Overview

GRAL ("we", "us", "our") operates gral.tech and enterprise platforms including Cognity, Sentara, Emittra, and Blackchannel AI. This privacy policy describes how we collect, use, store, and protect personal data when you interact with our website and services.

By using our website, you acknowledge that you have read and understood this policy. If you have questions, contact us at privacy@gral.tech.

Information We Collect

We collect the following categories of information:

  • Website analytics — Page views, device type, browser information, referrer URL, and general geographic location. This data is collected in aggregate and is not used to identify individual users.
  • Contact form submissions — Name, email address, company name, and message content submitted through our website contact forms.
  • Platform usage data — For enterprise clients using our platforms, usage data is collected as necessary to operate and improve the service. This data is governed by separate enterprise agreements and data processing addendums.

How We Use Your Information

We use collected information for the following purposes:

  • Respond to inquiries and contact form submissions
  • Improve the functionality, performance, and content of our website and services
  • Communicate about our platforms and services, only with your explicit consent
  • Fulfill contractual obligations to enterprise clients
  • Comply with legal requirements and enforce our terms of service

Data Storage & Security

We take the security of your data seriously and implement appropriate technical and organizational measures:

  • Website data is processed within the European Union.
  • Enterprise platform data is stored according to client-specific deployment configurations, including on-premise, private cloud, or hybrid environments.
  • All data is protected with industry-standard encryption both in transit (TLS 1.2+) and at rest (AES-256).
  • Our infrastructure is SOC 2 Type II, GDPR, and ISO 27001 compliant.

Third-Party Services

We use analytics tools to understand website traffic patterns and improve user experience. We select providers that offer adequate data protection and processing within the EU where possible.

We do not sell, rent, or trade personal data to third parties under any circumstances.

Enterprise platform integrations with third-party services are governed by separate data processing agreements negotiated with each client.

Cookies

Our website uses cookies in the following categories:

  • Essential cookies — Required for core website functionality, such as navigation and security. These cannot be disabled.
  • Analytics cookies — Used to understand how visitors interact with our website. These are only placed with your explicit consent.

We do not use advertising or tracking cookies. We do not participate in cross-site tracking or retargeting programs.

Your Rights

Under the General Data Protection Regulation (GDPR) and applicable data protection legislation, you have the following rights regarding your personal data:

  • Right of access — Request a copy of the personal data we hold about you.
  • Right to rectification — Request correction of inaccurate or incomplete data.
  • Right to erasure — Request deletion of your personal data where there is no compelling reason for its continued processing.
  • Right to data portability — Request transfer of your data to another controller in a structured, machine-readable format.
  • Right to restriction of processing — Request limitation of how we process your data in certain circumstances.
  • Right to object — Object to processing of your personal data where we rely on legitimate interests as the legal basis.

To exercise any of these rights, contact privacy@gral.tech. We will respond to your request within 30 days.

Data Retention

  • Contact form data is retained for a maximum of 24 months from the date of submission, after which it is permanently deleted.
  • Enterprise data is retained according to the terms specified in each client's contractual agreement.
  • Website analytics data is anonymized after 14 months and cannot be linked to individual users.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Contact

For questions, concerns, or requests related to this privacy policy or your personal data, contact us at:

privacy@gral.tech
GRAL
Italy