Privacy Policy

Grain is operated by Yamsilver Ltd (registration pending), a company based in the United Kingdom. References to "Grain", "we", "us" or "our" refer to this entity. This policy explains what personal data we collect, why we collect it, and how we handle it.

If you have any questions, contact us at hello@grainreport.co.uk.

1. What data we collect

When you create an account and use Grain, we collect and store the following:

• Your email address and a hashed (encrypted) version of your password
• Your restaurant name and address, if provided
• Review text you paste into Grain for analysis, including reviewer names, ratings, dates and written content
• AI-generated analysis reports produced from your reviews
• Drafted review responses generated on your behalf
• Payment information processed by Stripe (we do not store card details directly)
• Usage data such as analysis dates and account activity

We do not collect data about your customers directly. Review text you submit may contain third-party personal data (reviewer names and written content) posted publicly on platforms such as Google. We process this data on your behalf under legitimate interests - to help you understand feedback about your own business.

2. How we use your data

• To provide the Grain service - analysing reviews and generating reports
• To send you analysis reports and account-related emails
• To process your subscription payments
• To improve the accuracy and quality of our analysis
• To respond to support requests

3. Who we share data with

We share data only with the third-party services necessary to operate Grain:

• Anthropic - review text is sent to Anthropic's API to generate analysis reports.
• Render - our hosting provider. All data is stored on Render's infrastructure.
• Resend - used to deliver email reports and account notifications.
• Stripe - processes subscription payments. We do not store your card details.
• PDFShift - used to generate PDF versions of analysis reports.

We do not sell your data to any third party, and we do not use your data for advertising purposes.

4. Data retention

We retain your data for as long as your account is active. When you delete an analysis, the associated review text and any reviewer personal data is permanently deleted. When you close your account, all personal data is deleted within 30 days. Payment records may be retained longer where required by law.

5. Your rights

Under UK GDPR you have the right to access, correct, delete, or export your personal data, and to object to or restrict our processing. To exercise any of these rights, email hello@grainreport.co.uk. We will respond within 30 days.

6. Security

Passwords are hashed before storage and never stored in plain text. All data is transmitted over HTTPS. We take reasonable steps to protect your data but cannot guarantee absolute security.

7. Cookies

Grain uses a session cookie to keep you logged in. We do not use tracking cookies or third-party advertising cookies.

8. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email. Continued use of Grain after changes constitutes acceptance of the updated policy.

9. Contact

For any privacy-related queries, contact us at hello@grainreport.co.uk.