Privacy Policy

Effective date: May 18, 2026

Grunlo LLC ("Company," "we," "us," or "our") operates the Grunlo platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. This policy should be read together with our Terms of Service.

1. Information We Collect

Account Information

When you register for an account, we collect:

Your name, email address, and phone number
Company name and business information
Login credentials (passwords are stored in hashed form only)

Customer Data

As part of using the Service, you and your staff may input data about your customers, including:

Names, addresses, phone numbers, and email addresses
Property and service location details
Job details, notes, service history, and scheduling information
Estimates, invoices, and payment records
Photos and file attachments related to jobs

Payment Information

Payment information (credit card numbers, billing addresses) is collected and processed directly by our payment processor, Stripe, Inc. We do not store your full payment card numbers on our servers. We receive and store only limited billing details (such as the last four digits of your card and billing email) for reference purposes.

Communications Data

If you use our SMS and voice communication features, we collect and store:

SMS message content (sent and received)
Phone numbers involved in communications (sender and recipient)
SMS delivery status and carrier error codes
Call metadata (date, time, duration, call direction, and call outcome such as answered, missed, or voicemail)
Call routing metadata (forwarding numbers, ring groups, and IVR selections)
Voicemail audio recordings and, where enabled, their text transcriptions
Opt-in and opt-out status per phone number (including STOP/START keyword responses)

Usage Data

We automatically collect information about how you interact with the Service, including:

Pages visited and features used
IP addresses and browser/device information
Date and time of access
Referring URLs

Location Data

If you or your staff use field tracking features, we may collect:

GPS coordinates from field technician devices (only while clocked in and with permission enabled)
Address geocoding data for properties and service locations

2. How We Use Information

We use the information we collect to:

Provide and operate the Service -- job scheduling, invoicing, customer management, route optimization, and all other platform features
Process payments -- manage subscriptions, process invoices, and facilitate online payments
Send communications -- deliver appointment reminders, job notifications, missed-call text-backs, and other messages you configure through the Service. Transactional emails (invoices, job updates, account notifications) are sent from mail.grunlo.com. Marketing emails are sent from hello.grunlo.com. All marketing emails include a one-click unsubscribe option.
Provide customer support -- respond to your inquiries and troubleshoot issues
Improve the Service -- analyze usage patterns to enhance features and fix issues
Ensure security -- detect and prevent fraud, abuse, and unauthorized access
Comply with legal obligations -- meet regulatory, tax, and legal requirements
Advertising and audience measurement -- create custom audiences and measure the effectiveness of our advertising on Google platforms (see Section 2.1 below)

2.1 Advertising and Audience Lists

When we prospect businesses about the Service, we may use business contact information (such as email addresses and phone numbers from public business listings, inbound inquiries, or prior outreach) to:

Show relevant advertisements on Google platforms
Build custom audience lists for advertising (Customer Match)
Measure whether our advertising led to signups or other conversions

Contact data uploaded for Customer Match is transferred to Google via Google Ads Data Manager. Google normalizes and hashes identifiers (such as email and phone) before matching. We do not upload message content or unrelated personal data as part of this process.

Opting out. If you receive outreach from us, you may opt out of future marketing emails and removal from our advertising audience lists using the unsubscribe link in our emails or by contacting us at the address in Section 12. Opting out via our lead unsubscribe flow sets your record to not receive further outreach or be included in audience exports.

3. Third-Party Service Providers

We share information with the following third-party service providers who assist us in operating the Service. Each provider only receives the information necessary for their specific function.

Provider	Purpose	Data Shared
Telnyx	SMS and voice delivery, phone number provisioning, 10DLC campaign registration	Phone numbers (sender and recipient), SMS message body text, call metadata (timestamps, duration, direction, disposition), voicemail recording URLs, messaging profile identifiers, and 10DLC campaign registration data
Stripe	Payment processing and subscription billing	Billing name, email, payment method details, transaction amounts
Amazon Web Services (AWS)	Infrastructure hosting, email delivery (SES), file storage (S3/CloudFront), address validation and maps (Location Service)	All data processed through the Service is hosted on AWS infrastructure; emails sent via SES; files stored on S3; addresses geocoded via Location Service
Cloudflare	Content delivery network and security	IP addresses, request metadata (for DDoS protection and performance optimization)
Google (Google Ads / Google Ads Data Manager)	Conversion measurement, ad delivery, Customer Match audience lists	Business contact identifiers (email, phone, name, postal code, country) for prospects we contact about the Service; page views and conversion events on our marketing site via Google tags (see Section 7)

Each of these providers maintains their own privacy policies and data handling practices. We encourage you to review them:

4. SMS, Voice, and Voicemail Disclosures

This section provides detailed information about how data is collected, used, shared, and protected in connection with our SMS, voice, and voicemail features. These features are powered by our telecommunications provider, Telnyx.

4.1 Types of Messages

The Service may send and receive the following types of SMS messages on behalf of our customers (tenants):

Appointment reminders and confirmations
Job status notifications
Missed-call text-back messages
Two-way conversational messages between businesses and their customers
Invoice and payment notifications
Estimate and proposal delivery notifications
Job completion summaries

4.2 Message Frequency

Message frequency varies depending on the tenant's business activity and configuration. There is no fixed number of messages per month. Recipients may receive multiple messages per week during periods of active service.

4.3 Opt-In and Consent

Each business using the Service (tenant) is responsible for obtaining appropriate consent from their customers before sending SMS messages, in compliance with the Telephone Consumer Protection Act (TCPA) and applicable state laws. The Service provides tools to support this, including:

Per-customer notification preferences that can be configured by the business or by the customer through the customer portal
Granular SMS toggles for different notification types (appointment reminders, job updates, invoices, etc.)
A customer-facing portal where recipients can view and update their communication preferences at any time

Consent status is recorded within the Service and can be withdrawn at any time by the recipient through the methods described below.

4.4 Opt-Out (STOP)

Recipients may opt out of SMS messages at any time by replying STOP to any message received from the Service. Opt-out is handled at the carrier network level and takes effect immediately. Once a recipient opts out:

No further SMS messages will be sent to that phone number from the originating number
The sending business (tenant) is notified of the opt-out through delivery status updates
The opt-out is honored regardless of message type

4.5 Opt-In (START)

Recipients who have previously opted out may opt back in by replying START (or UNSTOP) to the number they previously opted out of. This restores message delivery from that number.

4.6 HELP Keyword

Recipients may reply HELP to any message to receive assistance information, including the name of the sending business and instructions for opting out. Recipients may also contact the sending business directly for support.

4.7 Costs

Standard message and data rates from the recipient's mobile carrier may apply. The Service does not charge recipients for receiving messages; any charges are between the recipient and their carrier.

4.8 Voice Calls and Voicemail

When a tenant provisions a phone number through the Service, inbound and outbound voice calls are routed through Telnyx's telecommunications network. The following data is collected and stored:

Call metadata -- caller ID, called number, timestamps, call duration, call direction (inbound/outbound), and call outcome (answered, missed, voicemail, busy, failed)
Voicemail recordings -- when a caller leaves a voicemail, the audio recording is retrieved from Telnyx over an encrypted connection, then stored on Amazon Web Services (AWS) S3 with server-side encryption. Each recording is stored under the specific tenant's isolated storage path
Voicemail transcriptions -- where enabled by the tenant, voicemail audio is transcribed to text. Transcriptions are stored alongside the call record and are accessible only to the tenant
Missed-call text-back -- when configured, the Service automatically sends an SMS to callers whose calls were not answered, letting them know the business will follow up. The recipient's phone number and the text-back message content are shared with Telnyx to deliver this SMS

Voicemail recordings and transcriptions are accessible only to the tenant whose phone number received the call. They are not shared with other tenants or used by the Company for any purpose other than providing the Service.

4.9 Data Shared with Telnyx and Why

To provide SMS, voice, and voicemail features, we share specific categories of data with Telnyx. Below is a detailed breakdown of what is shared and the purpose of each:

Data Category	What Is Shared	Why It Is Shared
Phone numbers	Sender and recipient phone numbers for each SMS or call	Required to route messages and calls to the correct recipient
SMS message body	The text content of each outbound SMS	Required for Telnyx to deliver the message to the recipient's carrier
Call control signals	Instructions for call routing, forwarding, hold, and voicemail (via TeXML)	Required for Telnyx to execute call flows configured by the tenant
Voicemail recordings	Telnyx temporarily hosts the recording; we retrieve it via authenticated API call	Required to transfer the recording to our secure storage (AWS S3) for the tenant
Messaging profile IDs	Internal identifiers that associate messages with a tenant's messaging configuration	Required for Telnyx to apply the correct sending rules, number pool, and compliance settings
10DLC campaign IDs	Campaign registration identifiers required by U.S. carriers for application-to-person (A2P) messaging	Required for carrier compliance; messages without a valid campaign ID may be blocked

Telnyx processes all data it receives in accordance with its Privacy Policy and applicable telecommunications regulations. Telnyx does not use the content of your messages or calls for its own marketing or advertising purposes.

4.10 Mobile Information Sharing Restrictions

Your mobile information will not be sold, rented, loaned, or shared with third parties for promotional or marketing purposes.

All categories of data described in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties except as described in this section.

We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. We may share your personal data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to:

Telnyx -- our telecommunications provider, for SMS delivery, voice call routing, and phone number provisioning
Amazon Web Services (AWS) -- our hosting and infrastructure provider, for data storage, processing, and email delivery
Any other vendors who assist us in the delivery of text messages or voice services

These parties are contractually obligated to use your data solely for the purpose of providing their services to us and are prohibited from using your data for their own marketing or promotional purposes. No mobile information is shared with affiliates, partner companies, or any other entity for cross-promotional or marketing use.

4.11 Retention of SMS and Voice Data

We retain SMS, voice, and voicemail data as follows:

SMS messages -- message content, phone numbers, and delivery statuses are retained while the tenant's account is active and for 30 days after account termination, after which they are permanently deleted from active systems
Voicemail recordings -- audio files stored on AWS S3 are retained while the tenant's account is active and deleted within 30 days of account termination
Voicemail transcriptions -- retained on the same schedule as voicemail recordings
Call metadata -- call logs (timestamps, duration, direction, outcome) are retained while the tenant's account is active and for 30 days after termination
Telnyx API and webhook logs -- raw request and response payloads exchanged with Telnyx are retained for 90 days for debugging, compliance, and dispute resolution, then automatically purged

Backups containing communication data may persist for up to 90 days after deletion from active systems before being fully purged.

5. Data Storage and Security

We take the security of your data seriously and implement appropriate technical and organizational measures, including:

Encryption in transit -- all data transmitted between your browser and our servers is encrypted using TLS/SSL
Encryption at rest -- data stored on our infrastructure is encrypted at rest
Access controls -- access to customer data is restricted to authorized personnel and systems on a need-to-know basis
Tenant isolation -- each customer account (tenant) is logically isolated; your data is never shared with or accessible to other tenants
Regular backups -- data is backed up regularly to prevent loss

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Data Ownership and Processing

You own your data. All customer data you input into the Service remains your property. We act as a data processor on your behalf.

Data export. You may request an export of your data at any time by contacting us.

Data deletion. Upon account termination, we will retain your data for a reasonable period (typically 30 days) to allow for data export. After that period, your data will be permanently deleted from our active systems. Backups containing your data may persist for up to 90 days before being purged.

7. Cookies and Tracking

We use essential session cookies to operate the Service (e.g., to maintain your login session and CSRF protection). These cookies are strictly necessary and cannot be disabled.

On our public marketing website and signup flows, we may use Google tags (such as Google Analytics 4 and Google Ads conversion measurement) to understand how visitors use our site and whether advertising campaigns lead to signups. These tags may set cookies or use similar technologies on your browser. This is separate from Customer Match uploads described in Section 2.1, which use business contact data you have provided or that we obtained in connection with sales prospecting.

Across our website and the Service, we also use product-analytics and session-replay tools, including Microsoft Clarity and FullStory, to understand how the product is used and to diagnose issues. These tools may record interactions such as mouse movements, clicks, scrolling, and the pages you visit, and may set cookies or use similar technologies. We use this information to improve the product and troubleshoot problems. For more information about how Microsoft collects and uses data, see the Microsoft Privacy Statement.

You can control certain ad and analytics settings through your browser, device settings, or Google Ads Settings. If we materially change how we use cookies or similar technologies, we will update this policy and provide notice where required.

8. Children's Privacy

The Service is not directed at or intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it promptly.

9. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal information:

Access -- request a copy of the personal information we hold about you
Correction -- request that we correct inaccurate or incomplete information
Deletion -- request that we delete your personal information, subject to legal retention requirements
Portability -- request your data in a portable, machine-readable format
Objection -- object to certain processing of your data

To exercise any of these rights, please contact us using the information below. We will respond to your request within 30 days.

10. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. We also retain data as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods:

Account data -- retained while your account is active and for 30 days after termination
API and webhook logs -- retained for 90 days for debugging and compliance
Communication records (SMS/voice) -- see Section 4.11 above for detailed retention schedules for SMS messages, voicemail recordings, call metadata, and API logs
Payment records -- retained as required by tax and financial reporting regulations

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where practicable, by email to the account owner. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Grunlo LLC
Email: [email protected]