1. Introduction
GRC Flow is committed to handling personal data responsibly and transparently. This Privacy Policy explains how personal data may be collected, used, stored and shared when users access or use the platform.
Personal data is processed in accordance with applicable data protection legislation, including the General Data Protection Regulation (GDPR), where applicable.
2. Categories of Personal Data
Depending on how the platform is used, GRC Flow may process the following categories of information:
Account information: details required to create and manage an account.
Authentication information: data used to authenticate users and protect account access.
Project information: information entered into projects, forms, assessments and workflows.
Documents and generated outputs: files, text, reports and other materials submitted to or generated through the platform.
Payment information: transaction and billing information required to manage purchases. Payment card details may be handled directly by the relevant payment provider.
Technical information: logs, diagnostic information and security-related records.
Communications: information included in support requests and other communications with GRC Flow.
The categories of data processed depend on the features used and the information users choose to provide.
3. Purposes of Processing
Personal data may be processed for the following purposes: providing and maintaining the platform; creating and managing user accounts; processing user requests and generating requested outputs; storing project information and deliverables; managing subscriptions and payments; providing customer support; protecting platform security and preventing misuse; meeting applicable legal and regulatory obligations.
4. Legal Bases for Processing
Where required by the GDPR, personal data is processed on an applicable legal basis, which may include:
Contractual necessity: to provide requested services and manage user accounts.
Legal obligation: to comply with applicable legal requirements.
Legitimate interests: to maintain platform security, prevent abuse and improve service reliability, where these interests are not overridden by users' rights.
Consent: where processing requires consent under applicable law. Where consent is the legal basis, it may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Artificial Intelligence Services
Certain platform features may use third-party artificial intelligence services to process requests and generate documents, assessments or recommendations. Where necessary to provide these features, relevant user-submitted information may be transmitted to the applicable AI service provider.
Users should avoid submitting passwords, authentication credentials or personal or confidential information that is unnecessary for the requested task. The handling of submitted information by an AI provider may also be subject to that provider's applicable terms and data protection arrangements.
6. Third-Party Service Providers
GRC Flow may rely on external providers for services such as hosting, databases, authentication, payment processing, email delivery and artificial intelligence. Personal data may be shared with these providers where necessary to operate the platform, provide requested services, maintain security or meet legal obligations.
Where required, appropriate contractual and organisational safeguards are used to govern the handling of personal data by service providers. GRC Flow does not sell personal data to advertisers.
Website hosting: Render, Frankfurt, Germany. Application hosting: Vercel, Frankfurt, Germany. Database: Neon, Frankfurt, Germany. Network protection and delivery: Cloudflare, global network.
Artificial intelligence: OpenAI, which may process data outside the European Union. If it cannot answer, and unless you restrict the providers in your settings, Anthropic, which may process data outside the European Union, or DeepSeek, which processes data in China, may be used where available.
Payments: Stripe. Email delivery: Google (Gmail). Google sign-in: Google and Neon.
7. International Data Transfers
Where personal data is transferred outside the European Economic Area, GRC Flow will apply appropriate safeguards where required by applicable data protection law. These may include an adequacy decision or approved contractual safeguards, depending on the circumstances.
8. Data Retention
Personal data is retained only for as long as necessary to fulfil the purposes described in this Policy, subject to applicable legal obligations and legitimate security requirements. Retention periods may vary depending on the type of data, the relevant service and the reason the information was collected.
Users can permanently delete any deliverable at any time from their Deliverables: the deliverable, all its versions and the information entered to produce it are erased from the platform. The deletion is immediate and cannot be undone.
9. Data Security
GRC Flow applies appropriate technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration or disclosure. No online system can guarantee absolute security.
Users should avoid submitting sensitive information that is not necessary for their intended use of the platform.
10. Data Protection Rights
Subject to the conditions and limitations established by applicable law, individuals may have the right to: access their personal data; request correction of inaccurate or incomplete data; request deletion of their data; request restriction of processing; receive certain personal data in a portable format; object to certain processing activities; withdraw consent where processing is based on consent; lodge a complaint with a competent data protection authority.
Requests concerning personal data may be submitted to [email protected]. Individuals may also contact the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados — CNPD) or another competent supervisory authority.
11. Cookies and Similar Technologies
GRC Flow may use cookies and similar technologies necessary for the operation, security and functionality of the platform. Where consent is legally required, non-essential cookies and tracking technologies will only be used after the required consent has been obtained.
12. Changes to This Policy
This Privacy Policy may be updated to reflect changes in the platform, its service providers or its data processing practices. The latest version will be published on the GRC Flow website, together with its effective date.
13. Contact
For questions or requests concerning this Privacy Policy or the handling of personal data, contact: Email: [email protected]