LAST UPDATED · August 21, 2026
How we handle account data, website data, and the sales performance data customers upload or sync into Grit Board.
This Privacy Policy explains how Grit Board LLC ("Grit Board," "we," "us," or "our") collects, uses, shares, and protects personal data when you visit our website, create an account, or use the Grit Board service.
Grit Board helps sales managers turn sales activity and performance data into boards, games, and coaching views. That means the service may process personal data about managers who use the service and sales representatives whose data is uploaded or synced by a customer.
For account, billing, support, and website data, Grit Board generally acts as the business or controller. For sales-rep roster, activity, pipeline, quota, and performance data that a customer uploads or syncs into Grit Board, the customer is generally the controller and Grit Board acts as a processor or service provider acting on the customer's instructions.
We collect data you provide directly, data generated by your use of the service, and data customers upload or sync into the product.
We use personal data to provide, operate, secure, and improve Grit Board. We do not sell personal data, and we do not use customer-uploaded sales-rep data to advertise to sales reps.
Grit Board scores and ranks reps using rules the manager configures. Those scores are inputs for a manager, not automated decisions about anyone's employment — Grit Board never makes an employment decision on its own. If you believe automated scoring significantly affects you, you can object through your employer or by emailing hello@gritboard.io.
Where laws such as the EU GDPR, UK GDPR, Brazil's LGPD, or similar data protection laws apply, we rely on appropriate legal bases for processing. Depending on the context, these may include performance of a contract, legitimate interests, consent, compliance with legal obligations, or instructions from the customer as controller.
For customer-uploaded or synced sales-rep data, the customer is responsible for identifying and maintaining the legal basis for collecting and providing that data to Grit Board, including any required notices, consents, employment-law analysis, or workplace monitoring disclosures.
Customers decide what sales-rep data they upload or sync, which users may access it, how scoring rules are configured, and how boards are used inside their organization. Grit Board processes that data to provide the service and according to the customer's instructions.
When a customer connects a CRM, Grit Board reads only the records needed to count activity for the current season, adds them up per rep, and stores the totals. The underlying CRM records are not copied into Grit Board. The OAuth credentials for the connection are held by Nango, our integration provider — Grit Board stores only a reference to the connection, never the tokens themselves.
If you are a sales representative whose data appears in Grit Board, please contact your employer or the organization using Grit Board first. They control the underlying data and are usually best placed to answer questions or handle requests to access, correct, delete, or restrict the data.
Grit Board uses a small, fixed set of providers to run the service: Vercel (hosting), Supabase (database and authentication), Stripe (billing), Resend (transactional email), PostHog (product analytics), and Nango (the OAuth connection layer for CRM sync). Each one is under a data processing agreement.
The Subprocessors page lists each provider, what it does, and where it processes data. We keep it current, and we will update it before a new provider starts handling customer data.
Grit Board is operated from the United States, and our providers process data in the United States and, for some of them, in other countries. If you use Grit Board from Latin America, the European Economic Area, the United Kingdom, or elsewhere, your data will be processed in the US.
For transfers out of the EEA, the UK, or Brazil, we rely on the standard contractual clauses in our agreements with each provider, and on our own DPA with customers. Where a provider is certified under the EU-US Data Privacy Framework, that applies too — though we do not rely on it alone, since its status is under appeal.
Grit Board does not delete data on a timer. Account and sales data stay until you delete them or close the account — a season you uploaded in January is still there in December unless you remove it.
The account owner can export the organization's data — seasons, rep rows, and account records — as a JSON file, or permanently delete the account, from Settings at any time. Deletion removes the organization, its seasons, rep rows, memberships, and coin and reward history, and deletes the associated sign-in accounts. It is immediate and cannot be undone.
After deletion, two things survive on purpose: backup copies we take before database changes, which are kept briefly and replaced as new ones are taken, and the email suppression list, which keeps a record that an address unsubscribed so we do not email it again. Server logs roll off on our providers' own schedules.
Every table in our database has row-level security switched on, and every query is scoped to a single organization — keeping one customer's reps invisible to another is the rule we design around first. Data is encrypted in transit, hosted on providers with their own audited controls, and access to production is limited to the founder.
Our product analytics never receive rep names, stats, or file contents — only counts and identifiers — and we do not record screen sessions. Grit Board is not SOC 2 certified, and we will not claim otherwise until it is. Our Security page describes what is in place, and what is not, in detail.
No online service can promise absolute security. Customers are responsible for who they invite into their workspace and for uploading only data they are allowed to process.
If we discover a breach affecting personal data in your account, we will email the account owner without undue delay and, where the law sets a deadline, within 72 hours of becoming aware of it. We will tell you what happened, what data was involved, what we have done, and what you should do.
We would rather send you an early notice that turns out to be minor than a late one that was not.
Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about how your personal data is processed, under laws such as the GDPR in Spain and Portugal, Brazil's LGPD, Mexico's federal data protection law, California privacy law, and similar laws in parts of Latin America.
If you have a Grit Board account, the fastest route is Settings: the account owner can export the organization's data as JSON or delete the account outright. For anything else — access, correction, restriction, objection, withdrawing consent — email hello@gritboard.io. We will confirm receipt and respond within 30 days, or any shorter period the applicable law requires; if we need longer we will tell you why.
If you are a sales rep whose numbers appear on a board, contact your employer first. They chose what to upload and they control it. If you write to us instead, we will pass the request to them and tell you we have done so.
You may also have the right to complain to a data protection authority. In Spain that is the Agencia Española de Protección de Datos; in Portugal, the Comissão Nacional de Proteção de Datos; in Brazil, the Autoridade Nacional de Proteção de Datos; and in Mexico, the Secretaría Anticorrupción y Buen Gobierno, which took over personal-data protection from INAI in 2025.
For individuals in Mexico, this section supplements the rest of this Privacy Policy as an integral privacy notice under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares — the 2025 law that replaced the 2010 statute. The controller (responsable) for account, website, billing, and support data is Grit Board LLC, 6378 W 9890 N, Highland, UT 84003, United States. Our designated privacy contact is hello@gritboard.io.
For sales data a customer uploads or syncs, Grit Board acts as an encargado (processor) on the customer's documented instructions; the customer is the responsable, and providing the required privacy notice to its reps and maintaining the legal basis for the processing are the customer's obligations.
The primary purposes for processing personal data are to provide and secure the service, create and manage accounts, authenticate users, process billing, provide support, operate boards and games, process customer-uploaded or synced sales data, communicate service notices, comply with legal obligations, and enforce our agreements. Secondary purposes are product analytics and product improvement; to opt out of analytics for your account, email hello@gritboard.io and we will exclude you. Marketing emails carry a one-click unsubscribe.
Grit Board scores and ranks sales performance automatically, using rules your employer configures. Those scores inform a manager; they are not automated decisions about your employment. If automated processing of your data significantly affects you, you have the right to oppose it — contact your employer, who controls the data, or email hello@gritboard.io.
Mexico residents may exercise ARCO rights: access, rectification, cancellation, and opposition. You may also revoke consent where processing is based on consent, or ask us to limit the use or disclosure of your personal data. Send requests to hello@gritboard.io with enough information for us to verify your identity and locate the data. We respond within 20 business days and, where a request is granted, give effect to it within 15 business days after that, as the law provides.
We may share personal data with the service providers, advisers, authorities, and transaction counterparties described in this Privacy Policy. Where a disclosure is a transfer requiring your consent under Mexican law, we will not make it if you refuse; sharing with our service providers acting on our instructions is not a transfer under that law.
We do not intentionally collect sensitive personal data through Grit Board unless a customer uploads or syncs it. Customers should not provide sensitive personal data unless they have a lawful basis and any required express consent or notice.
Grit Board is a business service and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us at hello@gritboard.io so we can take appropriate action.
We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify customers, such as posting the updated policy, updating the "Last updated" date, or sending a notice through the service.
You can contact Grit Board LLC about privacy questions or requests at hello@gritboard.io. That address is also our designated privacy contact for Mexico and our data-subject communication channel under Brazil's LGPD.
Mailing address: Grit Board LLC, 6378 W 9890 N, Highland, UT 84003, United States.