Privacy Policy
Version 2026-10
This Privacy Policy explains how GridEstate handles personal data in connection with ServiceLog and our websites. It covers data we are responsible for ourselves and explains our role for the data contractors store about their own customers.
1. Who is responsible
- For account data — the people who sign up for ServiceLog, users of contractor accounts and visitors to our website — GridEstate is the controller: [legal entity name], registry code [registry code], [registered address], Estonia, hello@gridestate.com.
- For data that a contractor stores in ServiceLog about its own customers (their contact people, sites and service records), the contractor is the controller and GridEstate is its processor. If you are a contractor’s customer, please contact that contractor about your data; we help them answer your request.
2. Data we collect as controller
- Account data: name, email address, company name, password (stored only as a one-way hash), language and your role in the account.
- Terms acceptance: which version of the Terms you accepted and when.
- How you found us: campaign parameters (such as utm_source), referral code, the first page you visited and the referring website, if you sign up.
- Usage and security data: IP address, browser, sign-in times, and actions performed in the service.
- Communication: messages you send us and our replies.
- Billing data: company details, invoices and payment status.
3. Why we use it and on what legal basis
- To provide the service and your account, including verification and password-reset emails — performance of a contract (GDPR Art. 6(1)(b)).
- To keep the service secure and prevent abuse — our legitimate interest (Art. 6(1)(f)).
- To understand which channels bring us customers — our legitimate interest (Art. 6(1)(f)).
- To send invoices and keep accounting records — legal obligation (Art. 6(1)(c)).
- To tell account owners about important product changes — our legitimate interest; you can opt out of non-essential messages at any time.
4. Cookies and browser storage
We use only what the service needs:
- a sign-in session cookie and browser storage that keep you signed in and remember your active account;
- a cookie that remembers your language choice;
- a first-party cookie that remembers how you first found us (campaign parameters, referring website and landing page) for up to 90 days. It is sent to us only if you create an account.
We use PostHog, hosted in the EU, to understand how the service is used and to find errors. We do not use advertising cookies or track you across other websites.
5. Your customers’ data (our role as processor)
Contractors store in ServiceLog the names, email addresses, phone numbers and roles of their customers’ contact people, the addresses of the sites they service, visit records, acts, photos and other documents, and logs of page visits and emails sent. We process this data only on the contractor’s instructions and under our Data Processing Agreement. The contractor’s own privacy notice applies to it.
6. Who we share data with
We use these service providers (sub-processors):
- MongoDB Atlas — database hosting in the EU;
- Cloudflare — application hosting, file storage, content delivery, DNS and network security;
- Resend — sending service emails;
- PostHog — product analytics and error tracking, EU region;
- Sentry — error monitoring.
We may also disclose data to our accountants and legal advisers under confidentiality, and to authorities where the law requires it. We do not sell personal data.
7. Where data is stored
We store data in the European Union. Some of our providers are based in the United States. Where personal data may be accessed from outside the European Economic Area, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses.
8. How long we keep it
- Account data: while the account is active and for [12 months] after it is closed.
- Invoices and accounting records: 7 years, as required by the Estonian Accounting Act.
- Security and error logs: up to [90 days].
- Email confirmation and password-reset links: they expire after 3 days and 1 hour respectively.
- Customer Data stored by contractors: as described in the Data Processing Agreement.
9. Security
Data is encrypted in transit (TLS) and at rest by our hosting provider. Passwords are stored as one-way hashes. Sign-in, confirmation and reset links are single-use and expire. Each contractor’s data is kept separate from others’, access inside an account depends on the user’s role, and only a small number of authorised people at GridEstate can access production systems. We keep regular backups.
10. Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. To use these rights, write to hello@gridestate.com. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority where you live.
11. Changes
We will update this policy when our processing changes. The version label at the top shows which version is current; we will tell account owners about material changes by email.