Privacy policy

Draft for legal review. Bracketed items must be confirmed by counsel and the Pivital operations owner before this policy is published as final.

This policy explains what Grace collects, why, who receives it, and how long it is kept. Grace is a private AI assistant for families, operated by Pivital Systems, LLC of Phoenix, Arizona (“Pivital”, “we”, “us”).

What this policy covers

It covers the Grace website, the family workspaces hosted at addresses such as yourfamily.gracefor.you, and the Grace apps and services. Your family’s workspace is controlled by its parents, so some choices described below are made by a parent on the family’s behalf.

Information we collect

Account information. Names, and email addresses for parents, adult members and seniors. Child accounts use a username and password and never need an email address. Passwords are stored by our authentication service in hashed form, not as readable text.

Family information. The family name, the workspace address, who belongs to the family, their roles (parent, adult member, senior or child), and which access groups and personas each person may use.

Content you add. Chats and messages, documents and pictures you attach, the text extracted from them, family knowledge bases, family projects, and shared family discussions.

Usage and limits. How much each member uses Grace, measured in tokens and minutes, and the daily limits and curfews a parent sets. Parents can see these totals.

Billing information. Customer and subscription identifiers, seat counts and checkout details. Payment card details are entered with and held by Stripe.

Security records. Sign-in, sign-out, password change and account recovery events, kept so we can detect misuse and investigate problems.

Technical and error information. Error and performance details from our servers. If we enable an error-monitoring service, it may also receive request details, which we configure to exclude message content.

Web search. When Grace answers a question with web search, the search text is sent to our search provider.

Children

Read the dedicated children’s privacy notice for a plain-language explanation and parent choices.

Parents create child accounts. A parent sets the child’s username and password, and the child signs in to the family’s workspace with that username. We do not ask children for an email address or other contact details.

Parents can read their child’s chats, and can join a chat so the child can see the parent is present. Messages from child accounts are checked by a safety model before they reach Grace, and parents can set limits on when, how long and how much a child may use Grace.

[Counsel to confirm: the children’s privacy obligations that apply, including whether verifiable parental consent is required under the Children’s Online Privacy Protection Act or any state law, and how the parental consent step is recorded.]

Adult members and senior accounts are different. Their chats are private: parents cannot read them, and they are not safety-screened.

How we use information

Our AI transparency notice explains AI inputs, external processing, and limitations.

• To run Grace: sign you in, store your family’s chats and documents, answer your questions, and keep family members’ access correct.
• To apply the limits and curfews a parent sets, and to show parents usage totals.
• To bill your family for the seats it has, and to keep the subscription in step with the people in the family.
• To keep the service secure, prevent misuse, and investigate incidents.
• To send transactional messages such as invitations, password resets and sign-in links.
• To comply with the law and respond to valid legal requests.

[Counsel to confirm: whether Pivital uses personal information for product improvement or model training, and if so, the opt-out available to each account type. This policy must not state a position until it is confirmed.]

Who receives information

Our service-provider disclosure identifies providers, their purposes, the information involved, and processing that depends on optional features. Provider identities and data practices are important privacy information; private technical configurations are not needed to explain them.

[Counsel and operations must confirm the complete list and whether information is sold or shared for advertising. No blanket no-sale or no-training assurance is made in this draft.]

We may also disclose information if the law requires it, or to protect the safety of people or the security of Grace.

How long we keep information

• Source documents may be removed after they are indexed, according to a setting the family or Pivital controls. Extracted text and summaries are kept on their own schedule, and are included in deletion requests.
• Deactivated accounts and families are scheduled for deletion. [Retention period to be confirmed.]
• Backups are kept for [backup retention period to be confirmed] and then overwritten.
• Superseded knowledge pack versions are kept for a restore window of [restore window to be confirmed] and then removed.
• Security and delivery records support account protection, investigation, and message delivery. [The complete retention schedule must be confirmed.]

Removing access is not the same as erasing every record immediately. Family-shared content, billing records, and information subject to legal obligations may need separate handling. Contact us for help with a deletion request.

How we protect information

Grace uses account permissions, family-scoped access controls, protected document storage, encrypted connections, and security records. Our security overview explains these measures and how to report a concern. We do not publish credentials, private endpoints, internal topology, or detailed defensive configurations.

No system is perfectly secure. If we learn of a breach that affects your information, we will notify you as the law requires.

Your choices and rights

• Parents can view, change and remove members and their access, set limits, switch Grace off for a member, and remove a child account.
• Anyone can ask us, using the contact details below, for a copy of the personal information we hold about them, for a correction, or for deletion. We will respond within [response period to be confirmed].

[Counsel to confirm: state-specific rights, including any applicable to residents of California and other states, and the procedure for verifying requests made on behalf of a child.]

Where information is processed

[Counsel and operations to confirm: the hosting regions for Supabase, Render, Vercel and each provider in the table above, and any transfers outside the United States.]

Changes to this policy

We will post changes here and update the date at the top. [Counsel to confirm: advance notice to families for material changes, and the method of notice.]

Contact

Pivital Systems, LLC, Phoenix, Arizona. Use our contact form for privacy questions or requests. Do not include sensitive family information in your initial message. [Required privacy contact details and postal address remain to be confirmed.]