Privacy policy
Revision:
Draft for review. Confirm the operator’s identity and address before publishing this version.
This notice explains personal data processing on the Grubbx website and platform: accounts, AI conversations, brand projects, files, invitations, credits, payments and support. It does not describe food ordering or data processing by other businesses on their own websites.
1. Controller and contact
Grubbx is the service’s trading name. The controller is: Operator identity, address and country awaiting confirmation. Contact hola@grubbx.com, subject “Privacy”. The controller’s identification must be completed before this version is used as a final notice.
2. Data processed
- Account and access: name, email, user identifier, profile image and information supplied by your authentication provider.
- Brand work: instructions, messages, responses, references, images, files, preferences, projects, saved resources and generation history.
- Collaboration: invitee email, sender identity, project, role, invitation status and activity associated with project permissions.
- Purchases: customer, payment and subscription identifiers, amount, currency, payment status, credit balance and transactions. Stripe collects payment details through its form; Grubbx does not request full card numbers in chat.
- Usage and support: correspondence, technical connection, browser and device information, usage events and records needed to diagnose errors or abuse.
Sensitive data is unnecessary for brand creation. Avoid uploading identification documents, health records, third-party financial information or intimate material. Request removal if you upload such information accidentally. Photographs may contain personal data; you need authority to share and transform them.
3. Purposes
Necessary purposes include authentication, account and project operation, AI processing, resource storage and retrieval, permissions and invitations, authorized purchases, credit administration, support, service protection and legal compliance. Relevant data is used for each function based on the service relationship and any required consent.
Promotional messages are a secondary purpose. Decline or unsubscribe through the message link or privacy contact without losing service access. Security, purchase and contract notices are operational messages. An incompatible new purpose requires notice and prior consent where applicable.
4. AI, providers and international processing
Instructions and references needed for a response are sent to the provider processing that request. The integration uses Vercel AI Gateway and configured models from DeepSeek, Google, OpenAI, Meta and Recraft; not every provider participates in each request. Models may change. Do not send information you lack authority to disclose to these providers.
The service integrates Clerk for authentication, Convex for application data, Vercel for hosting, files and analytics, Stripe for payments and Resend for transactional email. They may process data outside Mexico. Their function and applicable agreement determine whether they act on Grubbx’s instructions or independently, for example to comply with payment or fraud-prevention obligations.
Processors must follow applicable instructions, confidentiality duties and safeguards. Where disclosure constitutes a transfer to a third party, its purposes must be disclosed and required consent obtained unless a legal exception applies. Authority requests will be addressed on a lawful basis and limited to necessary data. This notice does not authorize database sales or advertising use of your projects.
There is no blanket promise of zero retention or exclusion from training across all models: conditions depend on the provider and configuration. Request information before sending restricted material. The service license does not itself authorize training Grubbx’s own models on your content for purposes unrelated to your request.
5. Project and file visibility
Project permissions control collaborators’ access within the application. However, some generated images are stored at public URLs: anyone obtaining the link may open the file without signing in. Restricting a project does not automatically make those URLs private. Do not use these functions for trade secrets or information requiring confidential access. Deleting a project does not by itself guarantee removal of every associated file from storage; request file deletion as well.
6. Cookies and local storage
Authentication may use cookies, and your browser may retain preferences, drafts or work state. The application integrates Vercel analytics to understand service usage. External resources and services may receive technical data when opened. Clearing browser cookies and storage may sign you out or remove information stored only on that device. This notice does not constitute consent to advertising tracking. Optional technologies requiring permission must remain subject to that consent.
7. Retention and security
Account and project data is retained while needed for the service. Deletion requests require review of active data, associated files, backups and outstanding obligations. Payment evidence and records required for legal duties or claims may be retained for applicable periods with restricted use, then deleted. We do not promise instant deletion of every copy or a single retention period for all categories.
Administrative, technical and physical safeguards must be proportionate to the data and risk. No system is invulnerable. Breaches significantly affecting your rights will be communicated as required by law, with information to help you protect yourself. Report suspicious access to the contact address.
8. Access, rectification, cancellation and objection
Email hola@grubbx.com, subject “ARCO rights”, with your name, reply contact, requested right and a description of the data or correction. We will explain proportionate identity or representation verification; do not attach unnecessary sensitive documents initially.
A determination will be communicated within 20 business days of receipt and, if approved, implemented within 15 business days after the response. Any legally permitted extension will be justified. Exercising rights is free, except legally permitted reproduction or delivery costs. A refusal must explain its basis.
Use the same channel to withdraw consent or restrict use or disclosure. Withdrawal is not retroactive, may prevent a function requiring that data and does not remove legal retention duties. If your rights are not addressed, you may apply to Mexico’s Secretaría Anticorrupción y Buen Gobierno through its official channels without an additional internal prerequisite.
9. Third-party data and minors
You need a lawful basis and appropriate notice to invite others or include client data. Grubbx does not replace your responsibilities toward those individuals. Account contracting is intended for people aged 18 or older with legal capacity. A representative may request assistance and deletion if a minor provided data without valid authorization.
10. Changes
This page will display the current version and revision date. Material changes will be communicated through a reasonable account-related channel. Publication alone does not replace renewed consent where required. See the platform terms.
