Your Privacy Choices

Introduction

Welcome to Grid&Glow LLC's Privacy Policy. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website gridandglow.com and purchase our products or services.

Grid&Glow LLC specializes in creating and selling premium PSD mockups, 3D models, digital design assets, and providing custom mockup design services. We take your privacy seriously and are transparent about our data practices.

Important: By using our website and services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our services.

Owner and Data Controller

Legal Entity: Grid&Glow LLC
Business Address: Portland, Oregon, United States
Contact Email: hello@gridandglow.com
Website: https://gridandglow.com

Grid&Glow LLC is the data controller responsible for your personal information. If you have any questions or concerns about this Privacy Policy or our data practices, please contact us using the information above.

Information We Collect

We collect several types of information from and about users of our website and services:

Personal Information You Provide

Account Information: Name, email address, billing address, and phone number when you create an account
Payment Information: Credit card details, billing information (processed securely through third-party payment processors)
Order Information: Details about products purchased, custom project specifications, order history
Communication Data: Messages you send us, customer support inquiries, feedback, and reviews
Custom Project Details: Design requirements, project briefs, uploaded files, and specifications for custom mockup services

Information Collected Automatically

Usage Data: IP address, browser type and version, time zone setting, browser plug-in types, operating system and platform
Device Information: Hardware model, unique device identifiers, mobile network information
Analytics Data: Pages visited, time spent on pages, click-through rates, download activity, search queries
Cookies and Tracking: Data collected through cookies, web beacons, and similar technologies

Information from Third Parties

Payment processors (Stripe, PayPal, Shop Pay) regarding transaction completion
Analytics providers (Google Analytics) for website usage patterns
Marketing platforms for email campaign analytics

How We Use Your Information

We use the information we collect for the following purposes:

Service Delivery

Processing and fulfilling your orders for digital products and custom services
Providing access to purchased mockups, templates, and digital assets
Managing custom mockup projects and communicating project requirements
Sending order confirmations, download links, and delivery notifications
Providing customer support and responding to your inquiries

Business Operations

Processing payments and preventing fraudulent transactions
Maintaining and improving our website functionality and user experience
Analyzing usage patterns to enhance our product offerings
Conducting quality assurance and testing
Complying with legal obligations and resolving disputes

Marketing and Communications

Sending promotional emails about new products, special offers, and updates (with your consent)
Personalizing your shopping experience based on browsing and purchase history
Displaying targeted advertisements on third-party platforms
Conducting surveys and gathering feedback to improve our services

Note: You can opt out of marketing communications at any time by clicking the "unsubscribe" link in our emails or by contacting us directly.

Data Sharing and Third Parties

We do not sell your personal information. We share your information only in the following circumstances:

Service Providers

We work with trusted third-party service providers who assist us in operating our business:

Shopify Inc. (Canada) - E-commerce platform and hosting
Fly.io (United States, servers in Frankfurt, Germany) - application hosting and database
Backblaze, Inc. (United States) - storage for uploaded and generated files
Resend (United States) - transactional email, such as receipts and account notices
Stripe, Inc. (United States) - Payment processing
PayPal Inc. (United States) - Payment processing
Google LLC (United States) - Analytics, advertising, and email services
Mailchimp (Intuit Inc.) (United States) - Email marketing
Cloudflare, Inc. (United States) - Content delivery and security
Meta Platforms, Inc. (United States) - Advertising and analytics

Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities, including to meet national security or law enforcement requirements.

Business Transfers

If Grid&Glow LLC is involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

With Your Consent

We may share your information for any other purpose with your explicit consent.

Memberships and GridPack Studio

Paid memberships and GridPack Studio involve data we do not handle anywhere else on the site: a recurring payment relationship, a record of what you agreed to, and the design work you save. This section sets out what that means for your personal data. Everything in the rest of this policy applies to it as well.

What We Hold for a Membership

Membership record

Which tier you hold, the billing period, the status of the membership, and the date the current period ends. Held for as long as the membership exists and afterwards as part of your account history.

Consent record

The exact wording shown to you when you agreed to automatic renewal, the amount and billing period you agreed to, the date and time, your IP address and browser user-agent. Kept for 3 years after the membership ends, because US auto-renewal law requires a business to be able to show what the customer was told, and that record cannot be reconstructed later.

Billing events

Payments, failed payments, tier changes, cancellations and refunds, as a dated history. Retained for 7 years with other transaction records, for tax and accounting.

Usage counts

How many exports or other metered actions you have used in the current period, so entitlements can be applied. Not linked to the content of your designs.

Card details go to Stripe, not to us

Grid&Glow does not receive or store your payment card information. Card numbers, expiry dates and security codes are entered on a payment form hosted by Stripe and are processed by Stripe.

We do keep information associated with your payment: the brand and last four digits of the card as Stripe reports them, the billing country, whether each payment succeeded or failed, and the identifiers Stripe uses for your customer and subscription records.

Stripe as Our Payment Processor

Memberships are billed through Stripe, Inc. (United States), acting as an independent controller for its own fraud-prevention and legal-compliance purposes and as our processor for taking the payment. When you start or change a membership, the following reaches Stripe:

your email address and name;
your billing address and country, where Stripe or tax rules require it;
the tier, amount and billing period;
an identifier linking the payment back to your account on our side;
the card details you enter, which are collected by Stripe's own payment form rather than by us.

Stripe is certified under the Payment Card Industry Data Security Standard as a Level 1 Service Provider. Its own handling of your data is governed by Stripe's privacy policy, which we encourage you to read at stripe.com/privacy.

Legal basis (EU/UK): performance of a contract for the payment itself, and our legitimate interest in preventing fraud and keeping accurate financial records.

GridPack Studio

When you use the Studio, we hold:

Saved projects: the dimensions, box style, material and other parameters you set, stored so you can return to them.
Artwork you upload: images you place on a design. Stored with the project. We do not inspect, index or analyse the content of uploaded artwork, and we do not use it to train anything.
Export records: what was exported and when, so entitlements and licences can be applied.

Your designs and artwork are yours. We do not use them for marketing, we do not show them to other users, and we do not share them with anyone except the infrastructure providers listed in this policy who store them on our behalf.

How long: saved projects stay while your account exists. Where an account has had no active membership for a prolonged period, we may delete saved projects after giving you at least 30 days' notice by email, as set out in our Terms. You can export or delete a project yourself at any time.

Where: the Studio runs on infrastructure operated for us in the European Union, and project files are stored with our file-storage provider. Both are listed under Data Sharing above.

Emails You Receive About a Membership

Some emails are part of the service rather than marketing, and you cannot opt out of them while you hold a membership, because they tell you about money leaving your account:

receipts and invoices for each payment;
notice before a price change takes effect;
warnings that a payment has failed and the card needs updating;
confirmation of a cancellation, a tier change, or a refund;
notice of a material change to what your tier includes, or of the service closing.

Marketing email is separate and you can unsubscribe from it at any time without affecting your membership.

If You Cancel or Ask Us to Delete Your Data

Cancelling a membership does not delete your personal data, and we do not delete it automatically, because an account and its purchase history usually outlive a membership.

If you ask us to erase your data, we will, with two exceptions we are required to keep:

transaction records, for 7 years, for tax and accounting;
the consent record for automatic renewal, for 3 years after the membership ends, as described above.

Those are kept minimised: what was agreed, when, for how much. Everything else connected to the account is removed. Write to hello@gridandglow.com to make a request.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our website and store certain information. Cookies are small data files stored on your device.

Types of Cookies We Use

Essential Cookies: Necessary for website operation, shopping cart functionality, and checkout process
Analytics Cookies: Help us understand how visitors interact with our website (Google Analytics)
Marketing Cookies: Track your browsing activity to display relevant advertisements
Preference Cookies: Remember your settings and preferences for future visits

Managing Cookies

You can control and manage cookies through your browser settings. Please note that disabling cookies may affect the functionality of our website and your ability to use certain features.

How to Opt Out

Browser Settings: Most browsers allow you to refuse cookies or delete existing cookies
Google Analytics: Google Analytics Opt-out Browser Add-on
Interest-Based Advertising: Digital Advertising Alliance Opt-Out

Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

Universal Rights

Right to Access: Request a copy of the personal information we hold about you
Right to Correction: Request that we correct any inaccurate or incomplete information
Right to Deletion: Request that we delete your personal information (subject to legal obligations)
Right to Data Portability: Receive your data in a structured, commonly used format
Right to Withdraw Consent: Withdraw your consent for marketing communications at any time
Right to Object: Object to processing of your personal information for certain purposes

How to Exercise Your Rights

To exercise any of these rights, please contact us at hello@gridandglow.com. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

Information for EU Users (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

Legal Basis for Processing

We process your personal data based on the following legal grounds:

Contract Performance: To fulfill our contractual obligations when you purchase products or services
Consent: When you have given explicit consent for marketing communications
Legitimate Interests: For business operations, fraud prevention, and service improvement
Legal Obligation: To comply with applicable laws and regulations

Data Retention

We keep personal data only for as long as we need it for the purpose it was collected for, or for as long as the law requires. In practice:

Account data - while the account exists, and for 12 months afterwards in case it is reopened.
Transaction and billing records - 7 years, for tax and accounting.
Auto-renewal consent records - 3 years after the membership ends, as US auto-renewal law requires.
Saved projects and uploaded artwork - while the account exists; see Memberships and GridPack Studio above.
Support correspondence - 3 years from the last message in the thread.
Analytics and server logs - 26 months for analytics, 90 days for server logs.

Where we are required to keep something after you ask us to erase your data, we keep the minimum: what was agreed, when, and for how much.

International Data Transfers

Your information may be transferred to and processed in countries outside the EU/EEA, including the United States. Most of the providers listed under Data Sharing are US-based, Stripe among them.

For those transfers we rely on the Standard Contractual Clauses approved by the European Commission, incorporated into our agreements with each provider, and on the UK Addendum where UK data is involved. Where a provider is certified under the EU-US Data Privacy Framework, we also rely on that certification. You can ask us for a copy of the safeguards that apply to a particular transfer by writing to hello@gridandglow.com.

Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority if you believe we have violated your privacy rights.

Information for US Users

If you are a resident of certain U.S. states (California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, and Montana), you have specific privacy rights under state laws.

California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the following rights:

Right to Know: Request disclosure of categories and specific pieces of personal information collected
Right to Delete: Request deletion of your personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: Opt out of sale or sharing of personal information
Right to Limit Sensitive Information: Limit use of sensitive personal information
Right to Non-Discrimination: Not be discriminated against for exercising your rights

Categories of Personal Information We Collect

Identifiers (name, email, IP address)
Commercial information (purchase history, browsing activity)
Internet activity (website interactions, device information)
Financial information (payment details - processed by third parties)

Sale and Sharing of Personal Information

We do not sell your personal information. We may share information with advertising partners for targeted advertising purposes, which may be considered "sharing" under CCPA. You can opt out by contacting us.

Other US State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, and Montana have similar rights to access, correct, delete, and opt out of targeted advertising and sale of personal information.

Exercising Your US State Rights

To exercise your rights, please email us at hello@gridandglow.com with "Privacy Rights Request" in the subject line. We will verify your identity and respond within the timeframe required by applicable law (typically 45 days).

Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

Security Measures Include:

SSL/TLS encryption for data transmission
Secure payment processing through PCI-DSS compliant providers
Regular security audits and vulnerability assessments
Access controls and authentication requirements for our systems
Employee training on data protection and privacy
Regular data backups and disaster recovery procedures

Important: While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you transmit information at your own risk.

Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately, and we will take steps to delete such information from our systems.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

Posting the updated Privacy Policy on this page with a new "Last Updated" date
Sending an email notification to registered users (for significant changes)
Displaying a prominent notice on our website

We encourage you to review this Privacy Policy periodically. Your continued use of our services after changes are posted constitutes your acceptance of the updated Privacy Policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Grid&Glow LLC
Portland, Oregon, United States
Email: hello@gridandglow.com
Website: https://gridandglow.com

We aim to respond to all legitimate requests within 30 days. Occasionally, it may take us longer if your request is particularly complex or you have made multiple requests. In this case, we will notify you and keep you updated.

Privacy Policy