Privacy Policy

Effective date: [[EFFECTIVE DATE, e.g. 1 October 2026]]

This Privacy Policy explains how [[LEGAL ENTITY NAME]] (“Granularity”, “we”, “us”) collects, uses, stores and shares information when you use the Granularity marketing analytics platform at www.granularity.io and its related services (together, the “Service”). It also describes the choices you have about that information.

1. Who we are

[[LEGAL ENTITY NAME]], [[REGISTERED ADDRESS]], is the controller of the personal data described in this policy. You can reach us at support@granularity.io.

2. What the Service does

Granularity connects to the advertising, analytics and commerce platforms a customer already uses (for example Google Ads, Google Analytics 4, Google Search Console, Meta Ads, TikTok Ads, LinkedIn Ads, Shopify and Stripe), imports reporting data from those platforms on the customer’s behalf, and turns it into unified dashboards, reports and AI-assisted analysis. The Service is provided to businesses. Each customer organisation decides which platforms to connect and which of its team members may use the workspace.

3. Information we collect

3.1 Account and workspace information

When you create an account or are invited to a workspace we collect your name, email address, profile picture (if you sign in with a third-party identity provider), the organisation you belong to and your role within it. Authentication is operated for us by Clerk.

3.2 Connected platform data

When an authorised member of a customer organisation connects a marketing, analytics or commerce platform, we receive an access token for that platform and use it to import reporting data: campaigns, ad groups, ads, keywords, search queries, spend, impressions, clicks, conversions, sessions, revenue and similar aggregated performance metrics, together with the account, property or site identifiers they belong to. Commerce connectors may include order, product and customer records; where those records contain personal data about the customer’s end customers, the customer is the controller and we process that data only on its instructions.

3.3 Content you provide

Questions you ask the AI assistant, files you upload, transformation rules, notes, feedback and support requests.

3.4 Usage and device information

Log data (IP address, browser type, pages visited, timestamps), error diagnostics and product analytics events. On our public marketing and sign-in pages we use Google Tag Manager to load analytics tags; the authenticated application does not load marketing tags.

4. Google user data

This section applies when a customer connects a Google product to Granularity. We request the following Google OAuth scopes and no others:

• openid and email - to identify which Google account authorised the connection and to show that account to your team.
• https://www.googleapis.com/auth/adwords - Google Ads API. Used to list the Google Ads accounts you may report on and to read campaign, ad group, ad, keyword and conversion performance reports for the accounts you select. We do not create, edit, pause or bid on campaigns.
• https://www.googleapis.com/auth/analytics.readonly - Google Analytics Data and Admin APIs. Used to list the GA4 properties you may report on and to read aggregated traffic, engagement, acquisition and conversion reports for the properties you select. Read-only.
• https://www.googleapis.com/auth/webmasters.readonly - Google Search Console API. Used to list the sites you may report on and to read search analytics (queries, pages, clicks, impressions, position). Read-only.

How we use it. Google data is used solely to provide the Service to the customer organisation that connected it: to build dashboards, reports, alerts and AI-assisted answers about that organisation’s own marketing performance. We do not use Google user data for advertising, we do not sell it, and we do not use it to build or improve general-purpose models.

How we store it. Imported reports are stored in our analytics database and the OAuth tokens are stored encrypted in our connection service, both hosted on Google Cloud in the Netherlands (europe-west4), alongside a managed analytics database in the same region. Data is partitioned by customer organisation and protected by row-level access controls so that one customer cannot read another’s data.

How we share it. Google data is visible only to members of the customer organisation that connected it and, where the customer has enabled AI features, is sent in the minimum necessary form to the AI providers listed in section 7 to generate the requested output. We do not transfer Google user data to any other third party except as required by law.

Limited Use disclosure. Granularity’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access. You can disconnect a Google source at any time from the Sources page of your workspace. Disconnecting stops all imports, deletes the stored token and marks the account's imported data for erasure by our purge process after a short grace period during which the source can be restored (section 9). You can also revoke Granularity’s access from your Google Account permissions; we then stop importing new data and you can disconnect the source to trigger erasure.

5. How we use information

• To provide, operate, secure and support the Service.
• To import, transform and present connected platform data to the customer.
• To generate AI-assisted analysis and recommendations the customer asks for.
• To send service, security and billing communications.
• To monitor performance, diagnose errors and prevent abuse.
• To comply with legal obligations.

6. Legal bases

Where the GDPR or UK GDPR applies, we process personal data to perform our contract with the customer, on the basis of our legitimate interests in operating and securing the Service, to comply with legal obligations and, for analytics on our public marketing pages, on the basis of our legitimate interest in understanding how the site is used. [[REVIEW: the public pages currently load analytics tags without a consent banner; EEA cookie consent is tracked separately.]]

7. Sub-processors and sharing

We share information only with service providers that process it on our behalf and under contract, with the customer organisation it belongs to, and where required by law. Our current sub-processors are:

• Google Cloud (europe-west4, Netherlands) - hosting, storage, secrets
• Managed analytics database provider (europe-west4, Netherlands)
• Supabase - application database
• Vercel - web application hosting
• Clerk - authentication and organisation management
• Anthropic, OpenAI and Voyage AI - AI model providers for assistant features
• Sentry - error monitoring
• Statsig - feature flags and product analytics
• Resend - transactional email

AI providers receive only the content needed to answer a request and are used under terms that prohibit using customer content to train their models. [[REVIEW: confirm this matches the signed provider terms.]] Customers may also bring their own AI provider key, in which case that provider’s terms apply.

8. International transfers

Our primary infrastructure is in the European Union. Where a sub-processor processes data outside the EU/EEA, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.

9. Retention and deletion

Imported platform data is retained for as long as the source remains connected and the customer organisation is active, so that historical performance can be reported over time. When a source is disconnected its token is deleted immediately, the account is marked for deletion and its imported data is erased by a scheduled purge after a short grace period. When an organisation leaves the Service it enters a 30-day grace period after which all of its data - accounts, connections, imported data, AI history and derived analytics - is erased from every store, and the erasure is verified. One exception: we keep an append-only security audit trail (which user performed which action, when, from which IP address and browser) indefinitely, as the record that erasure happened and to answer security and accountability questions. AI execution telemetry is kept for 180 days. Backups expire on their own schedule. We may retain information longer where the law requires it.

10. Security

We use encryption in transit and at rest, tenant isolation enforced at the database layer, least-privilege access, audit logging and continuous monitoring. No method of transmission or storage is completely secure; if we learn of a breach affecting your data we will notify you as required by law.

11. Your rights

Depending on where you live you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to lodge a complaint with a supervisory authority. Workspace administrators can manage most account data directly; for anything else contact support@granularity.io. If you are an end customer of one of our customers, please contact that business first; we will assist it in responding.

12. Cookies

The Service uses strictly necessary cookies for authentication and session security. Our public marketing and sign-in pages load analytics tags through Google Tag Manager when the page loads, to understand how visitors use the site. You can control cookies through your browser settings.

13. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect personal data from children.

14. Changes to this policy

We will post any changes on this page and update the effective date. For material changes we will notify workspace administrators by email.

15. Contact

[[LEGAL ENTITY NAME]]
[[REGISTERED ADDRESS]]
support@granularity.io

This policy is governed by the laws of [[COUNTRY / GOVERNING LAW]].