Privacy Policy

1. Who we are

GroundBrain is operated by GroundBrain UK Ltd, a company registered in England and Wales under company number 17406682, with its registered office at Bartle House, 9 Oxford Court, Manchester, England, M2 3WQ ("we", "us").

For questions about this policy or your data, contact [email protected].

2. Our role: controller and processor

GroundBrain is sold to companies, and most data in it is entered by their staff in the course of their work.

• Where your employer provides the Service to you, that company decides why and how your data is used. They are the data controller; we are their data processor, acting on their instructions under a data processing agreement. Questions about how your employer uses your data should go to them.
• For our own account, billing and support records, meaning the identity of the people who administer an account and our correspondence with them, we are the controller.

3. What we collect

We collect only the personal data we need to provide the Service, in line with the data minimisation principle in the UK and EU GDPR. In broad terms, that covers:

• Account data: the details needed to set up and secure your account and to associate it with your company, your projects and your role.
• Data you create in the Service: the content and files you enter, upload or record in the app, and the project each item belongs to. This is work data, but it can describe identifiable people. Where the data you submit includes audio, we retain it after processing, because it supports the entry it belongs to.
• Technical data: device, app and connection information, and server logs of requests to the Service, kept for security and troubleshooting.

We do not use the Service to collect special category data (such as health or biometric data), and we ask that you do not enter such data. Data you submit is processed to provide the Service, not to identify individuals.

4. How we use it

• To provide the Service: storing and processing the data you create, and showing it back to you and your colleagues on the project.
• To keep the Service secure and working: authentication, abuse prevention, diagnosing faults.
• To improve accuracy: your corrections and answers to clarifying questions are used to measure and improve how well the Service works for your organisation.
• To communicate with account administrators about the Service.
• To meet legal obligations.

We do not sell personal data, we do not use it for advertising, and we do not use customer data to train publicly available AI models.

5. Legal bases (UK/EU GDPR)

Where we act as controller, we rely on:

• Contract: to provide the Service to the account holder.
• Legitimate interests: security, fault diagnosis, and improving the Service, balanced against your rights.
• Legal obligation: where the law requires us to keep or disclose records.
• Consent: where you connect an optional third-party account such as Google Drive, which you can disconnect at any time.

Where we act as processor, your employer determines the legal basis.

6. Who we share it with

We use a small number of service providers ("subprocessors") to run the Service. They act on our instructions and are bound by contract.

We may also disclose data where the law requires it, or to protect the rights and safety of users and the Service. If the business is sold or reorganised, data may transfer with it, subject to this policy.

7. Where your data is held

The Service is hosted in the European Union, and your company data is stored there.

Where personal data is transferred outside the UK or the EEA, for example to support a UK-based customer, the transfer is covered by appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

8. How long we keep it

We keep personal data for as long as it is needed for the purposes described in this policy, and for as long as the account it belongs to is active.

Retention periods for the data you create in the Service are set by the agreement with the company that provides the Service to you, and data is deleted automatically in line with that agreement. When an account closes, data is deleted or returned as that agreement requires.

Where the law requires us to keep certain records, for example for tax or accounting purposes, we keep them for the period the law sets.

9. Security

We take appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and separation between customers' data. Access by our staff is limited to those who need it to operate and support the Service.

No system is perfectly secure. If a breach affects your personal data, we will notify the relevant supervisory authority and affected customers as the law requires.

10. Your rights

Subject to the conditions in the law, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its use, and to receive it in a portable form. To delete your account, see how to delete your GroundBrain account. You may also complain to a supervisory authority. In the UK, that is the Information Commissioner's Office (ico.org.uk).

If your employer provides the Service to you, please make these requests to them. As their processor we will assist them in answering you, but we cannot act on their data without instruction. For data where we are the controller, contact [email protected].

11. Children

The Service is a workplace tool and is not directed at children. We do not knowingly collect data from anyone under 16.

12. Changes

We may update this policy. Where a change materially affects you, we will tell account administrators before it takes effect, and the date at the top of this page will change.

13. Contact

GroundBrain UK Ltd
Bartle House, 9 Oxford Court, Manchester, England, M2 3WQ
[email protected]