Privacy Policy
Grain is operated by Grainreport Ltd (company number 17414969), a company based in the United Kingdom. References to "Grain", "we", "us" or "our" refer to this entity. This policy explains what personal data we collect, why we collect it, and how we handle it.
If you have any questions, contact us at hello@grainreport.co.uk.
1. What data we collect
When you create an account and use Grain, we collect and store the following:
- Your email address and a hashed (encrypted) version of your password
- Your restaurant/venue details, if provided - including name, address, description, style, menu highlights, current specials, dietary options, contact details and website
- Review text you paste into Grain for analysis, including reviewer names, ratings, dates and written content
- AI-generated analysis reports produced from your reviews
- Drafted review responses generated on your behalf
- Payment information processed by Stripe (we do not store card details directly)
- Usage data such as analysis dates and account activity
We do not collect data about your customers directly. Review text you submit may contain third-party personal data (reviewer names and written content) posted publicly on platforms such as Google. We process this data on your behalf under legitimate interests - to help you understand feedback about your own business.
1a. Connecting your Google Business Profile
If you choose to connect your Google Business Profile to Grain, you grant us access to read reviews from your listing on your behalf, so they can be pulled in and analysed automatically. This is entirely optional - Grain works fully without it, using manually submitted reviews.
If you connect your account, we store an encrypted authorisation token that lets Grain access your Google Business Profile data. This token is encrypted at rest and is never visible to us in readable form. You can disconnect at any time from Settings, which immediately and permanently deletes this token from our systems.
We only request the minimum access needed to read your reviews and identify your business listing. We do not post, edit, or delete anything on your Google Business Profile on your behalf.
2. How we use your data
- To provide the Grain service - analysing reviews and generating reports
- To send you analysis reports and account-related emails
- To process your subscription payments
- To improve the accuracy and quality of our analysis
- To respond to support requests
3. Who we share data with
We share data only with the third-party services necessary to operate Grain:
- Anthropic - review text is sent to Anthropic's API to generate analysis reports.
- Render - our hosting provider. All data is stored on Render's infrastructure.
- Resend - used to deliver email reports and account notifications.
- Stripe - processes subscription payments. We do not store your card details.
- PDFShift - used to generate PDF versions of analysis reports.
We do not sell your data to any third party, and we do not use your data for advertising purposes.
4. Data retention
We retain your data for as long as your account is active. When you delete an analysis, the associated review text and any reviewer personal data is permanently deleted. When you close your account, all personal data is deleted within 30 days. Payment records may be retained longer where required by law.
5. Your rights
Under UK GDPR you have the right to access, correct, delete, or export your personal data, and to object to or restrict our processing. To exercise any of these rights, email support@grainreport.co.uk. We will respond within 30 days.
6. Security
Passwords are hashed before storage and never stored in plain text. All data is transmitted over HTTPS. We take reasonable steps to protect your data but cannot guarantee absolute security.
7. Cookies
Grain uses a session cookie to keep you logged in. We do not use tracking cookies or third-party advertising cookies.
8. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email. Continued use of Grain after changes constitutes acceptance of the updated policy.
9. Contact
For any privacy-related queries, contact us at hello@grainreport.co.uk.