Privacy

Last updated October 14, 2026

Grainwork, Inc. (“Grainwork,” “we,” “us,” or “our”) provides software and related websites, communications, waitlists, beta programs, and product services for cabinet and millwork businesses. This Privacy Policy explains what information we collect, how we use it, how we share it, and the choices available to you.

Information we collect

We may collect information you provide directly, including:

name
email address
phone number
company or shop name
role or job title
location
waitlist, beta, demo, or early-access interest
comments, replies, questions, support requests, feedback, or other messages you send us
communication preferences, such as email, release note, marketing, or SMS preferences

If you use the Grainwork product, we may collect account, company, project, customer, room, cabinet, manufacturing, material, workflow, support, file attachment, AI-assistant, billing, subscription, and usage information that you or your organization enter into the service.

We also collect information automatically, such as device and browser information, IP address, pages viewed, referring pages, approximate location derived from IP address, interactions with our website or product, session and product usage events, logs, diagnostics, and similar technical information.

Waitlist and communications

If you join the waitlist, we collect your email address, signup source, and signup time so we can manage early access, send launch or product updates, and understand interest in Grainwork.

If you join the waitlist, create an account, request a demo, contact us, or opt in to product updates, we may send you emails related to Grainwork, including product progress, beta availability, release notes, launch timing, educational content, founder updates, and related information.

You can unsubscribe from marketing emails using the unsubscribe link in the email or by contacting us at compliance@grainwork.io.

SMS/text message communication

If you provide your phone number and consent to receive text messages from Grainwork, we may send SMS messages related to Grainwork updates, waitlist status, beta access, demo scheduling, product announcements, or direct responses to your inquiries.

Message frequency may vary. Message and data rates may apply. Consent to receive SMS messages is not a condition of purchase.

You can opt out of SMS messages at any time by replying STOP. For help, reply HELP or contact us at compliance@grainwork.io.

We do not sell, rent, or share mobile phone numbers or SMS opt-in consent information with third parties or affiliates for their own marketing or promotional purposes. We may share limited information with service providers who help us operate messaging, email, customer communication, analytics, security, hosting, or business systems. These providers may only use the information to provide services to Grainwork.

Cookies, analytics, and similar technologies

We use cookies and similar technologies for necessary site functions, authentication, preferences, security, analytics, and product improvement. Where required, non-essential analytics and tracking technologies are controlled through our cookie consent tool.

Our analytics and site-behavior tools may help us understand page views, traffic sources, clicks, scrolling, feature usage, performance, session activity, and product workflows. We use this information to improve Grainwork, debug issues, measure interest, protect our systems, and make the product easier to use.

You can control cookies through your browser settings and, where available, through the cookie settings link or consent banner on our website. Some website or product features may not work properly if cookies are disabled.

Advertising and campaign measurement

We may use advertising, retargeting, or campaign measurement technologies in the future to understand the effectiveness of our marketing and reach people who may be interested in Grainwork. If we use technologies that are considered targeted advertising, “sale,” or “sharing” under applicable privacy laws, we will provide any required consent controls or opt-out choices.

How we use information

We use information to:

provide, operate, secure, and improve Grainwork
manage accounts, companies, projects, subscriptions, waitlists, demos, and support requests
communicate with you about the product, your account, support, security, updates, and administrative matters
send marketing, release note, launch, and product communications where permitted
personalize or improve workflows, onboarding, and product experiences
analyze usage, troubleshoot issues, maintain logs, and improve performance
prevent abuse, fraud, security incidents, and unauthorized access
process payments, subscriptions, invoices, taxes, and related business records
comply with legal, tax, accounting, regulatory, and operational obligations
enforce our terms, agreements, and policies

AI features

Grainwork may include AI-assisted features that help generate, summarize, classify, answer, or assist with product workflows. Information you submit to AI features, together with related context needed to provide the feature, may be processed by service providers that help us provide those features.

You should not submit sensitive personal information, regulated data, or confidential third-party information to AI features unless your organization has permission to do so and the information is needed for the workflow.

If your organization allows it, you can connect an AI assistant you choose, such as Claude, ChatGPT, or Codex, to your Grainwork account. The assistant then reads information from your organization’s workspace as you, and that information is sent to the company that provides the assistant, which handles it under its own terms and privacy policy, not ours. We record which assistants are connected, who connected them, and when they were last used, so your organization’s administrators can see and disconnect them.

Improving Grainwork and aggregated insights

We study how Grainwork is used to decide what to build, forecast demand for new capabilities, find where the product is slow or confusing, and improve the defaults, suggestions, and starting points we offer. Some features suggest settings or values based on aggregated, de-identified patterns across many customers. These never expose or identify any individual customer's designs, standards, pricing, customers, or business information.

We do not sell, rent, or trade personal information or customer content, and we do not share it for advertising, ad targeting, or third-party marketing purposes.

How we share information

We do not sell personal information.

We may share information with service providers that help us operate Grainwork, including providers for hosting, database, storage, authentication, email delivery, SMS messaging, analytics, customer support, payment processing, security, infrastructure, AI processing, and business operations.

When you or another user in your organization connects an AI assistant, we send that assistant the information it asks for, as described under AI features.

We may also disclose information if we believe disclosure is reasonably necessary to comply with law or legal process, protect Grainwork or others, investigate abuse, fraud, security incidents, or technical issues, enforce our terms or agreements, or complete a business transaction such as a merger, acquisition, financing, reorganization, or asset sale.

Customer data

Grainwork is business software. When a customer organization enters information about its own users, customers, projects, jobs, files, or workflows into Grainwork, that organization is generally responsible for deciding what information is entered and how it is used. If your information was provided to Grainwork by a Grainwork customer, you may need to contact that organization directly to exercise privacy rights.

We process that information for the organization under our Data Processing Addendum.

Support access to your data

Grainwork staff may access a customer organization's workspace to investigate problems, respond to support requests, or repair the Service. That access is time-limited, recorded, shown in the workspace while it is active, and can be ended at any time by an administrator or owner of that organization. Staff access is used only to operate, secure, support, and repair the Service.

Support calls and recordings

When you take a voice or video call with Grainwork staff in the product, the call is carried by a video provider that processes the audio, video, and screen share needed to connect it. We keep a record of who was on the call and when.

Support calls may be recorded and transcribed. When a call is recorded, everyone on it is told before joining and sees that it is being recorded while it runs. A recording can include voices, camera video, what was shown on a shared screen, and a transcript and summary made from the audio by a service provider that processes AI features for us. Recordings are stored with a storage provider and are available to Grainwork staff only. We use them to support you, follow up on the call, and improve our support, and we delete a recording with its transcript and summary on request at compliance@grainwork.io.

Data retention

We keep personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the service, maintaining business records, resolving disputes, enforcing agreements, complying with legal obligations, and preserving security.

For example, we may keep waitlist information while Grainwork is managing early access, launch updates, or product availability unless you ask us to delete it and we are not required or permitted to retain it. We may keep certain account, billing, support, security, and operational records longer where needed for legitimate business, legal, tax, accounting, or security reasons.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No system is perfectly secure, and we cannot guarantee absolute security.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information about you. You may also have rights to opt out of certain marketing, targeted advertising, sale, sharing, or profiling activities. Country-specific information below explains the rights that apply in particular countries.

To make a privacy request, contact compliance@grainwork.io. We may need to verify your identity before completing certain requests.

You can unsubscribe from marketing emails using the unsubscribe link in those emails. You can opt out of SMS messages by replying STOP. You can manage non-essential cookie preferences through our cookie consent controls where available.

Children’s privacy

Grainwork is intended for businesses and professional users. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

International processing

Grainwork is based in the United States, and we store and process information there. Our service providers may also process it in other countries where they or their subcontractors operate. Those countries may have privacy laws that are different from, and less protective than, the laws where you live.

When we send personal information to another country, we protect it as this Privacy Policy describes and as the law that applies to you requires, including through contracts with our service providers. Country-specific information below adds details for particular countries.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time as Grainwork develops, as our website or product changes, or as legal requirements change. The updated version will be posted on this page with a new “Last updated” date.

Contact

Questions or requests about this Privacy Policy can be sent to:

Grainwork, Inc.
203 Wood St
Apt A
Loogootee, IN 47553
Email: compliance@grainwork.io

Service providers and subprocessors

We use third-party providers to host, operate, secure, and support Grainwork, including providers for cloud hosting, database and file storage, authentication, email and SMS delivery, video calls, payment processing, analytics, error monitoring, address lookup, and AI processing. A current list of these providers, and what each is used for, is available on request at compliance@grainwork.io.

These providers may process personal information only to provide services to Grainwork, and are bound by contractual confidentiality and security obligations. We do not sell personal information and we do not share mobile phone numbers or SMS opt-in consent with third parties for their own marketing.

Exporting and deleting your data

You can export information from Grainwork using the export features in the product. If your subscription ends, you will have thirty (30) days to export your data before we may delete it, subject to routine backup retention and to records we are required or permitted to keep. To request an export or deletion outside of the product, contact compliance@grainwork.io.

Reporting a security concern

If you believe you have found a security vulnerability or a data-handling problem in Grainwork, please report it to compliance@grainwork.io. We will acknowledge your report and work with you to understand and address it. Please do not publicly disclose an issue before we have had a reasonable opportunity to respond.

Country-specific information

If you are in one of the countries below, the information for that country also applies to you. We add countries to this section over time.

Australia

We handle personal information about people in Australia in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). The kinds of personal information we collect, how we collect and hold it, and why we use it are described above. This section adds what that law asks us to tell you.

Dealing with us anonymously. You can ask us general questions without giving your name, or by using a pseudonym. To create an account, use the product, or book a support call, we need your name and email address.

Access and correction. You can ask to see the personal information we hold about you, and ask us to correct it, by writing to compliance@grainwork.io. There is no charge to make a request. We will respond within 30 days. If we refuse, we will tell you why in writing and how to complain.

Sending information overseas. Grainwork is a United States company, so personal information we collect from you is sent to, stored in, and processed in the United States. Some of our service providers are based in, or use subcontractors in, the European Union and the United Kingdom. Before we disclose personal information to a recipient outside Australia, we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles, including through contracts with our service providers.

Data breaches. If a data breach involving your personal information is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Complaints. If you think we have breached the Australian Privacy Principles, write to us at compliance@grainwork.io and tell us what happened. We will acknowledge your complaint within 7 days and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

Canada

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to how we handle your personal information, along with any provincial private-sector privacy law that applies to you, such as those of Quebec, Alberta, and British Columbia. We collect, use, and disclose your personal information with your consent, for the purposes described above, except where the law allows otherwise. You can withdraw your consent at any time, subject to legal or contractual limits, but we may then be unable to provide some or all of the Service.

Privacy Officer. Our Privacy Officer is responsible for how we protect personal information and answers questions about it, including about our service providers outside Canada. You can reach our Privacy Officer at compliance@grainwork.io or at the mailing address under Contact above.

Access and correction. You can ask to see the personal information we hold about you, and ask us to correct it, by writing to our Privacy Officer. There is no charge to make a request. We will respond within 30 days. If you are in Quebec, you can also ask us to stop disseminating your personal information or to de-index it, and to give you the computerized personal information you provided in a structured, commonly used technological format.

Storage and processing outside Canada. Your personal information is stored and processed in the United States, and some of our service providers are based in, or use subcontractors in, the European Union and the United Kingdom. While it is outside Canada, it is subject to the laws of those countries and may be accessible to their courts, law enforcement, and national security authorities. Our contracts require our service providers to protect it and to use it only to provide services to us.

Breaches. If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will tell you and the Office of the Privacy Commissioner of Canada, and the provincial commissioner where the law requires it.

Complaints. Write to our Privacy Officer first at compliance@grainwork.io. We will acknowledge your complaint within 7 days and respond within 30 days. You can also complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or to your provincial commissioner, such as the Commission d’accès à l’information du Québec.

European Union

If you are in the European Union or elsewhere in the European Economic Area, the General Data Protection Regulation (GDPR) applies to how we handle your personal information. Grainwork, Inc. is the controller of the personal information we collect about you for our own purposes, such as your account, billing, and communications. When a customer enters information about its own people or clients into Grainwork, that customer is the controller, and we process the information on its behalf, as described under Customer data above. Our contact details are under Contact above.

Legal bases. We rely on these:

Contract: to provide the Service and manage your account and subscription.
Legitimate interests: to secure, support, analyze, and improve the Service, and to send you business communications about Grainwork. We weigh these interests against your rights.
Consent: for non-essential cookies, SMS, and marketing where the law requires consent. You can withdraw consent at any time.
Legal obligation: to keep tax, accounting, and other records the law requires.

You need to give us your name and email address to have an account; other information is optional. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

Your rights. You can ask us for a copy of your personal information, and ask us to correct it, delete it, restrict how we use it, or send it to you or another organization in a portable format. You can object to our use of it based on legitimate interests, and you can object to direct marketing at any time. Write to compliance@grainwork.io. We will respond within 1 month.

Transfers outside the European Economic Area. Your personal information is transferred to and processed in the United States, and some of our service providers process it in the United Kingdom. Where EU law requires a safeguard for a transfer, we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the recipient is certified under it, or on contracts that use the EU Standard Contractual Clauses. You can ask us for details of the safeguard that applies.

Complaints. Write to us first at compliance@grainwork.io. We will acknowledge your complaint within 7 days and respond within 30 days. You can also complain to the data protection authority in the country where you live or work, or where you think the problem happened. The European Data Protection Board lists them.

Israel

If you are in Israel, the Protection of Privacy Law, 5741-1981, and the regulations under it apply to how we handle your personal information. Grainwork, Inc. is the controller of the personal information we collect about you for our own purposes. Our contact details are under Contact above.

Giving us information. You are not under a legal obligation to give us personal information. Giving it is your choice and depends on your consent. If you do not give us your name and email address, we cannot create an account for you. The purposes we use personal information for, and the kinds of providers we share it with and why, are described above.

Access and correction. You can ask to review the personal information we hold about you, and ask us to correct or delete information that is inaccurate, incomplete, unclear, or out of date, by writing to compliance@grainwork.io. We will respond within 30 days.

Direct marketing. You can ask us at any time to remove you from any list we use for direct marketing, and we will.

Sending information overseas. Your personal information is stored and processed in the United States, and some of our service providers are based in, or use subcontractors in, the European Union and the United Kingdom. Our service providers are bound by written agreements to keep it secure, to use it only to provide services to us, and not to pass it on except as we instruct.

Security incidents. If a serious security incident affects your personal information, we will tell you, and the Privacy Protection Authority where Israeli law requires it.

Complaints. Write to us first at compliance@grainwork.io. We will acknowledge your complaint within 7 days and respond within 30 days. You can also complain to the Privacy Protection Authority.

New Zealand

If you are in New Zealand, the Privacy Act 2020 and its information privacy principles apply to how we handle your personal information. Grainwork, Inc. collects and holds it, and our contact details are under Contact above. You need to give us your name and email address to have an account; other information is optional.

Sending information overseas. Your personal information is stored and processed in the United States, and some of our service providers are based in, or use subcontractors in, the European Union and the United Kingdom. Our service providers hold and process it only on our behalf, and we remain responsible for it under the Privacy Act 2020.

Privacy breaches. If a privacy breach involving your personal information has caused or is likely to cause you serious harm, we will tell you and the Privacy Commissioner as soon as practicable, as the Privacy Act 2020 requires.

Complaints. Write to us first at compliance@grainwork.io. We will acknowledge your complaint within 7 days and respond within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz.

United Kingdom

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply to how we handle your personal information. Grainwork, Inc. is the controller of the personal information we collect about you for our own purposes, such as your account, billing, and communications. When a customer enters information about its own people or clients into Grainwork, that customer is the controller, and we process the information on its behalf, as described under Customer data above. Our contact details are under Contact above.

Legal bases. We rely on these:

Contract: to provide the Service and manage your account and subscription.
Legitimate interests: to secure, support, analyze, and improve the Service, and to send you business communications about Grainwork. We weigh these interests against your rights.
Consent: for non-essential cookies, SMS, and marketing where the law requires consent. You can withdraw consent at any time.
Legal obligation: to keep tax, accounting, and other records the law requires.

Transfers outside the United Kingdom. Your personal information is transferred to and processed in the United States, and some of our service providers process it in the European Union. Where UK law requires a safeguard for a transfer, we rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, or on contracts that use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard that applies.

Complaints. Write to us first at compliance@grainwork.io. We will acknowledge your complaint within 7 days and respond within 30 days. You can also complain to the Information Commissioner’s Office at ico.org.uk.