Privacy Policy
for GRAN Software Solutions GmbH

Effective from: October 7, 2026

This Privacy Policy applies to you when you use our services and products (including our websites and blogs).

Data Controller

The controller responsible for processing your data is GRAN Software Solutions GmbH, Am Hamburger Bahnhof 3 c/o Glazewski, 10557 Berlin, Germany.

How to contact GRAN

You can contact us by email at hello@gransoftware.de. We have not appointed a data protection officer, as we are not obliged to do so under Art. 37 GDPR. For all data protection matters, please use the contact details above.

Children

Our services and products, including websites and blogs, are not intended for persons under the age of 18. Should we become aware that we have unintentionally collected personal data from such persons, we will take immediate measures to delete this information. If you believe that we may be in possession of personal data from persons under the age of 18, please notify us immediately at hello@gransoftware.de.

What data we collect

Personal data we receive directly from you

User Information – When you create an account in one of our products or services, we collect certain personal data, including, but not limited to, your email address, first and last name, time zone. (collectively referred to as “User Information”)

User-Generated Content – Whenever you use one of our products or services, you can create content such as notes, calendar entries, time entries, contract documents, customer and project information, and more. We collect all of this information (collectively referred to as “User-Generated Content”).

Communication Information – When you communicate with us via email, phone, through one of our websites, products, or services, or through other channels such as social media or Discord, we collect, among other things, your contact information, your name, and the content of your messages (collectively referred to as “Communication Information”).

Personal data we receive indirectly through your use of our products and services

This includes, but is not limited to, visiting our websites and blogs. This data is collected directly from your browser or device when you use our websites and is described below.

Cookies and similar technologies – We use cookies and other technologies (e.g., local storage). We store information on your device, such as your authentication token, which is required to use private areas of our websites, products, and services (collectively referred to as “Cookies”). For more information, please see our Cookie Policy.

Device Information – This includes the IP address, device name, operating system, unique device identifiers, and the browser you use (collectively referred to as “Device Information”).

Usage Data – We may automatically collect information about your use of our websites, products, and services, such as the features you use and the actions you take (collectively referred to as “Usage Data”).

Log Data – Information that is automatically sent by your browser or device when you access our websites, products, and services. This includes, but is not limited to, your IP address and the date and time of your request (collectively referred to as “Log Data”).

Website analytics

Our websites use Umami, an open-source analytics software that we operate on our own servers in the European Union. When you visit our websites, the following data is transmitted to our analytics server: the pages you view, the page that referred you, your IP address, information about your browser and operating system, your screen size, and website performance metrics (such as page load times). Your IP address is used only in memory, to derive your country and a short-lived visitor identifier, and is never stored. Of the location only the country is kept; region and city are removed. The visitor identifier is a keyed hash of the IP address and browser information that changes every day, so visits on different days cannot be linked to each other. Umami does not set cookies. We do not record mouse movements, clicks or scrolling.

The legal basis for this processing is our legitimate interest under Art. 6(1)(f) GDPR in understanding how our websites are used and how they perform, so that we can improve them. In balancing this interest against yours: the data is collected and stored exclusively on our own servers in the EU, is never shared with third parties, is not used for advertising, and is not combined with data from other websites or services. You have the right to object to this processing at any time (see “Your rights” below). If you object, contact us at hello@gransoftware.de and we will stop processing your data for analytics purposes.

Analytics data is retained for 24 months and then deleted.

How we use your data

• To provide, maintain, develop, and improve our services, products, and websites.
• To measure the use and performance of our websites (website analytics, see above).
• To conduct research.
• To communicate with you about our services, products, and websites.
• To protect GRAN, our users, and the public by improving the security and reliability of our services, including detecting, preventing, and responding to fraud, abuse, security risks, and technical issues.
• To comply with legal obligations, including applicable laws, regulations, legal processes, or enforceable governmental requests, and to protect the rights, privacy, safety, or property of our users, affiliates, or third parties.

With whom we share your data

We may share your personal data as needed or when appropriate with the following parties:

• Suppliers and service providers. We work with third-party providers and service providers to provide our products and services, and we may share your personal data with them for this purpose. This includes, but is not limited to, hosting or cloud providers, payment providers, and email services.
• Communication platforms. If you contact us via Discord or social media, the content of your messages and your user name are processed by the respective platform provider.
• Business transfers. In the event of a merger, acquisition, or other business transition, your personal data may be transferred as part of that transaction.
• Government authorities or other third parties. We may disclose your personal data if required by law or if we believe that such action is necessary to comply with legal obligations or to protect our rights and those of our users.
• Other users of our products and services. Some features of our services allow you to share information with other users. In such cases, your personal data may be visible to these users, for example, when you invite others to your organization.
• Third parties with whom you share your information. If you voluntarily share your data with third parties (e.g., via integrations, external apps, or exporting documents), we may also share your personal data with them at your direction.

Sub-processors

We use the following sub-processors for the operation of the Service:

Our website analytics runs on our own infrastructure and does not involve any additional sub-processor.

Retention

We retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected, including to provide our services, comply with legal obligations, resolve disputes, enforce agreements, and protect our legitimate business interests.

In particular:

• Server log data (IP address, date and time, requested page) is retained for 14 days for security and troubleshooting purposes.
• Website analytics data is retained for 24 months.
• Data associated with your user account is retained for the duration of our contractual relationship and deleted afterwards, unless legal retention obligations apply.
• Invoices and accounting records are retained for up to 10 years as required by German tax and commercial law (§ 147 AO, § 257 HGB).
• Communication data is retained as long as necessary to handle your request and to comply with legal obligations.

Once personal data is no longer required for these purposes, we will securely delete or anonymize it in accordance with applicable laws.

Legal bases for processing

The data we collect and the reasons for processing have the following legal bases:

• Contractual necessity. We process your data to fulfill the contract you have with us and to provide the services you have requested, e.g., when you purchase access to our products and services (“Contractual Necessity”).
• Legal obligations. We process your data when we are legally required to do so, e.g., we must retain the invoices sent to you for accounting purposes (“Legal Obligations”).
• Legitimate interests. We process your data for our legitimate interests and those of third parties, e.g., to improve services, maintain relationships, or for internal administrative purposes (“Legitimate Interests”).
• Vital interests. We process your data to protect your vital interests and those of others, e.g., when health or life is at stake (“Vital Interests”).
• Consent. We process your data for the purposes for which you have given us your consent, e.g., to send you emails (“Consent”).

Below is a summary of what, how, and why we collect and process data:

Your rights

• Right to information about your personal data collected and processed by us.
• Right to rectification of your personal data if it is outdated or incorrect.
• Right to be forgotten, i.e., erasure of your personal data from our records.
• Right to restriction of processing of your personal data.
• Right to object to the processing of your personal data (e.g., for direct marketing) at any time.
• Right to take your personal data with you or transfer it to other providers.
• Right not to be subject to automated decision-making.
• Right to withdraw your consent at any time if it is our legal basis for processing.
• Right to lodge a complaint with a supervisory authority. You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR). The supervisory authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59-61, 10555 Berlin, Germany.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

You can exercise your rights through the interfaces of our services and products or by contacting us at hello@gransoftware.de.

Data transfers

Website data. The data collected when you visit our websites — server log data and website analytics data — is stored exclusively on servers located in the European Union / European Economic Area, using infrastructure providers located in the EU/EEA (Hetzner: Germany / Finland; Scaleway: Poland / France). Website visitor data is not transferred to third countries. Our websites load no fonts, scripts, icons or maps from third-party servers.

Product and support data. We may transfer your personal data to third parties outside the EEA when this is necessary for the operation of our products and services — for example, when you contact us by email or via communication platforms such as Discord, or when payment providers process your transactions.

We ensure that we work with partners and providers who use Standard Contractual Clauses (SCCs), rely on adequacy decisions of the European Commission (such as the EU-US Data Privacy Framework), or ensure that the recipient country has adequate data protection laws.

Changes to the Privacy Policy

We may update this Privacy Policy from time to time. When this happens, we will post the updated version on this page, unless the law requires a different type of notification.