Privacy Policy

Last updated 2 min read
Report issue

Privacy Policy#

Effective date: 2026-05-14 Last updated: 2026-05-14

This is a baseline template that reflects the current state of GritivaCore. It is not legal advice. Have it reviewed by a qualified lawyer before publishing as your final policy.

1. Who we are#

GritivaCore ("we", "us", "our") is a self-hosted infrastructure management platform. The operator of this software (you, the customer) is the data controller for everything that flows through the system.

2. What we collect#

When you use the GritivaCore Cloud (panel.gritiva.com) we collect:

  • Account data — email address, name (if provided), hashed password, role assignments
  • Telemetry — VM heartbeats, agent versions, scope counts, mesh peer counts (no payload data)
  • Usage logs — API request paths, status codes, request IDs, IP addresses (kept 30 days)
  • Billing data — only when you opt into a paid plan; processed by our payment provider, never stored on our servers

When you self-host GritivaCore, none of the above leaves your infrastructure unless you explicitly opt in.

3. What we do NOT collect#

  • Application payloads (the contents of databases, files, or messages handled by your scopes)
  • Mesh traffic (gmesh is end-to-end WireGuard between your VMs; we cannot read it)
  • The OpenAI/LLM prompts your docs system sends (those go directly from your gritiva-docs-backend to the LLM provider you configured)

4. Where data lives#

Account + telemetry + usage logs are stored in our managed PostgreSQL on EU-Central (Frankfurt). Backups retained 30 days, encrypted at rest with AES-256.

5. Who we share with#

  • Sub-processors (current list, also at https://gritiva.com/legal/subprocessors):
    • Cloudflare (DNS + tunnel + WAF)
    • The cloud provider hosting our managed plane (Hetzner)
    • Our payment processor (Stripe, when applicable)
  • Law enforcement — only with a valid legal request, and we will notify you unless prohibited by law

6. Your rights (GDPR / CCPA)#

You can request: a copy of your data, correction of inaccurate data, deletion, or export. Email [email protected]. We respond within 30 days.

7. Cookies#

The marketing site uses essential cookies (session) and one analytics cookie (Plausible — privacy-respecting, no fingerprinting). The application surfaces (panel.gritiva.com, docs.gritiva.com) use only an auth_token cookie for authenticated sessions.

8. Security#

  • Transport: TLS 1.3 only
  • At rest: AES-256
  • Auth: bcrypt for passwords, JWT for sessions (60-min TTL)
  • All credentials in .env files on the server, never in source control
  • Reported via [email protected] (PGP available)

9. Children#

GritivaCore is a B2B infrastructure tool. We do not knowingly collect data from anyone under 18.

10. Changes#

We will email account owners 30 days before any material change. The current revision is always at https://docs.gritiva.com/docs/privacy-policy.

Contact#