Privacy Policy

Uploaded files and workspace metadata are stored on Google Cloud in europe-west4 (Netherlands, EU) when cloud storage is enabled. Graceworks Group is based in South Africa and processes personal information under POPIA. Some subprocessors (email, analytics if you opt in, connectors you enable) may process data in other regions. We use your data only to run the service and generate the analysis you requested. We never sell it. You can delete your data at any time.

If you have questions, email privacy@gracelumiq.co.za.

Account information: Your name and email address when you sign up.

Data you upload: Files you upload for analysis. This data is yours. We process it only to generate the dashboard and answer your questions.

Usage data: How you use GraceLumiq - which features you use, how often. This is anonymised and helps us improve the product.

We use your data for one purpose: to run GraceLumiq and generate the analysis you requested. We do not:

• Sell your data to anyone
• Use your uploaded data to train AI models
• Share your data with third parties for marketing
• Access your data beyond what is needed to run the service

When cloud storage is enabled, uploaded files and related infrastructure run on Google Cloud europe-west4 (Netherlands, EU). Database and application servers for our production deployment are also operated in that region unless you use a self-hosted install on your own infrastructure.

Enabling integrations (for example Google Sheets, Xero, or Shopify) or optional AI features may involve further transfers to those providers' regions. We do not claim that your data never leaves South Africa - we describe where our primary hosting runs and which subprocessors may apply.

Under the Protection of Personal Information Act, you have the right to:

• Access - download a copy of your data
• Correct - update or replace your uploaded data
• Delete - remove any data source or your entire account
• Object - opt out of any processing beyond service delivery

To exercise any of these rights, email privacy@gracelumiq.co.za.

Your uploaded data is stored for as long as your account is active. If you delete a data source, it is removed within 24 hours. If you close your account, all data is permanently deleted within 30 days.

Your data is encrypted at rest (AES-256 on Google Cloud) and in transit (TLS 1.2+). Each workspace is logically separated in our database and storage paths - other organisations cannot access your files.

GraceLumiq uses the following services to operate:

• Google Cloud (europe-west4, EU) - primary file storage and infrastructure
• SendGrid - transactional emails (account confirmations, billing)
• PostHog - anonymised product analytics (only if you opt in)
• Sentry - error monitoring (no personal data)

No uploaded data is shared with any of these services.

We use one session cookie to keep you logged in. Optional analytics load only if you opt in. No advertising cookies.

We will email you if we make material changes to this policy. Minor updates (fixing typos, clarifying language) will be reflected here without notification.

For any privacy-related question or request: privacy@gracelumiq.co.za

Graceworks Group (PTY)(LTD) · Cape Town, South Africa