Grounds

Legal

Privacy Policy

Last updated August 5, 2026. Plain text, Word

This Privacy Policy describes how Owndevice, Inc. ("Grounds") collects, uses, and shares personal information in connection with the grounds.ai website and the Grounds for Law, Grounds for Business, and Grounds Personal services (collectively, the "Service").

1. Information we collect

Account information

Name, email address, organization, and authentication identifiers from our identity provider (Clerk). We do not collect or store passwords directly.

Customer Data

Documents, redlines, comments, playbooks, and other content you submit to the Service. Customer Data may include personal information about your counterparties, your clients, and other third parties for whom you are the controller and we are the processor.

Usage and device information

Server logs (IP address, browser, OS) and basic usage records generated by operating the Service. We do not run third-party advertising trackers and we do not sell personal information.

Payment information

Billing is handled by Stripe. We receive metadata (subscription plan, last-four of card, billing address) but never receive raw card numbers.

2. How we use information

  • Provide, secure, and improve the Service.
  • Process Customer Data to generate AI suggestions, redlines, and analyses for you. AI inference happens on AWS Bedrock — see Section 4.
  • Bill paid plans and detect fraud.
  • Communicate with you about your account, service updates, and (only with your consent) product news.
  • Comply with legal obligations.

3. What we don't do

  • We do not use Customer Data to train foundation models — ours or anyone else's. Our inference partner contracts explicitly prohibit retention or training on the inputs we send.
  • We do not sell personal information.
  • We do not share Customer Data with third-party advertisers.
  • We do not embed third-party JavaScript on grounds.ai aside from the limited set of self-hosted analytics, fonts, and auth scripts described in Section 6.

4. AI processing and sub-processors

AI inference is performed by AWS Bedrock in the U.S. East region. Our Bedrock terms explicitly prohibit use of customer inputs for model training or for any purpose other than returning the inference result. Storage uses Supabase Postgres (RDS-class managed Postgres) in U.S. East. Email delivery uses AWS SES. The current sub-processor list is published on our Subprocessors page.

5. Retention

We retain Customer Data for as long as your account is active. On account termination, we delete production copies within 60 days, subject to a rolling backup expiration window of up to 35 days. Account metadata (e.g., billing records) is retained for the period required by tax and accounting law (typically 7 years).

6. Cookies and analytics

We use essential first-party cookies only: session cookies set by our authentication provider (Clerk) to keep you signed in. We do not set analytics or advertising cookies, we do not use third-party ad-tech cookies, and we do not track you across other sites.

7. Your rights

Depending on where you live, you may have the right to: access a copy of your personal information, correct it, delete it, restrict processing, port it, or object to processing. To exercise any of these rights, email privacy@grounds.ai. We respond within 30 days.

For Customer Data that we process on your behalf as a processor (most contract content), please direct requests through the customer (your organization). We will assist the customer in responding to data-subject requests as described in the DPA.

8. International transfers

We process data in the United States. For visitors in the EEA, UK, and Switzerland, we rely on Standard Contractual Clauses (and the UK Addendum) for international transfers.

9. Security

We use TLS for data in transit and AES-256 at rest. Access to production is restricted under least-privilege — today that means a single vetted engineer (the founder) — with logged access. See the Security Addendum for the full set of controls.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children.

11. Changes

We will post any material change to this policy here and email all active account holders at least 30 days before the change takes effect.

12. Contact

Questions or concerns? Email privacy@grounds.ai.