Privacy Policy

01Data we collect

We collect only the data necessary to run GRE. The table below lists each category, what it includes, why we process it, and the legal basis we rely on.

We do not collect special-category personal data (such as health, religion, or biometric data). If you voluntarily include such data inside a workspace document, it is treated as workspace data under your control.

02How we use data

We use your data to:

• Provide the service — operate your workspace, render documents, and compute coverage.
• Keep the service secure — detect abuse, investigate incidents, and enforce access controls.
• Meet compliance obligations — maintain audit trails required by frameworks such as ISO 27001 and PDPA.
• Improve the product — analyze aggregate usage to fix bugs and prioritize work. We never sell your data.
• Communicate with you — send service notices, security alerts, and responses to your requests.

03Legal basis

Under PDPA and GDPR, we may only process your personal data on a valid legal basis. GRE relies on the following:

• Consent — for optional communications and any processing you explicitly agree to. You may withdraw consent at any time.
• Contract — to deliver the service you signed up for, including account setup and workspace operations.
• Legitimate interest — for security monitoring, abuse prevention, and product improvement, balanced against your privacy rights.
• Legal obligation — where Thai or international law requires us to retain records or disclose data to authorities.

Where we rely on legitimate interest, we have completed a balancing test to confirm your rights are not overridden.

04Data sharing

We do not sell your personal data. We share it only as described below.

Subprocessors

Service providers who process data on our behalf to operate GRE:

• Supabase — hosted database, authentication, and file storage.
• [COMPLETE LIST] — additional subprocessors pending legal confirmation.

Each subprocessor is bound by a data processing agreement that limits how it may use your data.

No sale of data

We never sell personal data to third parties, and we do not use it for advertising.

Law enforcement

We may disclose data if required by law, court order, or to protect the rights, property, or safety of GRE, our users, or others.

05Data retention

We keep your data only as long as necessary:

• Active accounts — your workspace data is retained while your account is active.
• Deleted accounts — after account deletion, we retain data for [RETENTION PERIOD] to handle legal obligations, then permanently delete it.
• Audit log — security and compliance audit entries are retained for [AUDIT RETENTION] as required by [APPLICABLE FRAMEWORK].

06Your rights

Depending on where you live, you may have the following rights over your personal data:

• Access — request a copy of the data we hold about you.
• Rectify — correct inaccurate or incomplete data.
• Erase — request deletion of your data, subject to legal retention duties.
• Restrict — ask us to limit processing in certain circumstances.
• Port — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interest.

To exercise any of these rights, contact us at [PRIVACY@EMAIL]. We will respond within [RESPONSE TIME] as required by PDPA and GDPR.

07Security

We protect your data with industry-standard controls:

• Encryption at rest — your data is encrypted in the underlying Supabase database.
• Row-level security — database access is scoped per workspace so tenants cannot read each other’s data.
• Audit logging — material actions are recorded for accountability and incident response.
• Access controls — internal access is least-privilege and reviewed on a regular cadence.

No system is 100% secure. In the event of a personal data breach affecting your rights, we will notify you and the relevant authority within [BREACH NOTIFICATION PERIOD] as required by law.

08Cookies

GRE uses a small set of cookies and similar technologies:

• Essential — a session cookie keeps you signed in. The service cannot function without it.
• Analytics [IF ANY] — if we enable product analytics, it is privacy-respecting and used only to improve the service.

We do not use tracking cookies for advertising.

09International transfers

Your data is stored in [SUPABASE REGION]. Where data is transferred across borders — for example, between your country and our infrastructure region — the transfer is governed by [SCC/ADEQUACY] to ensure a level of data protection consistent with PDPA and GDPR.

10Changes to this policy

We may update this Privacy Policy as the service evolves. When we do:

• We will post the updated version on this page and revise the “Last updated” date.
• For material changes that affect your rights, we will notify you by email before they take effect.

Continued use of GRE after a change takes effect means you accept the updated policy.

11Contact

If you have questions about this policy or your personal data, contact our Data Protection Officer:

• Name: [DPO NAME]
• Email: [PRIVACY@EMAIL]
• Postal address: [ADDRESS]

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.