Privacy policy
Effective November 3, 2026
Who we are
Gripheus is a customer feedback research service run by Avishay Kumar, a sole proprietor operating as Gripheus, from Vancouver, British Columbia, Canada. This policy explains what personal information we collect, why, and what you can do about it. Our privacy contact is Avishay Kumar, at support@gripheus.com or 5307 Victoria Drive #680, Vancouver, BC V5P 3V6, Canada.
Who this policy covers
- Website visitors to gripheus.com.
- People who contact us, by email or by booking a call.
- Business contacts we email, whose work email address is published on their company's website or a similar public page.
- Our clients' customers, whose comments appear in the files a client sends us. For these files we act on the client's behalf, under the client's instructions and our data handling terms.
Information we collect
- Website visitors: our hosting provider records basic technical information, such as IP address, browser type and pages requested, to keep the site running and secure. Our hosting provider also counts page visits and how visitors found us, such as a search engine or a link, so we can see which pages are useful. We don't run advertising on this site.
- Enquiries: your name, work email, company and whatever you write to us.
- Business contacts: your name, role, company and published work email, the page where we found it and the date, our emails to you, and any reply, including a request to stop contacting you.
- Client files: the review, return, support or survey exports a client chooses to send. Clients remove names, email addresses, phone numbers, street addresses, order numbers and customer IDs before sending. We strip any contact details left in the text before it is stored or analysed.
- Billing: if you become a client, your billing contact and invoice details. Payments are handled by Stripe; we never see full card numbers.
Free samples
If you send us an export for a free sample, we use it only for that sample, we don't share it, we don't publish anything about your brand without your written permission, and we delete the file within 30 days, confirmed in writing.
How we use it
- To answer enquiries and deliver the services a client orders.
- To contact business contacts about services that relate to their role, and to honour every request to stop.
- To produce each client's report. Client files are used for nothing else: never sold, never shared for anyone else's purposes, never combined with another client's data, and never used to train AI models.
- To keep records the law requires, such as invoices and proof of the basis for our emails.
Who we share it with
We use a small number of service providers that process information for us under contract:
| Provider | What it does | Location |
|---|---|---|
| Lovable Cloud (built on Supabase) | Hosts our website, database and uploaded files | United States |
| Anthropic (Claude) | Reads and labels cleaned client feedback | United States |
| Google, via the Lovable AI gateway | Groups similar comments | United States |
| Microsoft 365 | Our email | Canada |
| Stripe | Invoices and payments | United States |
Our AI providers are contractually barred from training on client data. We don't sell personal information, and we only disclose it to others where the law requires us to.
Where it's stored
Our providers store and process information outside Canada, mainly in the United States. While it's there, it is subject to the laws of that country, and courts, law enforcement and national security authorities there may be able to access it.
How long we keep it
| Information | How long |
|---|---|
| Client files and the comment text in them | Deleted within 30 days of delivering the report (for the monthly Fix tracker, within 30 days of each month's update); we confirm the deletion in writing |
| Delivered reports (counts and summaries only, no customer details) | As long as the client relationship lasts, unless the client asks us to delete them |
| Enquiries | Up to 2 years after our last contact |
| Business contact records | Up to 3 years after our last email, to show the basis for each email |
| Requests to stop contacting you | Kept permanently, so we never email you again |
| Invoices and billing records | 6 years, as Canadian tax law requires |
Cookies
The public pages of this site don't set any cookies, including for visitor statistics. The admin area uses a sign-in cookie that only our team needs.
How we protect it
Files are stored encrypted, only our founder can access client data, and access to our accounts is password-protected. If a breach affects your information, we'll tell the affected client within 72 hours of discovering it, and notify the Privacy Commissioner and affected people where the law requires.
Your choices and rights
- Stop our emails: reply "unsubscribe" to any email, or write to support@gripheus.com. We act on it within 10 business days, usually the same day.
- Access and correction: ask for a copy of the personal information we hold about you, or ask us to correct it.
- Withdraw consent: you can withdraw consent to a use of your information, subject to legal or contractual limits.
- If you're a client's customer: your comments reach us only through that business. Contact the business first; we'll help them answer your request.
We'll reply within 30 days. If you're not satisfied, you can complain to the Office of the Information and Privacy Commissioner for British Columbia or to the Office of the Privacy Commissioner of Canada.
Changes to this policy
We'll post any change here with a new effective date. If a change affects how we use client data, we'll tell clients by email first.