Privacy Policy
Last updated November 4, 2026
This policy explains what personal information Granur Inc. ("Granur", "we", "us") collects, how we use it, who we share it with, and the choices and rights you have. It covers our website at granur.app and the Granur application.
Granur is used by organizations to manage their vendors and contracts. When an organization ("customer") uses Granur, the information it puts into the application belongs to that customer. We process it on the customer's behalf and under its instructions, as described in section 3.
1. Information we collect
We collect the following kinds of information:
- Account information: your name, work email address, organization, role, and a securely hashed password. If your organization enables Google or Microsoft sign-in, we receive your name and email address from that provider.
- Usage information: when you last signed in, how many times you've signed in, and when you were last active, so organizations can manage their users. We keep an audit log of actions taken in the application.
- Customer content: the contracts, documents, vendor details, evaluations, certificates, comments and other information customers add to Granur, including the text extracted from uploaded files.
- Vendor contacts: names, email addresses and phone numbers of vendor representatives that customers record, and details that vendors submit themselves through a document request link.
- Billing information: plan and payment history. Card details are collected and stored by Stripe, our payment processor, and never reach our servers.
- Website forms: when you request a demo or a free trial, contact us, write to support, or download a resource, we collect the details you enter, such as your name, email address, company and message, and whether you agreed to receive marketing emails.
- Website analytics: on our public website we count page visits with Vercel Web Analytics, which records the page, referring site, country and device type without cookies and without building a profile of you.
- Device settings: your display preferences (such as light or dark mode and region) and, if you turn them on, browser push notification subscriptions.
2. How we use information
Where the EU or UK GDPR applies, we rely on these legal bases: performing our contract with you or your organization; our legitimate interests in running, securing and improving our service and responding to business inquiries; your consent for marketing emails; and compliance with legal obligations.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
- To provide, secure and support the Granur application, including signing you in and sending service emails such as reminders, mentions, signature requests and document requests.
- To analyze uploaded documents with AI at a customer's request, for example to extract contract terms and obligations or review a SOC 2 report (see section 4).
- To process payments and manage subscriptions.
- To respond to demo requests, questions and support messages.
- To send marketing emails, only if you opted in. You can unsubscribe at any time.
- To comply with legal obligations and to protect Granur, our customers and others against fraud and abuse.
3. Customer content
For customer content, the customer is the controller (or "business") and Granur acts as its processor (or "service provider"). We use customer content only to provide the service to that customer, and not for our own purposes. If your information is in Granur because an organization you work with uses it, such as when you are a vendor contact, please contact that organization with questions or requests, and we will help them respond.
4. AI features
Some features send document text to Anthropic, our AI provider, to extract contract fields and obligations, review SOC 2 reports, analyze risk, and answer questions about your contracts. Anthropic processes this data on our behalf to return results to us. Under its commercial terms, Anthropic does not use this data to train its models. We do not use customer content to train AI models either.
AI output can contain mistakes. Granur shows AI results for a person to review before they are relied on.
6. Where information is stored and international transfers
Granur is a US company, and we store and process information in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your information is transferred to the United States. We protect these transfers with appropriate safeguards, such as the European Commission's Standard Contractual Clauses, or providers' certification under the EU-U.S. Data Privacy Framework where available.
7. How long we keep information
We keep account information and customer content for as long as the customer's account is active. When an owner closes an organization's account, we permanently delete its content after 30 days. If a free trial ends without a paid plan, we permanently delete its content 90 days after the trial ends. We delete declined free trial requests after 30 days. We may keep some information for longer when we need it to meet legal, tax or accounting obligations or resolve disputes. We keep website inquiries for as long as needed to respond and follow up, and marketing contact details until you unsubscribe.
8. Security
We use industry-standard measures to protect information, including encryption in transit, hashed passwords, access controls within each organization, and an audit log of actions. No system is perfectly secure, so we can't guarantee absolute security. If you believe you've found a security issue, please tell us using the form in section 13.
10. Your rights
Depending on where you live, you may have the right to access your personal information, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent at any time. Residents of California and other US states with privacy laws have similar rights, including the right to know what we collect and to request deletion, and we will not discriminate against you for using them.
To exercise your rights, use the privacy request form in section 13. We may need to verify your identity. If your information is part of an organization's account, we may refer your request to that organization. If you are in the EEA or UK, you also have the right to complain to your local data protection authority.
11. Children
Granur is a business service and is not intended for children. We do not knowingly collect information from anyone under 16.
12. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new "last updated" date, and if the changes are significant, we will notify customers by email or in the application.
13. Contact us
For questions or requests about privacy, including access, correction or deletion, use the form below and we'll reply by email. Granur Inc.