Privacy policy

1. Who we are

The controller of personal data is Artem Grigorevykh, individual entrepreneur registered in Georgia (personal number 345788506, Batumi, Georgia), operating the Grigmi platform (“Grigmi”, “we”).

Contact for any privacy question or request: [email protected]. We answer in Georgian, English or Russian.

We have not appointed a Data Protection Officer because the law does not require one for our activity; [email protected] reaches the person responsible for data protection.

2. Two roles: controller and processor

Controller. For the data of people who use Grigmi to build and run their own website — business owners, their staff, studios — and for visitors of grigmi.com itself, we decide why and how data is processed. This policy describes that processing.
Processor. Businesses use Grigmi to run their websites, bookings, shops and chats. The data of *their* customers (for example, a client who books a haircut on a salon’s website) is controlled by that business. We process it only on the business’s instructions under our Data Processing Terms (part of the Terms of Service). Each business website has its own privacy policy; requests about such data should go to the business first — we help them answer.

3. What data we collect and why

Account: name, phone, e-mail (if given), login, password (stored only as a one-way hash) · Why we use it: Create and secure your account, let you sign in, contact you about your account · Legal basis: Contract
Sign in with Google: Google account ID, e-mail, name · Why we use it: Let you sign in with Google instead of a password · Legal basis: Contract; your choice to use it
Two-step verification secret (encrypted) and recovery codes (stored as fingerprints) · Why we use it: Protect your account · Legal basis: Contract; legitimate interest in security
Sign-ins and security log: time, device type, browser, IP address, failed attempts · Why we use it: Detect break-in attempts, show you your active sessions, block abuse · Legal basis: Legitimate interest in security
Your website content: texts, photos, videos, products, prices, settings · Why we use it: Host and show your website, run the admin panel · Legal basis: Contract
Messages to Grigmi support, screenshots and files you attach · Why we use it: Answer your questions · Legal basis: Contract; legitimate interest
Subscription requests and payment status · Why we use it: Provide paid plans and keep accounting records · Legal basis: Contract; legal obligation
AI usage: which AI task ran and how many tokens it used · Why we use it: Count usage against your plan, prevent overspending · Legal basis: Contract
Requests to the AI assistant and its answers · Why we use it: Do what you ask the assistant to do; keep the conversation history you see · Legal basis: Contract
What you write and upload on grigmi.com/start (description of your business, photos, website address) · Why we use it: Build your website · Legal basis: Steps before a contract, at your request
“Free website” applications: name, contact (phone, Telegram), answers · Why we use it: Process your application and contact you · Legal basis: Steps before a contract, at your request
Telegram chat ID, if you connect a Grigmi Telegram bot · Why we use it: Send you the notifications you turned on · Legal basis: Consent (you start the bot); you can stop it any time
Technical data of visits: IP address, browser, pages opened, time · Why we use it: Deliver pages securely, protect against attacks and overload (rate limits) · Legal basis: Legitimate interest in security and operation

We do not sell personal data, we do not use it for advertising, and we do not build advertising profiles.

We do not knowingly collect data of children under 16. Grigmi is meant for businesses; if you believe a child gave us data, write to [email protected] and we will delete it.

4. Artificial intelligence

Tasks without personal data (building a site, design, texts, translations, SEO) may be processed by DeepSeek (DeepSeek, China) and Moonshot AI (Kimi, China). Before every such request our software checks it and does not send it if it finds phone numbers, e-mail addresses, document numbers or names of clients or staff.
Tasks that may involve personal data (the website chat, the assistant working with clients, orders and bookings, support, assistant functions) are processed only by Anthropic (Claude, USA), under Anthropic’s data processing terms with the EU Standard Contractual Clauses. If that model is not available, such a request is not sent to any AI.
Anthropic processes requests only to return an answer and, under its commercial terms, does not use them to train its models.
AI does not make decisions that have legal or similarly significant effects on you. The website chat only answers questions and offers a booking that the visitor confirms with a button.

Grigmi uses AI models to write and translate website texts, build pages, answer questions in the assistant and, if a business turns it on, answer its website visitors in a chat.

5. Who receives data

Hetzner Online GmbH · What for: Servers where the platform and all databases run · Where: Germany (EU)
Cloudflare, Inc. · What for: Network protection, content delivery, DNS, encrypted backups (R2 storage, Eastern Europe region) · Where: USA and worldwide network; backups in the EU
Google LLC · What for: Sign in with Google (only if you choose it) · Where: USA
Anthropic PBC · What for: AI for tasks that may contain personal data (section 4) · Where: USA
DeepSeek; Moonshot AI · What for: AI for tasks without personal data (section 4) · Where: China
Telegram · What for: Notifications through our bots (only if you connect them) · Where: Worldwide

We use these service providers (processors). Each processes data only on our instructions and is bound by confidentiality and security obligations.

The current list is also available at grigmi.com/subprocessors. We announce new providers there at least 14 days before they start processing customer data.

We may disclose data when required by law, at the lawful request of a court or state authority, or to protect the rights and safety of users and Grigmi.

6. International transfers

Our servers are in Germany. Some providers are in other countries (section 5). We transfer personal data outside Georgia and the EU only with appropriate safeguards required by law: transfers to the USA rely on the provider’s data processing agreement with the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. We do not transfer personal data to China: only requests checked to contain no personal data go to the AI providers there (section 4). You can ask us for a copy of the safeguards at [email protected].

7. How long we keep data

Account and website · Period: While the account exists; deleted within 30 days after you ask us to delete it. Sites of unfinished sign-ups and demos are closed after 1–3 days and deleted about 90 days after closing
Sign-in sessions · Period: Up to 120 days
Security log · Period: 180 days
Failed sign-in attempts · Period: 24 hours
Support messages · Period: While the account exists
Payment and accounting records · Period: As long as Georgian tax law requires (generally 6 years)
Visit statistics of websites · Period: 120 days; visit recordings — 30 days
Backups · Period: Hourly — 48 hours, daily — 30 days, monthly — 12 months. Deleted data disappears from backups when the backup expires

8. Security

Data is encrypted in transit (HTTPS with TLS 1.2+). Backups are encrypted before they leave the server. Every business has a separate database. Passwords are stored only as one-way hashes; two-step verification is available; access to servers is limited to keys of authorised persons. The platform is protected against attacks and overload, and we keep a log of sign-ins to the admin panel. If a personal data breach happens, we notify the State Audit Office of Georgia within 72 hours where the law requires it, and we inform affected people without undue delay when the breach may cause them significant harm.

9. Cookies and similar technologies

We use only cookies that are needed for the service to work: keeping you signed in, protecting sign-in, remembering your language and display preferences, and Cloudflare’s security cookies. We do not use advertising or third-party tracking cookies. Details: Cookie Notice.

10. Your rights

know whether we process your data and get a copy of it;
correct inaccurate data;
have your data deleted;
restrict processing;
receive your data in a machine-readable format and have it transferred (portability);
object to processing based on legitimate interest;
withdraw consent at any time, without affecting earlier processing;
not be subject to a decision based solely on automated processing that significantly affects you.

You have the right to:

Write to [email protected] from the e-mail or phone linked to your account, or use the admin panel (Account → Security; Settings). We answer within 10 working days; if the request is complex we may extend this once, as allowed by law, and tell you why. We may ask you to confirm your identity. Requests are free unless they are clearly unfounded or excessive.

If you think we process your data unlawfully, you can complain to the State Audit Office of Georgia (personal data protection supervision) and, if you are in the EU or UK, to your local data protection authority. We would appreciate the chance to resolve your concern first.

11. Google user data

Grigmi’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We request only your basic profile (name, e-mail and Google account ID) to sign you in. We do not use this data for advertising, do not sell it, and do not transfer it to anyone except as needed to provide sign-in, for security, or as required by law.

12. Changes to this policy

We may update this policy. The version and date are at the top. We will notify you in the admin panel or by e-mail at least 14 days before significant changes take effect.