Privacy Policy

This Privacy Policy explains how Gromly ("we", "us") collects, uses, and protects your personal data when you use our collaborative trip planning service. We comply with the EU General Data Protection Regulation (GDPR) and applicable Spanish data protection law.

The data controller responsible for your personal data is:

For any questions about how we handle your data, to exercise your rights, or to report a concern, please contact us at the email above.

We collect the following categories of personal data:

• Contract performance (Art. 6(1)(b)): Account data, trip content, financial data, uploaded documents — necessary to deliver the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): Error monitoring and security logs — necessary to maintain a stable and secure service.
• Legal obligation (Art. 6(1)(c)): Payment records — retained as required by applicable tax and accounting law.
• Consent (Art. 6(1)(a)): Any optional features explicitly described as consent-based (e.g., future analytics or marketing).

We share data with the following sub-processors to operate the service. All are bound by data processing agreements and, where applicable, EU Standard Contractual Clauses (SCCs) for transfers outside the EU:

We do not sell your data to third parties or use it for advertising purposes.

Gromly uses one cookie:

We do not use tracking cookies, advertising cookies, or analytics cookies. Your authentication access token is stored in memory only and is never written to disk.

• Account and trip data: Retained for as long as your account is active. When you delete your account, all your data is permanently deleted within 30 days.
• Payment records: Retained for 5 years as required by Spanish tax law (Ley General Tributaria).
• Session tokens: Refresh tokens expire after 7 days. Revoked immediately on logout or account deletion.
• Error logs (Sentry): Retained for 90 days.

As a data subject under GDPR, you have the following rights. To exercise any of them, email us at contact@gromly.io. We will respond within 30 days.

• Right of access (Art. 15): Request a copy of all personal data we hold about you. You can also use "Export my data" in account settings.
• Right to rectification (Art. 16): Correct inaccurate data via your account profile.
• Right to erasure (Art. 17): Delete your account and all associated data from account settings.
• Right to data portability (Art. 20): Export your data in machine-readable JSON format via account settings.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to restriction of processing (Art. 18): Request that we restrict how we use your data while a dispute is pending.

You also have the right to lodge a complaint with the Spanish data protection authority: Agencia Española de Protección de Datos (AEPD) at www.aepd.es.

Some of our service providers (Sentry, Stripe, Google, OpenAI) are based in the United States. These transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring your data receives a level of protection equivalent to GDPR standards.

OpenAI processes trip content you submit to the AI assistant, and a reduced copy of the photos you ask it to place on a stop. This data is used to generate responses and is not used to train OpenAI models (under our API usage agreement).

We implement appropriate technical and organisational measures to protect your data:

• Passwords are hashed using bcrypt and never stored in plain text.
• Session tokens are signed JWTs; refresh tokens are stored as hashes.
• All communications use HTTPS/TLS in transit.
• Authentication cookies are HttpOnly and Secure.
• Two-factor authentication (TOTP) is available and encouraged.

Gromly is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or via an in-app notice. The "Last updated" date at the top of this page reflects the most recent revision.