Privacy policy

1. What we collect

Account details: your name, email address, password (stored only as a one-way hash), and, if you sign in with Google, the name, email and profile picture Google shares with us.

Organization and site details you enter: business name, website addresses, brand description, services, locations, competitors, keywords and the questions you want tracked.

Data we gather about the websites you add: public pages we crawl for site checks, ranking positions, AI assistant answers that mention your brand or competitors, and basic facts the plugin reports from your WordPress site (post counts, theme, SEO plugin, plugin version).

Content you create or approve in Gralus: drafts, landing pages, SEO fixes, and the record of what was published or undone.

Usage and technical data: pages you open in the app, actions you take (kept in an audit log for your organization), IP address, browser type, and the emails we sent you and whether they were delivered.

2. How we use it

• To run the service: track rankings and AI answers, check your site, plan tasks, write drafts and publish what you approve.
• To send the emails you asked for: sign-in links, confirmations, approval requests, site-check results, reports, trial reminders. You can turn the optional ones off in Settings → Profile.
• To keep accounts safe: rate limiting, fraud and abuse prevention, security notices.
• To improve the product, using aggregated statistics that do not identify you.

We do not sell personal data and we do not show ads.

3. Google user data

If you choose "Continue with Google", we request only your basic profile (name, email, picture) to create and sign in to your account. We do not access Gmail, Drive, Calendar or any other Google data. Gralus's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

4. Who else sees your data

Service providers that help us run Gralus, under contracts that limit them to our instructions: hosting (Hetzner / our own servers), email delivery (SecureSMTP), search data (DataForSEO), AI model providers used to draft content (Anthropic, OpenAI) and payments (Stripe, which handles card details — we never store them).

Your own WordPress site, which receives only the content and SEO changes you approve, through the Gralus plugin.

People you invite to your organization, and anyone you give a share link to, see what you choose to share.

Authorities, when the law requires it.

5. Crawling and the GralusBot user agent

Site checks fetch public pages of the websites added to an account, identified as GralusBot. We respect robots.txt, keep a slow request rate, and never try to log in or read private areas. Site owners can block GralusBot in robots.txt at any time.

6. How long we keep it

While your account is active, plus 30 days after you cancel so you can export or reactivate. Tracking history, drafts and logs are deleted after that. Backups are rotated within 35 days. Email delivery logs are kept for 90 days. Legal and billing records are kept as long as the law requires.

7. Your choices and rights

• See and change your details any time in Settings → Profile.
• Export your data by asking us by email.
• Delete your account from Settings → Profile; organizations where you are the only member are deleted with it.
• Turn optional emails off in Settings → Profile.
• If you are in the EU/UK, you also have the rights to access, correct, restrict, port and object, and to complain to your data protection authority.

8. Cookies

We use only the cookies needed to keep you signed in and to remember your current organization and site. There are no advertising or cross-site tracking cookies.

9. Security

Data is encrypted in transit (HTTPS) and at rest for secrets such as WordPress connection keys. Passwords are hashed with scrypt. Access to production systems is limited to people who need it. If we ever discover a breach that affects you, we will tell you without undue delay.

10. Children

Gralus is for businesses and is not directed at children under 16. We do not knowingly collect their data.

11. Changes

If we change this policy in a way that matters, we will email account owners and update the date at the top of this page.