Privacy Policy

1. Who We Are

GRM ("we", "us", "our") is an outreach automation platform, operated by Moksh Rawat. We are the controller for the account and usage data described below. For the contact data our customers upload and message, the customer is the controller and we are their processor, acting on their instructions.

GRM is operated by Moksh Rawat, India. You can reach us at support@grmhq.com.

2. Information We Collect

• Account information — your name, business name, email address, phone number if you give one, industry, password (stored only as a hash), and your plan and billing status.
• Contact data you upload or create — names, email addresses, phone numbers, company, tags, custom fields and notes for the contacts you add, whether by hand, by file import, through the API or through the website tracking script.
• Message engagement data — for each email we send on your behalf: the recipient address, subject, body, delivery status, and whether it was opened, clicked or replied to. See section 6.
• Website events — if you install our tracking script, the events you configure (such as a page visit, form submission, signup or purchase) and the contact details you choose to send with them. The script does not collect IP addresses, user-agent strings or cookies.
• Consent records — when a contact opts in or out, what method and timestamp we recorded, and any IP address supplied at the time.
• Payment and invoice records — handled by our merchant of record, see section 7. We store invoice references and amounts, not your card details.
• Service and audit data — sign-in attempts, session tokens, API keys, job and webhook logs, and the actions you take in the product, used for security, debugging and support.

3. How We Use Your Information

• to provide the Service — storing contacts, running your sequences, and sending the messages you configure;
• to show you analytics about your own campaigns;
• to process payments, invoices and subscription changes;
• to send service messages such as email verification, trial reminders, weekly performance summaries and important account notices;
• to secure the Service — detecting abuse, preventing unauthorised access and enforcing our Terms;
• to answer your support questions;
• to meet our legal, tax and accounting obligations.

We do not sell your personal information, we do not use your contacts to market our own products, and we do not run advertising or cross-site tracking cookies on this website.

4. Legal Bases (if you are in the EEA or UK)

We process account and billing data to perform our contract with you; security, abuse prevention and service logs on the basis of our legitimate interests; and certain records to comply with legal obligations. Where we rely on consent, you can withdraw it at any time without affecting your use of the parts of the Service that do not need it.

5. Cookies and Similar Technologies

We use one essential cookie to keep you signed in. It is required for the Service to work and cannot be turned off while you are logged in. We do not use advertising or analytics cookies of our own.

Two third parties are loaded when you use this website:

• Cloudflare Turnstile — a bot-protection challenge on our signup and sign-in forms. Cloudflare receives your IP address and browser characteristics, and may set cookies as part of the challenge.
• Google Fonts — the typefaces used across the site are served by Google, which means your IP address is sent to Google when a page loads.

Neither is used to build an advertising profile of you. If you block them, the site still works, though the typefaces may fall back to your system fonts and the sign-up form's bot check may not load.

6. Email Tracking

Emails sent through GRM contain a small invisible image and use link redirects so that we can tell the sender whether a message was opened or clicked. This means that when a recipient opens or clicks an email, we record that event — and, like any web request, it reveals the time and the recipient's IP address to our servers. We use this only to produce the sender's own campaign analytics and to suppress further messages where required. If our customers need to disclose this tracking to their recipients, our Terms require them to do so.

7. Sharing and Sub-processors

We do not sell your personal information. We share data only with the providers that make the Service work, and only as much as each one needs:

• Resend — delivers the emails you send and reports delivery events such as bounces and complaints.
• Dodo Payments — our merchant of record, handling payment, tax and invoicing.
• Supabase — hosts our PostgreSQL database.
• Render — hosts our application servers.
• Cloudflare — provides the bot-protection challenge on our sign-in and sign-up forms.
• Google — serves the web fonts used on this site.

SMS delivery is not currently available, so no SMS provider is in this list. If we enable SMS we will add the provider here before it goes live.

These providers are bound to use your data only to deliver their part of the Service. We may also disclose data if the law requires it, or to protect the rights, safety and integrity of the Service. If we ever change this list, we will update this page and, for a material change, tell account owners by email.

If you need a Data Processing Agreement, we can provide one — contact us and we will send our current template.

8. International Transfers

Our providers store and process data in the United States, and our operations are run from India. Where personal data protected by the GDPR is transferred out of the EEA or the UK, we rely on the Standard Contractual Clauses with our providers, or on another lawful transfer mechanism. You can ask us for details of the mechanism that applies to a given transfer.

9. Data Retention

We keep your account and contact data for as long as your account is active. Beyond that:

• Deleting your account removes your account, contacts, sequences, settings, logs, consent records and API keys immediately and permanently. There is no 30-day waiting period.
• Deleting a contact is a soft delete for 30 days, so that an accidental deletion can be recovered and so we do not re-import the same person; the record is then purged.
• Email and SMS logs are kept for up to 13 months for campaign analytics and deliverability troubleshooting; the rendered message body is cleared after 90 days.
• Website tracking events are kept for up to 180 days.
• Webhook and job records are kept for up to 90 days for debugging and abuse investigation.
• Billing and tax records are kept as long as the law requires, held by our merchant of record.

Backups are retained on a rolling basis and expire automatically. Because a backup is a point-in-time copy of the whole database, a deletion may survive briefly inside one until it rotates out.

10. Your Rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, receive a portable copy, restrict or object to certain processing, and withdraw consent. You may also have the right not to be discriminated against for exercising these rights.

In the product you can export your account data and delete your account or individual contacts yourself, without asking us. For anything else, email support@grmhq.com and we will respond within 30 days. We may ask you to verify your identity first, and you may use an authorised agent to make a request for you. If we refuse a request we will explain why, and you may complain to your local data protection authority. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, so there is nothing to opt out of.

11. Security

We protect your data with encryption in transit (TLS) and at rest at the database level, hashed passwords, coarse and fine-grained rate limiting on authentication, session invalidation, signed link and webhook verification, and strict tenant isolation so that one account can never see another's data. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authority as and when the law requires.

12. Children

The Service is a business tool and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this policy. When we make a material change we will update the date at the top and tell account owners by email before it takes effect. Continuing to use the Service after that means you accept the updated policy.

14. Contact

For any privacy question or request, email support@grmhq.com or use our contact page.

GRM. Operated by Moksh Rawat, India.