Privacy Policy
Effective 9 November 2026. Plain-language version.
This policy explains what personal data Gridlode processes about customers and about people who appear in public web data, and the rights you have.
1. Customer data
- Account data: email, name, hashed password, plan and billing records.
- Usage data: API requests (engine, parameters, status, timing), used for billing, support and abuse prevention.
- Website analytics: on our public pages (never in the dashboard or admin) we use Google Analytics through Google Tag Manager and Microsoft Clarity to understand how visitors use the site. Clarity records anonymized page interactions with form fields masked. In the EEA, UK and Switzerland these run only after you accept them in the cookie banner; elsewhere you can decline at any time through Cookie settings in the footer. We run no advertising trackers.
We keep request logs for up to 13 months and account data for as long as your account is open, plus what tax law requires.
2. Data in our results
Our engines return publicly available data. We design them to minimize personal data: RDAP results never include registrant names or emails, WHOIS text redacts personal emails and phone numbers by default, and our page tools respect robots.txt.
Where results contain personal data, our legal basis is legitimate interest (GDPR Art. 6(1)(f)), assessed and documented. We keep provenance (source URL and time) and use short retention for cached copies.
3. Your rights
You can request access, correction, deletion, restriction or objection, and you can opt out of any sale or sharing of personal information. Use our public opt-out page or email [email protected]. We respond within 30 days.
Removed records are added to a suppression list so they stay out of future results.
4. Sharing
We use service providers for hosting, email, payments and website analytics (Google, Microsoft Clarity) under data-processing agreements. We don't sell customer account data.
5. Security
Passwords are hashed with scrypt, API keys are stored only as hashes, traffic is encrypted in transit, and access to production systems is restricted.
6. International transfers
Our servers are in Germany (EU). Where data leaves the EEA we rely on Standard Contractual Clauses.
Questions: [email protected]