Privacy Policy

Last updated: March 17, 2026

Grahm AI ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our Service.

1. Information We Collect

Data Type	What We Collect	Why
Account Info	Email address, name, password (hashed)	Authentication and account management
Content Data	Guides, SOPs, tickets, steps, and documents you create	To provide the Service
Usage Data	Feature usage, page views, AI call counts	To improve the Service and track quotas
Technical Data	IP address, browser type, device info	Security, debugging, and performance

2. How We Use Your Information

We use your information to:

Provide, maintain, and improve the Service
Authenticate your identity and manage your account
Process AI requests to generate and review documentation
Send service-related communications (account verification, security alerts, product updates)
Enforce our Terms of Service and prevent abuse
Analyze usage patterns to improve features

3. AI Processing

When you use AI-powered features (ticket normalization, SOP generation, quality review), your content is sent to a third-party AI provider (currently OpenAI) for processing. This data is transmitted securely and is subject to the AI provider's data usage policies. We do not use your content to train AI models. AI requests are processed in real-time and are not stored by the AI provider beyond the request lifecycle.

4. Data Storage and Security

Your data is stored on Supabase infrastructure with the following protections:

Encryption in transit (TLS 1.2+) and at rest
Row-level security ensuring users can only access their own data
JWT-based authentication with automatic token refresh
Rate limiting on API endpoints
Server-side AI key management (API keys never exposed to browsers)

5. Data Sharing

We do not sell, rent, or trade your personal information. We may share data only in these circumstances:

Service Providers: With trusted third parties who help us operate the Service (hosting, AI processing), bound by confidentiality agreements
Legal Requirements: When required by law, court order, or governmental regulation
Safety: To protect the rights, safety, or property of Grahm AI, our users, or the public
Team Features: Content you share with your team is visible to team members you have granted access to

6. Data Retention

We retain your data as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or compliance purposes. Deleted guides are kept in trash for 30 days before permanent deletion.

7. Your Rights

Depending on your location, you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Delete your data ("right to be forgotten")
Export your data in a portable format
Object to or restrict certain processing
Withdraw consent at any time

To exercise these rights, contact us at support@grahm.ai. We will respond within 30 days.

8. Cookies

Grahm AI uses session storage (not persistent cookies) for authentication. We do not use tracking cookies or third-party advertising cookies.

9. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it promptly.

10. International Transfers

Your data may be processed in the United States. By using the Service, you consent to the transfer of your data to the US, where data protection laws may differ from your jurisdiction.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification. The "Last updated" date at the top indicates when the policy was last revised.

12. Contact Us

For privacy-related questions or requests:

Email: support@grahm.ai
Grahm AI