Privacy Policy

Information you provide. If you contact us, we receive the contact details you provide, your message and related correspondence. This can include your name, email address and information needed to resolve an enquiry, correction, legal matter or privacy request.

Automatic collection. Delivering pages and assets involves request information such as IP address, browser and user-agent information, requested URL, request time and delivery or security events. Our infrastructure providers process this information to serve requests and protect the Site. Font requests also disclose connection information to Adobe as described below.

Sources and sensitive information. Information comes directly from your communications and browser requests, or an authorized person assisting with an enquiry. We do not buy visitor profiles from data brokers. We do not request government identification, health data, biometric identifiers or precise device location for ordinary browsing. Send only information necessary for your request and that you are authorized to provide.

The Site does not set its own advertising or analytics cookies and does not use advertising pixels, visitor session replay or cross-site analytics. Hosting and security providers may use technologies necessary to deliver requests and prevent abuse. Your browser may cache pages and assets.

Adobe Fonts. The Site loads a font stylesheet and font files from Adobe. Those requests transmit connection metadata, including IP address and browser request information. Adobe’s Fonts privacy notice describes its processing.

Search, filters and sorting are reflected in the page URL. When that URL is requested from the server or shared with another person, it can disclose the selected query and filters. Do not put confidential or sensitive information in a search query. A linked third-party site may use its own cookies and technologies under its own notice.

• Delivery and operations: serve pages and assets, diagnose delivery problems and maintain the Site.
• Correspondence: respond to questions, corrections, support enquiries and privacy requests.
• Compliance and protection: prevent abuse, investigate security incidents, comply with lawful obligations and requests, and establish, exercise or defend legal claims.

We do not sell personal information, share it for cross-context behavioral advertising or use it for targeted advertising. We do not send marketing messages because you visited the Site. Replies and notices relating to an enquiry may still be sent.

We retain personal information for as long as reasonably necessary for its collection purpose, including delivery, security, resolving correspondence and complying with legal requirements. We consider its nature and sensitivity, the purpose, applicable legal requirements and outstanding claims.

Infrastructure providers retain request and security records according to their operational requirements. Correspondence may be retained to respond and document a matter’s resolution. When information is no longer needed, it is deleted or anonymized, or isolated from further use until deletion is possible, subject to lawful exceptions and backup lifecycles.

Service providers. Hosting, network security and email providers process information needed to deliver the Site and handle correspondence. Cloudflare provides website delivery and infrastructure. Adobe processes font requests as described above. Providers may also process information for their own purposes under their applicable notices.

Professional advisers and authorities. We may disclose relevant information to advisers, government authorities or other parties where reasonably necessary for lawful obligations, protecting rights or safety, investigating abuse or establishing or defending a claim.

Business transfers and your instructions. Relevant information may be shared in an actual or proposed merger, financing, acquisition or transfer of the business, subject to appropriate confidentiality and applicable law. We may also share information with a recipient you authorize. These purposes do not authorize advertising sales of your information.

Providing information. You can browse without sending us correspondence. If you ask us to investigate a matter but decline to provide the information needed to identify it, we may be unable to resolve it.

Browser controls. You can manage cookies, cached files and external requests through your browser settings. Blocking necessary delivery or security requests can affect access. Blocking font requests uses the Site’s native font fallback. Do Not Track signals do not change essential request processing; the Site does not use cross-site behavioral tracking.

Privacy requests. Use How to contact us to request access, correction, deletion or another right that applies to you. The State privacy rights and European sections below explain additional rights and procedures.

The Site links to publications, evaluation platforms and model providers operated by others. These links do not imply endorsement or affiliation. We do not control their information practices. Review their privacy notices before visiting them or providing information.

We use safeguards appropriate to the information processed, including encrypted transport and access controls. Security risk is inherent in internet services, and no service can guarantee complete security.

Report a suspected vulnerability or disclosure using the security address in How to contact us. Do not include usable credentials or unnecessary personal information in an initial report.

Company is based in the United States. Our service providers may process information in the United States or other countries, where privacy protections may differ from those in your location.

Where a transfer is subject to European or other transfer restrictions, it must use a mechanism permitted by applicable law, such as an applicable adequacy decision, approved contractual safeguards or a legally available exception. You may request information about safeguards applicable to your information through How to contact us.

The Site is intended for adults and is not directed to anyone under 18. If you believe a child has provided personal information in a manner prohibited by law, use How to contact us to identify the relevant interaction. We will investigate and take deletion or other measures required by law.

We may update this Policy as our practices or legal requirements change. The effective date identifies the current version. Material changes will be announced through a prominent notice on the Site or another appropriate method. Where a change requires consent under applicable law, we will request it separately.

Grid Heap, Inc., a Delaware corporation
Business address: 1111B S Governors Ave Ste 51059, Dover, DE 19904, United States

Privacy questions, data-subject requests and appeals: legal@gridheap.com.
Security incidents and vulnerabilities: security@gridheap.com.

To make a privacy request, identify the right you wish to exercise and provide enough information to locate the relevant records. You may also write to our business address. Do not send government identification unless we specifically request it through an appropriate method.

This section applies where a U.S. state privacy law governs our processing. Rights are subject to its conditions, exemptions and limitations and may include confirmation of processing; information about categories, sources, purposes and recipients; access; correction; deletion; portability; and opting out of sale, sharing, targeted advertising or certain profiling. We do not use sensitive information to infer characteristics or conduct profiling with legal or similarly significant effects.

Notice at collection. The categories processed for the Site are contact details and correspondence you provide, and internet or network request information. Collection sources and uses are described above; recipient categories are in How we share your personal information, and retention criteria are in Retention. We do not sell or share these categories for cross-context behavioral advertising.

Requests and verification. Submit a request using How to contact us. We may verify identity using information associated with the enquiry and request additional information proportionate to the risk. An authorized agent may act with evidence of authority; we may also seek your confirmation where law permits. We respond within the period required by the applicable law.

Appeals and nondiscrimination. If we deny a request, we explain the reason subject to legal restrictions. Where an appeal right applies, use the same contact details and identify the request and why you believe the decision should change. We will provide the outcome and any applicable route to complain to the relevant authority. We do not unlawfully discriminate against people for exercising privacy rights.

Opt-out signals. The Site does not conduct sale, sharing or targeted advertising requiring an opt-out. We honor applicable opt-out preference signals, including Global Privacy Control, as required by law. Such a signal does not prevent essential delivery or security processing.

California and Nevada. California residents may make a Shine the Light enquiry about applicable disclosures for third-party direct marketing using the contact details above. We do not disclose personal information for another company’s own direct marketing. Nevada residents may submit an applicable sale opt-out request through the same methods, although we do not sell information for monetary consideration.

Controller. Company is the controller for the personal information covered by this Policy where the GDPR or UK GDPR applies. Its details are in How to contact us.

Our legal bases. We rely on legitimate interests for delivering and protecting the Site, diagnosing problems and responding to ordinary correspondence, where those interests are not overridden by your rights. Processing necessary to provide a service you request or take steps at your request before a contract relies on performance of a contract. Compliance with lawful obligations relies on legal obligation. Where consent is required, processing relies on the specific consent obtained; it can be withdrawn without affecting prior lawful processing.

Your rights. Subject to legal conditions, you may request access, rectification, erasure, restriction of processing and a portable copy of your information. You may object to processing based on legitimate interests, including direct marketing, and withdraw consent where it is the basis. We do not make solely automated decisions about you with legal or similarly significant effects.

Exercise a right using How to contact us. We may request proportionate information to verify identity and locate records, and will respond within the applicable legal period. If we cannot comply, we explain legal grounds and available remedies. The Retention and International data transfer sections describe the relevant practices.

Complaints. You may complain to the supervisory authority in your habitual residence, place of work or place of the alleged infringement. EEA authority contacts are listed by the European Data Protection Board; UK users may contact the Information Commissioner’s Office.