Privacy Policy

Last Updated: October 15, 2026

GRAT AI, LLC, a Delaware limited liability company operating from California (“GRAT,” “we,” “us,” or “our”), provides a cloud-based HR automation and workforce compliance platform at mygrat.ai (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard information when businesses (“Employers”) and their workforce members (“Employees”) access or use the Service.

INCORPORATION OF TERMS OF SERVICE: This Privacy Policy is incorporated into and subject to our Terms of Service, including all limitations of liability, indemnification obligations, AI disclaimers, and the Mandatory Binding Arbitration and Class Action Waiver set forth therein. By accessing or using the Service, you agree to this Privacy Policy and our Terms of Service.

1. Our Role: Service Provider / Data Processor for Employee Data

Understanding the legal relationship between GRAT, Employers, and Employees is critical:

• Employer Account Data (GRAT as Business / Controller): When a business owner, administrator, or manager registers an organization on GRAT, visits our website, or interacts with our sales and billing systems, GRAT acts as the "Business" or "Data Controller" for that account holder's business contact and billing information.
• Workforce & Employee Data (GRAT as Service Provider / Data Processor): When an Employer uploads, syncs, or collects Employee information (such as names, mobile phone numbers, email addresses, locations, roles, tax forms, certifications, warning letters, or digital signatures), the Employer is the sole "Business" / "Data Controller," and GRAT acts strictly as a "Service Provider" / "Data Processor" processing such data on the Employer's instructions.
• Employer Responsibility for Employee Notices & Consent: The Employer is solely and exclusively responsible for providing all legally required privacy notices to its Employees (including under the California Consumer Privacy Act (CCPA/CPRA)) and obtaining all required prior express consents (including under the Telephone Consumer Protection Act (TCPA)) before submitting Employee personal data or mobile numbers to GRAT. GRAT assumes zero liability for an Employer's failure to obtain proper Employee consent or provide required workplace privacy disclosures.

2. Information We Collect

Depending on how you interact with the Service, we collect the following categories of information:

• Employer & Location Information: Business names (DBA and Legal Business Name), Employer Identification Numbers (EIN), physical location addresses, industries, states of operation, administrator/manager contact details, and subscription/payment method tokens (processed via Stripe).
• Employee Workforce Information (Uploaded by Employers or Submitted by Employees): Full name, mobile phone number, email address, assigned location(s), department, role, classification, preferred language, uploaded credentials/certificates (e.g., Food Handler cards, IDs), completed onboarding or tax forms, disciplinary acknowledgments, training quiz scores, electronic signatures, and audit timestamps.
• SMS & Copilot Interaction Logs: Two-way SMS/MMS text messages, email delivery logs, and queries submitted to our AI assistants ("Ask AI" and SMS Employee Copilot).
• Technical & Usage Telemetry: IP addresses (used in part to generate tamper-evident Compliance Audit Receipts), browser type, device identifiers, operating system, session logs, cookies, and interaction metrics.

3. How We Collect Information

• Directly from Employers & Administrators: When you create an account, add locations, upload CSV rosters, create policies, or assign compliance tracks.
• Directly from Employees: When Employees click secure SMS/email links, complete forms, upload requested documents, sign acknowledgments, or reply to GRAT SMS messages.
• From Third-Party Integrations & Partners: When an Employer connects a POS, payroll, or HRIS integration (e.g., Square, Gusto, QuickBooks, Rippling) or assigns third-party Marketplace training (e.g., Simple Learning), we exchange roster and completion metadata via secure APIs.
• Automatically via Cookies & Telemetry: As users navigate the Service.

4. How We Use Information

We use collected information to:

• Provide, operate, maintain, and secure the Service across Employer and Employee portals;
• Deliver automated 2-way SMS and email onboarding links, task reminders, nudges, and verification codes;
• Generate timestamped Compliance Audit Receipts and track completion readiness for Employers;
• Process subscription billing, metered active-user fees, and Marketplace training transactions;
• Detect, investigate, and prevent platform abuse, fraud, security breaches, or violations of our Terms of Service (including exercising our right to suspend or cancel abusive accounts);
• Send administrative notices, product updates, and (where permitted) promotional communications; and
• Power our AI Features and improve the Service as detailed in Section 5 below.

5. Artificial Intelligence (AI) Processing, Anonymization & Third-Party Subprocessors

• Third-Party AI Providers: To provide AI-drafted policies, automated translations, document parsing, and interactive "Ask AI" / SMS copilot features, the Service transmits relevant prompts and document context over encrypted channels to enterprise third-party AI API providers (such as Google Gemini, OpenAI, or Anthropic). Under our enterprise API configurations, these third-party providers are contractually prohibited from using your proprietary business data or Employee PII to train their public foundational models.
• Anonymized Organizational Templates & RAG Improvement: As set forth in our Terms of Service, GRAT may anonymize and aggregate Employer-uploaded organizational templates, policies, and system telemetry (strictly after stripping all Personally Identifiable Information (PII) and company-specific identifiers) to improve our internal Retrieval-Augmented Generation (RAG) knowledge base and platform features.
• Strict Exclusion of Employee Submissions: Under no circumstances does GRAT use Employee-submitted forms (such as W-4s, I-9s, or direct deposit forms), personal identification documents, medical records, disciplinary responses, or Employee signatures to train generalized AI models.
• AI Accuracy Disclaimer: AI outputs and automated translations are generated probabilistically and may contain errors or omissions. Employers are solely responsible for human review and verification of all AI outputs before use.

6. SMS / Mobile Messaging Privacy & Carrier Compliance

No Sale or Sharing of Mobile Opt-In Data: We value your privacy and the privacy of your workforce. No mobile information, phone numbers, or SMS opt-in consent data will ever be sold, rented, or shared with any third parties or affiliates for third-party marketing or promotional purposes.

Mobile phone numbers provided to GRAT are used strictly to deliver work-related compliance tasks, onboarding links, two-way HR copilot responses, and account notifications on behalf of the Employer (or administrative alerts to the Employer) via our telecommunications providers (such as AWS End User Messaging / SNS or Twilio). Recipients may reply “STOP” at any time to opt out of SMS messages or “HELP” for assistance.

7. Disclosure of Information

We do not sell Personal Information. We disclose information only in the following circumstances:

• Within the Employer's Organization: Employee task statuses, uploaded documents, and audit receipts are visible to the Employer's authorized Account Owner, Account Admins, and scoped Location Managers.
• Infrastructure & Subprocessors: To vetted cloud hosting, database, payment, email/SMS delivery, and AI infrastructure providers (e.g., Amazon Web Services, Vercel, Stripe, Simple Learning) bound by confidentiality and security obligations.
• Legal Obligations & Protection of GRAT: When we believe in good faith that disclosure is necessary to comply with a subpoena, court order, regulatory inquiry, or legal process, or to enforce our Terms of Service, collect unpaid fees, or protect the rights, property, safety, and legal defense of GRAT AI, LLC, our founders, our users, or the public.
• Corporate Transactions: To a buyer, investor, acquirer, or successor entity in connection with any merger, acquisition, financing, reorganization, or sale of some or all of GRAT AI, LLC’s assets.

8. Data Security & Risk Acknowledgment

We implement industry-standard administrative, technical, and physical safeguards—including encryption in transit (TLS 1.2+) and encryption at rest (AES-256)—designed to protect data stored on our platform. However, no internet transmission, cloud storage system, or SMS network is 100% impenetrable. You acknowledge and agree that you provide data at your own risk, that you are responsible for maintaining the confidentiality of your login credentials, and that GRAT AI, LLC shall not be liable for any unauthorized access, credential compromise, carrier interception, or security incident beyond our reasonable control, subject always to the absolute liability caps in our Terms of Service.

9. Data Retention & Standby Read-Only Archive

We retain information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. If an Employer’s subscription expires or is canceled, the account enters Standby Mode (locking active write operations while preserving read-only access to historical records at GRAT's discretion, unless the account is terminated for abuse or the Employer requests permanent deletion). Employers remain solely responsible for downloading and retaining copies of their compliance records.

10. State Privacy Rights (California CCPA/CPRA & Other States)

Residents of California and certain other U.S. states have statutory rights regarding their personal information, including the right to know, access, correct, or request deletion of personal information, and the right not to be discriminated against for exercising such rights. GRAT does not "sell" or "share" personal information for cross-context behavioral advertising as defined under the CCPA/CPRA.

• Requests by Employees: Because GRAT processes Employee workforce records strictly as a Service Provider on behalf of your Employer, if you are an Employee seeking to access, correct, or delete employment or compliance records managed by your Employer, please direct your request to your Employer directly. We will assist Employers in fulfilling verified requests in accordance with applicable law.
• Requests by Employer Account Holders: Account Owners may manage or request deletion of their account data via platform settings or by contacting privacy@mygrat.ai.

11. Children’s Privacy

The Service is a business-to-business workforce platform not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16.

12. Changes, Controlling Language & Contact Information

We reserve the right to update this Privacy Policy at any time by posting the revised version on this page. Your continued use of the Service after any update constitutes acceptance of the revised Privacy Policy. Controlling Language: This Privacy Policy is drafted in the English language. Any translation into Spanish or any other language is provided strictly for convenience; in the event of any conflict or ambiguity, the English version shall govern and control in all respects.

For privacy inquiries, please contact GRAT AI, LLC at privacy@mygrat.ai or legal@mygrat.ai.