Last updated: 4 September 2026

This Privacy Policy explains how GrailHound ("GrailHound", "we", "us"), operated by SentoWeb Srl, a company registered in Romania, collects, uses, and shares information when you use our websites, web app, and mobile apps (together, the "Service"). As an EU-established controller we process personal data in accordance with the EU General Data Protection Regulation (GDPR). By using the Service you agree to this Policy.

1. Who this applies to

This Policy covers visitors to grailhound.app, registered account holders, and people who sign in through a third-party provider. If you do not agree with this Policy, please do not use the Service.

2. Information we collect

2.1 Information you give us

Account details — your email address, display name, and (for email/password accounts) a securely hashed password. We also store email-verification and password-reset state.

Social sign-in — if you sign in with Google, Apple, or Facebook, we receive and store a provider account identifier and your email address (and, where provided, your name) from that provider, and a record linking your GrailHound account to it. We do not receive your password for those services.

Trackers and preferences — the searches you create (keywords, selected marketplaces, filters, match rules), notification settings, sleep schedules, and similar configuration.

AI check inputs — if you use AI-powered checks, the prompt text and listing details you choose to evaluate are sent to our AI provider (see §4) to produce a result.

Support and communications — messages you send us.

2.2 Information created through your use of the Service

Marketplace results ("hits") — to run your trackers we retrieve publicly available listing data from the marketplaces you choose (e.g. title, price, image, URL, seller handle, location) and store the results that are surfaced to you.

Credits and billing records — your credit balance and a ledger of credit grants, purchases, and usage. Payment card details are handled by our payment processors and are not stored by us; we retain a processor customer/transaction identifier and purchase metadata.

Authentication & security logs — sign-in, logout, token, and password events, including IP address, approximate time, device/session name, and outcome, used to secure accounts and prevent abuse.

Notification delivery — push device tokens (for phone and web push), webhook endpoints you configure, and delivery status.

Device & usage data — standard technical data such as browser/app type, device identifiers, and log data.

Referrals — your referral code and referral relationships, where you use that feature.

2.3 Cookies and similar technologies

We use a small number of strictly-necessary cookies and similar local storage to keep you signed in and operate the Service. We do not use third-party advertising cookies.

3. How we use information

To provide, operate, and maintain the Service (run your trackers, deliver hits and notifications, manage credits).

To create and secure your account and authenticate you.

To process purchases and maintain billing records.

To detect, prevent, and investigate fraud, abuse, and security incidents.

To communicate with you about the Service (transactional messages, and — where permitted — product updates you can opt out of).

To comply with legal obligations and enforce our Terms.

4. How we share information

We do not sell your personal information. We share it only with:

Service providers / processors acting on our behalf, including: hosting and content delivery (Hetzner, Cloudflare); payment processing (Stripe, PayPal, and for mobile in-app purchases Apple, Google, and RevenueCat); authentication providers you choose (Google, Apple, Facebook); AI processing (OpenAI) for AI checks; push and email delivery (Apple/Google push services — APNs/FCM — and our email provider); and the marketplaces from which we retrieve listing data on your behalf.

Legal and safety — where required by law, to enforce our Terms, or to protect rights, safety, and security.

Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. International transfers

We operate from Romania (EU) and use providers that may process data in other countries, including the United States. Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses or an adequacy decision).

6. Data retention

We keep account and billing records for as long as your account is active and as needed to comply with legal, tax, and accounting obligations. Operational data such as marketplace check history is retained on a rolling basis and then deleted or aggregated. You can request deletion as described in §7.

7. Your rights and choices

Depending on where you live (for example under the EU/UK GDPR or California CCPA/CPRA), you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. You can manage much of your data in-app (account, trackers, notification settings, connected sign-in methods) or request help at the contact below. We will not discriminate against you for exercising your rights.

8. Security

We use technical and organizational measures to protect your information, including hashed passwords and hashed access tokens, encrypted transport (HTTPS), and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Children

The Service is intended for users aged 18 and over and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us information, contact us and we will delete it.

10. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and update the "Last updated" date; material changes will be communicated as required by law.

11. Contact us

Questions or requests about this Policy or your data: [email protected] — SentoWeb Srl, Romania. You also have the right to lodge a complaint with your local data protection authority (in Romania, the ANSPDCP).