Consent notice for the website and app

Last updated: September 25, 2026

This is the consent notice for grewray. It covers the website and the app together, so there is one set of promises and one consent, wherever you meet us.

When you create an account, you tick one box to agree to our terms and our privacy policy, which carry this notice. That single, clear action is your consent to the processing listed below. We record the date and the version you agreed to, so we can show exactly what you were told.

Browsing the website needs no consent at all: it sets no cookies and collects nothing about you beyond the request logs every website's servers keep.

What you consent to, item by item

Your name and work email
Why
To create your account, sign you in, and send service emails such as verification, security alerts and receipts.
Needed?
Required
Kept
While your account is open, then 30 days to export and up to 30 more in backups
Your company name, and a phone number if you give one
Why
To set up your business and to contact you about your account.
Needed?
Company name required; phone optional
Kept
While your account is open, then 30 days to export and up to 30 more in backups
Your password and two-factor settings
Why
To keep your account yours. The password is stored only as a salted hash that nobody can read.
Needed?
Required
Kept
While your account is open, then 30 days to export and up to 30 more in backups
Your business's profile: its name, web address, industry, country and time zone
Why
To run your workspace for the right trade, in the right time zone.
Needed?
Required
Kept
While your account is open, then 30 days to export and up to 30 more in backups
Sign-in and security records: devices, browsers, IP addresses and sensitive changes
Why
To protect accounts, detect abuse and investigate anything suspicious.
Needed?
Required
Kept
At least 180 days, as Indian law requires
A bot check on the sign-up and password-reset forms
Why
To stop automated sign-ups. It is provided by Cloudflare Turnstile.
Needed?
Required on those two forms
Kept
Not kept by us once the check is done
A breached-password check
Why
To refuse a password already exposed in a data breach. Only part of a one-way hash of it leaves our servers.
Needed?
Required when you set a password
Kept
Not kept
Your plan and billing contact
Why
To bill your subscription and keep the records tax law requires.
Needed?
Required when you subscribe
Kept
As long as tax and company law requires
Product news by email
Why
To tell you about new features and industry packs.
Needed?
Optional, and off unless you ask for it
Kept
Until you unsubscribe

The DPDP law allows some processing without consent, for specific legitimate uses. We rely on them only to comply with the law, a court order or a lawful direction, such as keeping tax records or reporting a security incident to CERT-In, and never to use your data for anything new.

Withdrawing your consent

Withdrawing is as easy as giving consent:

For product news, use the link in any email, or write to hello@grewray.com.
For everything else, close your account in the app, or write to hello@grewray.com. Because the service cannot run without the required items, withdrawing consent means closing the account: we stop processing, your business becomes read-only with 30 days to export, and then your data is deleted.

Withdrawing does not affect what was done lawfully before it, and we keep only what the law requires us to keep.

The data you keep about your customers

If your business uses grewray, you decide what personal data about your own customers, staff and suppliers goes into it, and you are responsible for their consent where the law requires it, including a parent's or guardian's consent for a child. We process that data only on your instructions, as our data processing addendum sets out.

Your privacy choices

Cookies on this website
None are used, so there is nothing to accept or refuse.
Analytics and advertising
None, on the website or in the app.
The sign-in cookie in the app
One strictly necessary cookie, grewray_refresh, which keeps you signed in. It is required to use the app.
Product news
Off unless you opt in, and every email lets you opt out.
Messages to your own customers
Decided by your business, in grewray's settings.

If we ever add an optional cookie or any analytics, we will ask you first, with a choice as easy to refuse as to accept, and this notice will change before they do. The details are in our cookie policy.

Your rights and grievances

You can ask for a summary of your data, have it corrected or erased, nominate someone to act for you, and raise a grievance, as our privacy policy explains. We reply within 1 business day and resolve grievances within 15 days. If you are not satisfied, you can complain to the Data Protection Board of India. You may also give, manage or withdraw consent through a consent manager registered with the Board.

Languages

This notice is written in English. On request, we will provide it in any language listed in the Eighth Schedule to the Constitution of India. Write to hello@grewray.com.