Data processing terms

Effective 25 September 2026

These terms apply when you use graspy for your business and store personal data about other people in your workspace, for example the SWAPD usernames of buyers and sellers, messages, prices and notes. For that data you are the controller and Graspy is your processor (GDPR art. 28). They form part of the Terms of service.

1. Subject and duration

We process this data only to provide graspy to you, for as long as your account exists.

2. Data and people

Types of data: usernames, ticket details, prices, statuses, dates, notes and message titles you enter or import. People concerned: your counterparties and contacts on SWAPD.

3. Our commitments

• We process the data only on your documented instructions, which are these terms and your use of graspy.
• Everyone with access is bound to confidentiality. Access is limited to what is needed to run and secure the service.
• Security: encryption in transit (HTTPS) and at rest (AES-256-GCM on top of the provider's encryption), password-free sign-in, access logging, rate limits and a strict separation of the single admin role.
• Sub-processors: Cloudflare (hosting and database), Resend (email delivery) and Google (our support mailbox, only for emails you send us). We tell you by email at least 14 days before adding or replacing one, and you may object by ending your account.
• We help you answer requests from the people concerned, and with security, breach notification and impact assessments where needed.
• We notify you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data.
• When your account ends we delete the data; backups expire within 30 days. You can export it yourself first.
• We make available the information needed to show compliance with these terms, and allow reasonable audits with 30 days' notice, at your cost.
• Transfers outside the EU are covered by the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

4. Your commitments

You make sure you have a lawful basis to store the data in graspy and that you inform the people concerned where the law requires it.

Contact: support@graspy.app