Your privacy is extremely important to us. Learn how we handle, protect, and respect your personal information.
GrapeCity India Private Limited Privacy Statement
This website is maintained by GrapeCity India Private Limited ("GrapeCity"), which has a software development centre at A-15, Sector 62, Noida, Uttar Pradesh - 201307.
This policy also covers GrapeHub MyAccount (myaccount.grapehub.io) ("MyAccount"), the account service where you sign in, manage subscriptions and licenses, place orders and pay. GrapeCity is the controller of the personal data processed in MyAccount.
By accessing or using this site, you agree to this Online Privacy Policy. If you do not agree, please do not access or use this site.
If you use kenzoAI, your use is additionally governed by the kenzoAI Terms, and the kenzoAI Data Policy governs how we process information you submit with a kenzoAI request, supplementing this Privacy Policy for that feature.
If you have any questions or concerns, please contact our Data Protection Officer at dpo.india@grapecity.com.
This policy explains how GrapeCity treats your Personal Information, and applies to information we collect on our website(s), through our products, and through email, text, and other electronic messages between you and us, including technical support, whenever you sign up for an account.
1. Commitment to Privacy
We are committed to protecting your online privacy and to managing the personally identifiable information ("Personal Information") you share with us appropriately. Personal Information is anything that can identify you, such as your name, address, phone number, e-mail address, or other contact details you or someone else provides to us. You can generally visit GrapeCity's Web pages without disclosing who you are or revealing any Personal Information. If you do choose to share Personal Information, we may transfer it, within GrapeCity or to our third-party service providers, across borders to other countries, subject to the limits in this Privacy Policy. GrapeCity aims to comply with privacy laws worldwide and, where legal requirements vary by country, to follow the principles in this policy.
2. Data Collection
When you visit this website, you can download a software trial or create an account (a one-time process) that lets us recognize you when you return. Creating an account authorizes us to control the personal data you provide. We collect only basic personal data: some or all of your name, organization, job title, address, email address, IP address, telephone number, contact history, order history, information selection choices, and product usage information from GrapeCity and our Technology Partners. This also includes anything you tell us, whether we asked or not, by email, phone, voicemail, or chat, and a record of your sign-ins to your GrapeCity account.
Through MyAccount we also process your name, phone number and email address; your billing address and tax ID (if you provide one); your organization name (company accounts only); the identifier Google provides, with your name and email, when you sign in with Google; an internal user ID; and your orders, payments, subscriptions and licenses. Card and bank details are entered with Razorpay and are not stored by us.
If you use kenzoAI, we additionally process the build information, logs, source-code or configuration diffs, and configuration details you submit explicitly, or BuildNinja includes, with each request, as described in the kenzoAI Data Policy. This is separate from, and not required for, the basic personal data described above.
If you do not create an account or download a trial, we will not have collected any of your personal data, and you can still use most of our website's information features without registering.
3. Purpose of Collection
We collect your basic personal data to run our business systems, give you a better experience, and provide better product and business information. We do not collect data we do not need, and we keep all personal data confidential. During registration, we ask your permission before using your data for email communications, marketing, or complimentary promotional items.
Registering gives you full access to our website. Once signed in, you can update your personal details, enjoy a smoother experience, view product information, request trials, create quotations, set up payment methods, and receive product upgrades, release information, selection assistance, and special offers, along with other features that improve your experience.
When you purchase software, we register your name, organization, street address, and email address to confirm you as a legitimate licensee. This ensures you can download the latest product version and that you receive the latest updates, maintenance, and support.
Lawful bases for processing
We process MyAccount data on these lawful bases:
Contract: to create your account, sign you in, process your orders and payments, and provide the subscriptions and licenses you buy.
Legal obligation: to issue tax-compliant invoices and keep the accounting records the law requires.
Legitimate interests: to check, using the email stored with a short link, that the right person opens it.
Consent: for marketing emails, for any marketing use of your sign-in details by the Marketing Portal, and for optional analytics cookies and browser storage.
4. Data Usage
We process personal data through our employees and third-party service providers engaged for this purpose. All third-party service providers acting on our behalf are contractually obligated to comply with the principles set out in this Policy. We implement appropriate safeguards to ensure that personal data processed by such providers is handled securely and in accordance with applicable data protection laws. These safeguards include:
- Contractual obligations: Requiring third-party service providers to comply with applicable data protection requirements and maintain appropriate confidentiality and security obligations.
- Purpose limitation: Ensuring that third-party service providers process personal data only for specified, legitimate purposes and in accordance with our documented instructions, where applicable.
- Access restrictions: Limiting access to personal data to authorised personnel who require such access to perform the contracted services.
- Security measures: Requiring appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.
- Due diligence and oversight: Taking reasonable steps to assess the data protection practices and reliability of third-party service providers.
- Data transfers: Implementing appropriate safeguards for transfers of personal data to third parties or across national borders, where required by applicable law.
Google Sign-In
Where you choose to sign in using Google, Google processes personal data in connection with its Sign in with Google service in its capacity as an independent data controller, rather than as a third-party service provider acting on our behalf. Google's processing of personal data is governed by its own privacy policy and applicable terms. We do not control Google's independent processing activities. Please refer to Google's privacy policy for further information about how Google collects, uses and protects your personal data.
We use your personal data to communicate with you about your account, product updates, and related information, and to improve your experience. With your consent, we may also use your name and email address to tell you about future offers, product developments, and new products that may interest you, based on your past inquiries and orders.
GrapeCity has a Data Protection Officer who oversees the effective, secure, and confidential processing of your personal data. For more information about our data protection process, contact our Data Protection Officer at dpo.india@grapecity.com.
5. Cookies
5.1 GrapeCity Cookie Policy
GrapeCity and some third-party service suppliers use cookies (small text files on your device) and similar technologies to help provide our website and online services and to collect usage and performance data. Cookies help us recognize you when you return, remember your preferences and settings, let you sign in, combat fraud, and analyze how our website and services are performing; we also use them for the other purposes described in the cookie details in Section 5.3. Our website may also include cookies from third-party service providers.
You can control cookies and similar technologies in several ways, including browser controls to block or delete them, and opt-out controls offered by some third-party analytics providers. Your choices here may affect your experience on our website.
5.2 Cookie Controls
You can restrict or block the cookies set by GrapeCity's website(s) through your browser settings. Doing so may affect functionality such as signing in, managing your account, or purchasing products. A small number of GrapeCity's suppliers also set cookies on our website(s) on our behalf.
5.3 Cookies Used by Our Products
The cookies and similar browser storage used by each of our products are described below for BuildNinja, GrapeHub MyAccount and the kenzoAI Developer Portal. Analytics cookies and storage are optional and are used only if you choose Accept all or enable Analytics in Privacy settings.
5.3.1 BuildNinja
This section explains the cookies and similar browser storage used on BuildNinja.
Necessary storage. Necessary storage keeps the website working and remembers your privacy choice. It remains active because the site cannot reliably provide these functions without it. It is not used for analytics or advertising.
Website analytics. Analytics is optional and remains off unless you select Accept all or enable Analytics in Privacy settings. We use Google Analytics and PostHog to understand page visits, device and browser information, approximate location derived from an IP address, clicks, scrolling and other interactions. PostHog may also record a replay of how you use the page. We use this information to measure and improve BuildNinja.
Campaign details such as UTM parameters and referral source are stored only after Analytics consent. If you withdraw consent, BuildNinja disables analytics and removes its available Google Analytics, PostHog and campaign storage from your browser.
Cookies and browser storage. This list covers the main browser storage used by BuildNinja. Some entries are local or session storage rather than cookies, but they are shown here because they serve a similar purpose.
_gh_aa(provider: BuildNinja; category: Necessary). Remembers your analytics choice and this policy version. Duration: Until you clear browser storage or a new consent version is required.
buildninja-theme(provider: BuildNinja; category: Functional). Remembers your light or dark appearance choice. Duration: Until you change the choice or clear browser storage.
plans(provider: BuildNinja; category: Functional). Caches available plan details to keep pricing, installation and account flows working. Duration: Until refreshed or browser storage is cleared.
redirect(provider: BuildNinja; category: Necessary). Temporarily remembers an internal page to return you there after sign-in. Duration: Until used, replaced or browser storage is cleared.
utm_data(provider: BuildNinja; category: Analytics). Remembers campaign or referral attribution after analytics consent. Duration: Until you withdraw consent or clear browser storage.
_ga and _ga_<measurement-id>(provider: Google Analytics; category: Analytics). Distinguishes visitors and maintains analytics session state. Duration: Up to 2 years, subject to browser limits.
ph_* and PostHog browser storage(provider: PostHog; category: Analytics). Product analytics, consented account identity and session replay. Duration: Browser storage: up to 1 year, subject to configuration. Session replay recordings: 30 days.
The exact Google Analytics and PostHog names can include a project identifier. Browser settings may shorten these durations. PostHog session replay recordings are retained for 30 days. PostHog event records are retained for 1 year. Google Analytics records are retained for 14 months.
Analytics providers and data location. Google Analytics (policies.google.com/privacy) processes analytics data using Google's global infrastructure and may process it outside your country. PostHog (posthog.com/privacy) receives BuildNinja analytics through its United States service endpoint. Processing or support may therefore occur in the United States or other locations used by its approved subprocessors. Where personal data is transferred internationally, GrapeCity applies the contractual and other safeguards required by applicable data-protection law. Further details may be requested from our Data Protection Officer.
External services. BuildNinja uses Google reCAPTCHA to protect forms from abuse. It loads when you start a form. Google Maps loads only after you choose Load map, and YouTube loads only after you choose Load video. These providers may receive technical information such as your IP address, browser and the page you visited, and may use their own cookies or similar storage under their policies. See Google's Privacy Policy (policies.google.com/privacy) for Google Analytics, reCAPTCHA, Maps and YouTube information.
Your choices. Choose Necessary only to continue without analytics, or Accept all to allow analytics. You can reopen Privacy settings at any time to change or withdraw your choice. When you withdraw consent, BuildNinja disables analytics and removes the available analytics cookies and browser storage from your browser. Withdrawing is as easy as accepting.
5.3.2 GrapeHub MyAccount
This section explains the cookies and similar browser storage used by GrapeHub MyAccount.
What are cookies and browser storage? Cookies and similar browser storage help a website remember information on your device. Some are needed for the account service to work. Analytics storage is optional and stays off until you choose it.
Storage we use.
AuthServer.Session(provider: GrapeHub MyAccount; category: Necessary). Keeps a signed-in account session working and protects access to account pages. Duration: Normally 8 hours; up to 7 days when Remember me is selected.
theme(provider: GrapeHub MyAccount; category: Functional). Remembers your light or dark appearance choice. Duration: Until you change the choice or clear browser storage.
redirect(provider: GrapeHub MyAccount; category: Necessary). Temporarily remembers an internal page to return you there after sign-in. Duration: Until used, replaced or browser storage is cleared.
plans and countries(provider: GrapeHub MyAccount; category: Functional). Caches plan information and the country list used in account and checkout forms. Duration: Until refreshed or browser storage is cleared.
checkout (session storage)(provider: GrapeHub MyAccount; category: Necessary). Keeps checkout context while you move through payment. It can include order details and Razorpay prefill information such as name, email address and phone number. Duration: Until the browser tab or session ends, or checkout data is cleared.
g_state(provider: Google; category: Necessary for Google Sign-In). Remembers Google Sign-In sign-out state. Google Identity Services loads on the login page when Google Sign-In is available. Duration: Up to 1 year, as set by Google.
_gh_aa(provider: GrapeHub MyAccount; category: Necessary). Remembers your analytics choice and the policy version. Duration: Until you clear browser storage or a new consent version is required.
_ga and _ga_<measurement-id>(provider: Google Analytics; category: Analytics). Measures visits and use of GrapeHub MyAccount. Duration: Up to 2 years, subject to browser limits.
ph_* and PostHog browser storage(provider: PostHog; category: Analytics). Product analytics, consented account identity and session replay. Duration: Browser storage: up to 1 year, subject to configuration. Session replay recordings: 30 days.
Google Analytics and PostHog names can include a project identifier. Browser settings can shorten storage duration. PostHog session replay recordings are retained for 30 days. PostHog event records are retained for 1 year. Google Analytics records are retained for 14 months.
Your choices. Choose Necessary only to continue without analytics, or Accept all to allow Google Analytics and PostHog. You can reopen Privacy settings at any time to change or withdraw your choice. When you withdraw consent, we disable analytics and remove the available analytics cookies and browser storage from your browser.
Third-party services. Google Analytics and PostHog process analytics data for us only after your analytics choice. Google Identity Services supports account login and may receive device and browser information and set the g_state cookie on the login page. When you select Pay, Razorpay Checkout loads and receives the details needed to process the payment, such as your name, email address, phone number, order ID, amount, currency and payment status. Razorpay may use its own cookies or similar storage during checkout. Our session-replay configuration masks form inputs and excludes the Razorpay checkout area. Their processing is described in this Privacy Policy and their own privacy notices.
5.3.3 kenzoAI Developer Portal
This section explains the cookies and similar browser storage used by the kenzoAI Developer Portal.
What are cookies and browser storage? Cookies and similar browser storage help the Portal remember information on your device. The sign-in cookie is needed for the service to work. Functional storage remembers your Portal preferences. Analytics storage is optional and stays off until you choose it.
Storage we use.
access_token(provider: kenzoAI Developer Portal; category: Necessary). Keeps your signed-in Portal session working and protects access to API management pages. Duration: 24 hours.
gc-coreai-devportal-theme(provider: kenzoAI Developer Portal; category: Functional). Remembers your light or dark appearance choice. Duration: Until you change the choice or clear browser storage.
gc-coreai-sidebar-collapsed and gc-coreai-sidebar-width(provider: kenzoAI Developer Portal; category: Functional). Remembers your sidebar layout preference. Duration: Until you change the choice or clear browser storage.
gc-coreai-i18nextLng(provider: kenzoAI Developer Portal; category: Functional). Remembers your language choice. Duration: Until you change the choice or clear browser storage.
plan_banner_dismissed_ids and ua_filters(provider: kenzoAI Developer Portal; category: Functional). Remembers dismissed plan messages and usage-analytics filters. Duration: Until you change the choice or clear browser storage.
_dp_aa(provider: kenzoAI Developer Portal; category: Necessary). Remembers your analytics choice and the policy version. It adopts your GrapeHub MyAccount analytics choice (_gh_aa) only on your first Portal visit. Duration: Until you clear browser storage or a new consent version is required.
_ga and _ga_<measurement-id>(provider: Google Analytics; category: Analytics). Measures visits and use of the Developer Portal. Duration: Up to 2 years, subject to browser limits.
ph_* and PostHog browser storage(provider: PostHog; category: Analytics). Product analytics and session replay. Duration: Browser storage: up to 1 year, subject to configuration. Session replay recordings: 30 days.
The access_token cookie is set by the Developer Portal authentication service. It is HTTP-only, so page JavaScript cannot read it. Google Analytics and PostHog names can include a project identifier. Browser settings can shorten storage duration. PostHog session replay recordings are retained for 30 days. PostHog event records are retained for 1 year. Google Analytics records are retained for 14 months.
Your choices. Choose Necessary only to continue without analytics, or Accept all to allow Google Analytics and PostHog. You can reopen Privacy settings at any time to change or withdraw your choice. When you withdraw consent, we disable analytics and remove the available analytics cookies and browser storage from your browser. You can clear functional storage through your browser settings. Clearing the sign-in cookie logs you out of the Portal.
Analytics and third parties. Google Analytics and PostHog process analytics data for us only after your analytics choice. The Developer Portal does not use third-party advertising cookies.
6. Optional Disclosure
You can choose whether to give GrapeCity your Personal Information. Some activities, such as ordering products, downloading software, or entering contests, require you to submit information through an online form, but taking part in these activities is entirely optional. If you choose to, we may ask for your name, mailing address, e-mail address, and other identifying information.
7. Data Security
Wherever GrapeCity or a third party holds your Personal Information on our behalf, we use reasonable safeguards, such as encryption and firewalls, to protect it from loss, misuse, or unauthorized access. If a personal data breach occurs, we will report it to the data protection authority within 72 hours.
8. Access/Accuracy
We want to keep any Personal Information you give us accurate and up to date, and to give you a way to access, update, or correct it.
To review your information, contact our Data Protection Officer at dpo.india@grapecity.com, and we will respond within 30 days. You can also ask us to remove all of your User Data. We can only do this by deleting your account and revoking your licenses, and we will do so once we no longer have a lawful basis to process your data, or after a final determination that it was processed unlawfully.
We may keep your User Data if deleting it would violate the law, create a legal problem, or make our records incorrect; otherwise, we retain it as described in this policy. We also cannot fully delete data that exists in earlier backups.
Your rights. You can use your privacy rights (access, correction, erasure and portability) through MyAccount or by contacting our Data Protection Officer at dpo.india@grapecity.com. We apply your request across MyAccount and the connected GrapeCity services that hold your account data (the GrapeCity Subscription API and the GrapeCity Payment Service). Your kenzoAI data is handled separately: erasing your GrapeHub MyAccount data does not erase your kenzoAI data, and erasing your kenzoAI data does not erase your GrapeHub MyAccount data. Make a separate request for each.
9. Third-Party Data Usage
We will not lease, sell, or rent your personal information to third parties, except where necessary to comply with the law, a police investigation, or legal proceedings. We occasionally give bonded mailing houses access to database information solely to print mailing labels for our own direct-mail and promotional purposes; in those cases, the mailing house is strictly bound by these same terms.
Who receives your data in MyAccount:
Google: when you sign in with Google, Google gives us your Google identifier, name and email. Google is an independent controller of your Google account data under its own privacy policy.
Razorpay: for paid plans, checkout is handled by Razorpay, our only payment gateway. Through the GrapeCity Payment Service we pass Razorpay the amount, currency, and your name, phone and email. Razorpay acts as our processor for checkout, and as an independent controller for its own regulatory records (KYC, RBI and fraud prevention). Free plans involve no payment, so no data goes to Razorpay.
GrapeCity services: the GrapeCity Subscription API (user ID, name, email, plan and subscription dates), the GrapeCity Payment Service (user ID, name, phone, email and payment amount) and the kenzoAI Developer Portal (internal user ID, plan details and dates, but no contact details). GrapeCity operates all three.
Analytics providers: if you choose analytics, Google Analytics and PostHog process analytics data for us, as described in Section 5.3.
Single sign-on apps: DevPortal, DOJO and the Marketing Portal receive the user information returned when you sign in with your GrapeHub account. They use it only for sign-in, unless you separately consent.
If you use kenzoAI, information you submit with a request is shared with our AI Providers (currently Microsoft Azure and AWS Bedrock) to generate the response. Based on each provider's current published terms, this content is not used to train their models and is not shared with unrelated third parties, apart from a limited, sometimes human-reviewed, abuse-detection process each provider runs to enforce its own acceptable-use policy. Separately, GrapeCity maintains internal request-response logs containing request content and AI Output, and stores prompts and AI Output in session records and database backups. See the kenzoAI Data Policy for details of this processing and your choices. Retention practices of AI Providers vary by provider and model; see the kenzoAI Data Policy for current detail. This disclosure is separate from the third-party sharing described above and does not involve leasing, selling, or renting your information.
If GrapeCity sells or transfers a material portion of its business or assets, your name, address, email address, member name, and other personal information may be transferred as part of that transaction.
10. Children'S Privacy
BuildNinja and kenzoAI are business and developer tools, not directed at or designed for use by children. This website and our products are not intended for use by anyone under 18, and we do not knowingly collect Personal Information from anyone under that age. If we learn that we have collected information from someone under 18, we will promptly delete it.
11. Collection of Sensitive Information
Our services are not intended to collect Sensitive Information such as medical, health, racial, ethnic, political, religious, philosophical, union membership, or sexual orientation information. You must not submit Sensitive Information to kenzoAI or Dojo. kenzoAI is intended for build information, logs, source-code or configuration diffs, and configuration data. Information inadvertently included in a request may be processed with that request and included in internal request-response logs, session records and backups, as described in the kenzoAI Data Policy. To report an inadvertent submission or request erasure, contact our Data Protection Officer at dpo.india@grapecity.com.
12. Consent
By using this website, you acknowledge this Online Privacy Policy. GrapeCity processes your Personal Information as described above, on the lawful bases in Section 3. If this policy changes, we will bring the changes to your attention by posting them prominently on our website for a reasonable period.
GrapeCity is not responsible for the privacy or security practices of our customers, which may differ from those described in this policy.
13. Retention
Short-link records (which store your email address) and user authorization records are deleted after 15 days.
kenzoAI Developer Portal records (internal user ID and plan details) are removed after the plan has ended, as per the plan's audit-log duration, and erasure is scheduled for 30 days after we receive your erasure request.
Invoice, tax ID, address, order and payment records are kept for 8 years, as required by tax and accounting law.
If you choose analytics, PostHog session replay recordings are kept for 30 days and PostHog event records for 1 year. Google Analytics records are kept for 14 months.
Manage your choices.
Necessary cookies stay on. You can allow or withdraw Analytics at any time.
