Privacy Policy

1. Who We Are

Traece B.V., operating as Grasp ("Grasp," "we," "our," "us"), respects your privacy and is committed to protecting the personal data of our customers, their users, and visitors to our website. This Privacy Policy explains how we collect, process, store, and protect personal data, and outlines your rights under the EU General Data Protection Regulation (GDPR).

Grasp helps organizations find the work AI should be doing. We run an eight-week sprint with your own team, provide the software that keeps the resulting workflows running (Grasp Work), and offer an add-on that keeps AI use across your company in view, including shadow AI (Grasp Govern).

We act as a:

• Data Processor — when processing customer data on behalf of our clients (who are the data controllers). This processing is governed by our DPA.
• Data Controller — when collecting data from website visitors, people who book a call or sign up for our newsletter, or marketing contacts.

For any privacy-related questions or requests, you can reach our privacy contact at info@joingrasp.com.

Our commitment is to data protection, transparency, and security at all times.

2. Types of Data We Collect

A. Customer & User Data (Processed on Behalf of Customers)

When providing our platform, we process personal data from several sources. The categories below summarise this processing; the authoritative description is set out in Annex I of our DPA.

Identity Provider (SSO) Data

Grasp connects to your organization's Identity Provider (Google Workspace or Microsoft Entra ID) to build a complete view of your application landscape. We process:

• Directory data and organizational structure (departments, teams, roles, managers)
• Connected applications and AI tool sign-in events visible in the SSO directory
• Authentication and access metadata (SSO login activity, session metadata, MFA status, OAuth scopes; OAuth tokens are encrypted at rest)

Desktop Agent Data

Where deployed (distributed via your organization's MDM solution), Pulse, Grasp's small app for company laptops (the desktop agent), detects the software and web applications in use across your environment, including shadow IT and shadow AI tools. The agent processes:

• Device identifier and hardware metadata (device model, operating system, hostname)
• Installed application inventory and versions
• Application and process names, and bundle/package identifiers
• Number of application sessions
• Visited domains and browser extension identifiers

To protect employee privacy, the agent is configured to minimise its footprint:

• It operates only during configured working hours (by default 09:00–17:00). Administrators can adjust this window in Grasp's settings where needed.
• It distinguishes business from personal browsing using the managed company browser profile.

The agent collects domain-level signals only. It does NOT collect: full URLs, page paths, or query strings (anything beyond the domain name); the content of web pages; screenshots or screen recordings; form inputs; keystrokes or keyboard input; file contents or file names on the device; passwords; or microphone, camera, or other sensor data.

The agent is designed to identify which applications and web services are in use — not to monitor what employees do inside those applications.

Platform Activity Data

• Login and activity data within the Grasp platform itself
• Role, permissions, and departmental information within Grasp
• Governance decisions and their recorded reasons (approve, block, and dismiss actions are logged with user attribution for compliance and audit purposes)
• Support tickets or correspondence with our support team

Special categories of data. The Services are not intended to process special categories of personal data (Article 9 GDPR), and customers are contractually required not to submit such data to the Services.

Customer and user data is never used to train AI models.

B. Website & Marketing Data

When you use our website, book a call or sign up for our newsletter, we may collect:

• Name, business email, company name, job title, company size and what you would like to talk about
• If you book a call by talking to our assistant: a recording of each spoken answer, used only to write it down, and the resulting text
• Questions you type into the question box on our pages
• Page views, counted without cookies and without storing anything on your device
• IP address, browser type, device information
• Cookies or similar technologies for marketing, analytics, and performance (subject to your consent via our cookie consent banner)

3. How We Use Personal Data

We only process personal data for legitimate and necessary purposes:

1. Delivering Our Services — Operate, maintain, and improve the Grasp platform; provide workflow mapping and measurement, application discovery, shadow AI detection, governance records and dashboards, AI-powered insights, and recommendations.

2. Security and Compliance — Monitor access, detect anomalies, and prevent unauthorized activity; protect against fraud, abuse, or data breaches; keep the records our customers need for their own obligations.

3. Customer Support & Communication — Respond to inquiries and provide technical support; communicate product updates, release notes, and relevant announcements.

4. Legal & Regulatory Obligations — Comply with applicable laws, regulations, or court orders.

Note: Personal data is not used for AI model training or sold to third parties.

4. Legal Basis for Processing

Under GDPR, Traece processes personal data on one or more legal grounds. Where Grasp acts as a processor, we process customer and user data on the documented instructions of the customer (the controller), and the customer is responsible for establishing the legal basis for that processing. Where Grasp acts as a controller (website, marketing, and direct contacts), the legal bases below apply.

Where we rely on legitimate interests, we conduct balancing tests to ensure our interests do not override the rights of data subjects. Where we rely on consent (e.g., marketing communications, cookie consent), it is requested explicitly and can be withdrawn at any time.

5. Automated Decision-Making

Grasp uses AI-powered features to assist our customers with governance decisions, including agent recommendations (e.g., suggesting whether to approve, block, or investigate an application) and risk scoring.

These features are advisory only. All governance decisions are made by authorized human users (typically CISOs or IT administrators) within the customer's organization. Grasp does not make automated decisions that produce legal or similarly significant effects on individuals without human review.

Confidence scores and recommendations are generated based on the customer's own precedent data and configurable rules — not on profiling of individual employees.

6. Sharing Personal Data

We do not sell personal data. We share personal data only where necessary to deliver our services, and only with the following categories of recipients:

• Cloud infrastructure and hosting providers (EU/EEA)
• AI / large language model API providers (used to classify and reason over AI-tool signals)
• Web-research and enrichment providers (retrieval of publicly available vendor documentation; breach-exposure checks for email addresses)
• Payment and billing providers
• CRM and business-tooling providers
• Transactional email providers
• Marketing email and newsletter providers
• Product analytics providers (anonymized usage data)
• Security and content-delivery providers
• Scheduling, speech and notification providers used on our website

On our own website (where Grasp is the controller) we use these providers:

• Cloudflare: hosts and secures the website, and checks that a form is sent by a person (Turnstile).
• Google Tag Manager and Google Ads: load our tags and, with your consent, measure whether one of our ads led to a booking.
• PostHog (EU): counts page views without cookies. Only the page path is sent, never a profile of you.
• Leadfeeder: recognises which company a visit comes from, using the IP address.
• Cal.com: shows the calendar and makes the booking when you pick a time. It receives your name, email, company, role, company size and what you would like to talk about.
• Anthropic: its language model answers questions typed into the question box on our pages, and works out what was said when you book a call by talking to our assistant. It receives the text of your question or answers.
• ElevenLabs: turns what you say to our booking assistant into text, and the assistant’s replies into speech. It receives the recording of each spoken answer.
• Resend: sends the newsletter confirmation and our emails.
• Discord: carries a notification to our own team when a call is booked, with the details you gave.
• Featurebase: runs our help centre, on its own site.

Grasp does not store or log what you type into the question box or say to the booking assistant. Your booking details leave the page only when you book.

A complete and up-to-date list of the sub-processors that process customer data on our customers' behalf — including each provider's name, purpose, and data location — is maintained in Annex III of our DPA, which forms part of our customer contracts. Providers used for our own website and marketing activities (where Grasp is the controller) fall under the categories above and this Privacy Policy. Customers are notified of any changes to our sub-processors, and may exercise any objection rights, in accordance with Section 6 of the DPA.

7. International Data Transfers

Most processing takes place within the EU/EEA. A limited number of sub-processors process specific data outside the EU/EEA — for example, the AI, speech, scheduling and notification providers used on our website (Section 6), AI and web-research providers (which receive domains, application names, and similar non-identifying signals), breach-exposure checks (which receive email addresses), and limited onward payment-processing transfers. Where this occurs:

• All transfers comply with Chapter V GDPR.
• We rely on an appropriate transfer mechanism — the EU-US Data Privacy Framework where the provider is certified, and/or Standard Contractual Clauses (SCCs) adopted by the European Commission — and apply supplementary measures (including encryption in transit, encryption at rest, and access controls).
• Where applicable, we assess the data protection laws of the recipient country in line with EDPB guidance.

The specific transfer locations and mechanisms applicable to each sub-processor are set out in Section 10 and Annex III of our DPA.

8. Data Retention

Retention follows the schedule in Section 12 of our DPA, which is the authoritative source for customer data:

• Customer & User Data — exportable through the Services during the contract term and during a 30-day post-termination grace period. After the grace period, customer data is deleted within a further 30 days, except for the limited categories below.
• Encrypted backups (held by infrastructure sub-processors) — deleted in line with the sub-processor's standard backup cycle, and in any event within 90 days of termination.
• Operational logs (held by infrastructure sub-processors for security, observability, and abuse prevention) — retained in line with the relevant sub-processor's documented retention policies.
• Billing and transaction records (held by Grasp and our payment provider) — retained for up to 7 years to comply with Dutch tax and accounting law.
• Email delivery logs (where transactional email is enabled) — retained in line with the email provider's documented retention policy.
• Website & Marketing Data — retained for analytics and marketing purposes for up to 36 months, unless the law requires otherwise or you withdraw consent earlier.

9. Data Security Measures

Traece implements technical and organizational measures appropriate to the risk, in line with Article 32 GDPR. These are set out in full in Annex II of our DPA and include:

• Encryption at rest (AES-256 where provided by the relevant hosting or database provider) and in transit (TLS 1.2 or higher, or equivalent secure transport)
• Multi-factor authentication (MFA) for all personnel accessing production systems
• Role-based access control on a least-privilege basis, with logical tenant segregation
• Backups and durable storage protected by the relevant providers' encryption and resilience controls
• Security monitoring, logging, and a documented incident response procedure
• Vulnerability scanning of dependencies and infrastructure
• Employee confidentiality obligations and security awareness training

We conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities, including desktop agent deployment, in accordance with GDPR Article 35.

10. Data Subject Rights (GDPR)

Data subjects have the following rights under GDPR:

1. Access — request a copy of your personal data

2. Correction — correct inaccurate or incomplete data

3. Erasure — request deletion of personal data (subject to contractual or legal limits)

4. Restriction — limit the processing of your personal data in specific contexts

5. Objection — object to processing based on legitimate interests

6. Data Portability — request a machine-readable copy of your data for transfer

7. Withdraw Consent — where processing is based on consent, you may withdraw it at any time

For employees of Grasp customers: your employer is the data controller. Please direct data subject requests to your organization's IT or privacy team in the first instance. We will assist your employer in fulfilling these requests in accordance with our DPA.

For website visitors and direct contacts: contact us directly at info@joingrasp.com.

We respond to all data subject requests within one month, as the GDPR requires.

11. Data Breach Notification

If a personal data breach occurs:

• We will notify affected customers (controllers) without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with GDPR Article 33 and Section 8 of our DPA.
• We will provide all information necessary for customers to assess the impact and fulfill their own notification obligations.
• We will provide assistance to mitigate potential harm and document all breaches in our internal breach register.

12. Cookies and Tracking

Grasp uses cookies and similar technologies on our website for analytics, performance, and marketing purposes.

• Strictly necessary cookies are used without consent (session management, security).
• Analytics and marketing cookies are only placed after you provide consent via our cookie consent banner.
• Page views are also counted without cookies: nothing is stored on your device and no profile is built.
• You can manage or withdraw cookie consent at any time via the cookie settings on our website.

Cookie data is not sold and is only shared with authorized sub-processors. For full details, see our Cookie Policy.

13. Our Own Use of AI

Grasp uses a large language model (provided via OpenAI's API) to classify and reason over signals in your AI-tool catalog. Inputs may include application names, process names, bundle identifiers, and domains derived from your environment. No directly identifying personal data of data subjects (such as names or email addresses) is transmitted to this provider.

• We use API-only access. Customer data is not used to train, fine-tune, or improve third-party AI models, and our AI sub-processors are engaged under terms that prohibit or default-disable such use.
• AI outputs within Grasp (recommendations, risk scores) are advisory and always subject to human decision-making by the customer's authorized users.

Our AI agent is part of the Grasp platform. It runs on the AI sub-processors listed in Annex III of our DPA, under terms that exclude customer data from model training.

On our website, the question box and the booking assistant use a language model provided by Anthropic through its API, and the booking assistant uses ElevenLabs to turn speech into text and text into speech. They receive only what you type or say there. Under its API terms Anthropic does not use this data to train its models.

This section is consistent with Section 14 and Annex III of our DPA. We are committed to responsible AI use and monitor our own compliance with the EU AI Act as it applies to our platform.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Significant updates will be communicated through our platform, website, or email at least 30 days before they take effect. The "Effective Date" at the top of this page reflects the most recent revision.

15. Contact Us

For questions, data subject requests, or GDPR inquiries:

Traece B.V., operating as Grasp

• General inquiries: info@joingrasp.com
• Website: joingrasp.com
• Registered office: Vrije Heerlijkheid 39, 1566 MH Assendelft (gemeente Zaanstad), the Netherlands
• KVK (Chamber of Commerce) number: 98464604

If you are unsatisfied with our response, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) at autoriteitpersoonsgegevens.nl.