Privacy Policy — Gripply

Gripply Limited ("Gripply", "we", "us"), a company registered in England and Wales (company number 17169919), provides a business communications service for small businesses and tradespeople: a dedicated business phone number that handles calls, SMS and WhatsApp Business messages, captures and transcribes those conversations, and turns what was agreed into tracked actions. This policy explains what information we collect, how we use it, and the choices you have. It covers both this website (gripply.app) and the Gripply service and apps.

If you have any questions, or want to exercise any of the rights described below, contact us at privacy@gripply.app.

Information we collect on this website

Waitlist email address. If you join the waitlist, we collect the email address you submit so we can contact you about early access. We only email you about Gripply, and every email includes an unsubscribe link.
Usage analytics. We use Google Analytics to understand how visitors use the site (pages viewed, approximate location, device and browser type). This involves cookies and similar technologies set by Google.
Technical logs. Our hosting provider records standard server logs (IP address, request time, user agent) for security and reliability.

Information we collect in the Gripply service

When you create a Gripply account and use the service, we collect and process:

Account information — your name, email address, business name and sign-in credentials (managed by our authentication provider; we never see your password).
Your business number and communications — calls to and from your Gripply number (including recordings and voicemails), SMS and WhatsApp Business messages, and the phone numbers involved. Recordings are transcribed so you can search and review them.
Content our software derives from your communications — transcripts, summaries, and extracted items such as appointments, requirements, callbacks and quotes. We use AI services to produce these; they are suggestions for you to review, not automated decisions with legal effect.
Contact details of the people you talk to — names and numbers of your clients, as captured from your communications or entered by you.
Billing information — your subscription plan and payment details, handled by our payment provider. We do not store full card numbers.
Device and app information — device type and push notification tokens if you enable notifications in our mobile app.

How we use information

To provide the service: routing your calls and messages, recording and transcribing conversations, extracting and tracking action items, and sending you daily digests and notifications.
To set up and operate your dedicated business number and, where you enable it, your WhatsApp Business connection.
To bill you for the service and manage your subscription.
To keep the service secure, prevent abuse, and troubleshoot problems.
To contact you about the service — early access, service updates and support. Marketing emails always include an unsubscribe link.

We do not sell your personal information, and we do not use the content of your conversations to train AI models or serve advertising.

Our legal bases (UK & EU GDPR)

Where the UK or EU GDPR applies, we rely on the following legal bases:

Performance of a contract — providing the Gripply service: routing, recording and transcribing your communications, extracting action items, operating your number and WhatsApp connection, billing, and support.
Legitimate interests — keeping the service and website secure, preventing abuse, improving the service, and understanding how our website is used.
Consent — the waitlist and marketing emails, and cookies or similar technologies where consent is required. You can withdraw consent at any time.
Legal obligation — keeping billing, tax and accounting records we are required to hold.

Automated decision-making

Gripply's AI features produce transcripts, summaries and suggested action items for you to review — you decide what to act on. We do not make automated decisions about you or your clients that have legal or similarly significant effects, and we do not carry out profiling of that kind.

Call recording

Gripply records and transcribes calls on your business number so you can review what was agreed. Laws on call recording vary by country and region, and in many places callers must be informed. As the business owner, you are responsible for making sure your use of call recording complies with the laws that apply to you and your callers.

Your clients' information

The people who call and message your Gripply number are your clients, not ours. We process their information (numbers, messages, recordings, transcripts) on your behalf, to provide the service to you. We don't contact your clients except to deliver your messages and any automated replies you have configured, and we don't use their information for any other purpose. If one of your clients contacts us about their data, we will refer them to you and assist you in responding.

Who we share information with

We share information only with the service providers we need to run Gripply, and only for the purposes described above. For each, here is what they receive:

Twilio — carries our calls, SMS and WhatsApp Business messages and provides your business number. Receives the phone numbers involved, call audio, and message content.
Meta (WhatsApp) — if you connect WhatsApp Business, messages on that channel are delivered through WhatsApp's Business Platform and Meta processes them under its own terms and privacy policy. When you authorize the connection, we receive from Meta the identifiers needed to link your WhatsApp Business Account (such as your WhatsApp Business Account ID and business display name) — we do not receive your Facebook profile, friends or posts.
Deepgram — transcribes call recordings and voicemails. Receives call audio.
Anthropic — provides the AI that summarises conversations and extracts action items. Receives transcripts and message text.
Stripe — processes payments. Receives your name, email and payment details.
Auth0 (Okta) — manages account sign-in. Receives your email and sign-in credentials.
Amazon Web Services — hosts the service and delivers email. Stores the service data described above.
Expo — delivers mobile push notifications. Receives your device push token and notification content.
Netlify — hosts this website. Receives standard server logs.
Kit — stores the waitlist and sends our early-access emails. Receives your waitlist email address.
Google Analytics — website usage analytics. Receives usage data collected by its cookies.

These providers act under contracts that restrict how they can use your information. We may also disclose information if the law requires it, or as part of a merger, acquisition or sale of our business — in which case this policy will continue to apply to your information.

International transfers

Some of the providers above process data outside the UK and the European Economic Area, including in the United States. Where required, we rely on lawful transfer mechanisms for those transfers — for transfers from the UK, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; for transfers from the EEA, the EU Standard Contractual Clauses — or an applicable adequacy decision (such as the UK–US and EU–US Data Privacy Frameworks, for providers certified under them).

How long we keep information

Waitlist emails — until you unsubscribe or ask us to delete them.
Communications data (recordings, voicemails, transcripts, messages and items derived from them) — for as long as your account is active, so your client history stays available to you.
Account information — for as long as your account is active, and briefly afterwards to handle closure.
Billing and payment records — for as long as tax and accounting law requires after the transaction.
Support requests — for up to two years after resolution, so we have context if an issue recurs.
Website analytics — per Google Analytics' retention settings, then deleted or aggregated.
Server and security logs — for short periods set by the relevant provider, typically 30–90 days.

If you close your account, we delete your communications data within 30 days, except where we must keep specific records for legal, billing or security reasons — and we delete those once the reason expires.

Security

We protect information with encryption in transit (TLS) for all connections to the service; encryption at rest for stored data, with additional application-level encryption of sensitive credentials; access controls so that only the people and systems that need your data can reach it; and logging and monitoring to detect problems. No system is perfectly secure, but we take the protection of your conversations seriously — they are the product.

Deleting your account

You can delete your Gripply account by emailing privacy@gripply.app from your account email. Deleting your account releases your business number and deletes your communications data as described in the retention section above. We will confirm when deletion is complete and tell you if any records must be retained for legal reasons, and for how long.

Your rights

Depending on where you live (including under the UK and EU GDPR), you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. You can exercise these rights by emailing privacy@gripply.app. You also have the right to complain to your data protection authority.

You can unsubscribe from waitlist and marketing emails at any time using the link in any email.

Children

Gripply is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16.

Changes to this policy

If we make material changes to this policy, we will update this page and, where appropriate, notify you by email or in the app. The "Last updated" date at the top shows when it last changed.

Contact

Gripply Limited is the data controller for the processing described in this policy (except where we act on your behalf as described in "Your clients' information").

Gripply Limited · Company no. 17169919 (England and Wales)
Registered office: 66 Paul Street, London EC2A 4NA, United Kingdom
gripply.app · privacy@gripply.app