.

For the content an organization puts into Grantory, such as people, teams, systems, requests and approvals, the organization is the controller and we act as its processor. That processing is governed by our data processing addendum.

2. What we collect

Account data
Your name, work email, a hashed password, your organization and your role in it.
Organization content
The access model you describe: teams, workspaces, resources, access levels, requests and their reasons, approvals, provisioning notes, expiry and review dates, findings and the audit trail.
Public request forms
The name, email and reason someone enters when they ask for access through your organization's form.
MCP keys
A SHA-256 hash of each key, its name, owner and last use. We never store the key itself.
Technical data
IP address, browser user agent and request time in server logs, and the cookies listed in the cookie policy.
Billing data
The billing contact, the number of people counted each month, and invoices. Card details are handled by our payment provider and never reach us.

3. What we do not collect

Grantory has no connectors to your infrastructure. We do not receive credentials, tokens, repository content, logs or customer data from the systems you list. This website uses no analytics, no advertising tags and no third-party fonts.

4. Why we use it

  • To provide the service you signed up for, including notifications you configure. Legal basis: performance of a contract.
  • To keep the service secure, investigate abuse and fix errors. Legal basis: our legitimate interest in a working, safe service.
  • To bill and keep accounting records. Legal basis: contract and legal obligation.
  • To answer you when you write to us. Legal basis: legitimate interest.

We do not sell personal data, use it for advertising, or use organization content to train models.

5. Who we share it with

Only with the subprocessors that run the service, with Slack when an organization adds a webhook, and with authorities where the law requires it. Each subprocessor is bound by a written agreement.

6. How long we keep it

  • Account data and organization content: while the organization is active.
  • After cancellation: deleted within 30 days of the end of the paid period. Backups roll over within a further 30 days.
  • Server logs: up to 30 days.
  • Invoices and billing records: as long as tax law requires.

Inside an active organization, an administrator can anonymize a former member. Their decisions stay in the ledger under a placeholder name.

7. International transfers

Where data leaves the European Economic Area, we rely on an adequacy decision or the European Commission's standard contractual clauses.

8. Your rights

You can ask for access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interest. If your data sits in an organization's Grantory, we will pass your request to that organization, since they decide about it. You can also complain to your local data protection authority.

Write to hello@grantory.pro. We answer within one month.

9. Security

See security and data for how the service is built. If we learn of a breach affecting your data, we will tell you without undue delay.

10. Changes

We will post changes here and update the effective date. If a change matters for how your data is used, we will tell account owners by email before it takes effect.