Granditude
Granditude

What We Do

Partners & Integrations

Working Together

Stories

  • Svenska

    Privacy policy

    Last updated: 9 November 2026

    This policy explains how Granditude AB handles personal data on our website, in the Granditude Commerce web applications and in the Granditude Commerce mobile app for iOS and Android.

    1. Who we are

    Granditude AB (org. no. 556919-8301), Drottninggatan 71C, 111 36 Stockholm, Sweden ("Granditude", "we", "us").

    Contact us about privacy at support@granditude.com or +46 (0)70 840 69 51.

    This policy covers:

    • our website, granditude.com
    • the Granditude Commerce web applications: PIM, Order Management, Warehouse (WMS), Purchase Management, Pricing Optimisation, Storefront Admin, Connect and Aurora
    • the Granditude Commerce mobile app for iOS and Android

    2. Our two roles

    We are the controller for personal data about visitors to our website, people who contact us, and the users who sign in to Granditude Commerce (their user accounts).

    We are a processor for the business data our customers store in Granditude Commerce: products, orders, deliveries, stock, and the names and contact details of their own customers and suppliers. We process that data only on our customer's instructions, under a data processing agreement. Our customer is the controller.

    If you buy from or sell to a business that uses Granditude Commerce, contact that business about your personal data. We help them answer your request.

    3. Website visitors

    What we collect

    • Technical data: IP address, browser and device type, pages visited, the page you came from, and cookie identifiers.
    • What you send us by email or through a form: name, email address, phone number, company and your message.

    Why, and on what legal basis

    • To answer your questions and follow up on your interest in our services (legitimate interest).
    • To see how the website is used and improve it, with Google Analytics (consent).
    • To measure our marketing on LinkedIn, with the LinkedIn Insight Tag (consent).

    Cookies

    We use cookies that the website needs to work, and, only if you agree, cookies for statistics (Google Analytics, through Google Tag Manager) and marketing (LinkedIn Insight Tag). You can change your choice at any time in the cookie settings on the website or by clearing cookies in your browser.

    4. Users of Granditude Commerce (web and mobile)

    Granditude or your organisation's administrator creates your account. You can't create an account in the apps yourself.

    What we collect

    • Your name, work email address, company, your roles and which apps you can use, and your language preference.
    • Your password, which we store only as a secure hash and never in readable form.
    • Sign-in and security logs: time of sign-in, IP address, and device or browser type.
    • What you do in the apps as part of your organisation's business records, for example who created an order, registered a delivery or counted stock.
    • If you allow browser notifications in Connect: a notification token for your browser (Google Firebase Cloud Messaging).

    Why, and on what legal basis

    To provide Granditude Commerce to your organisation under our agreement with it, to sign you in and keep your account secure, to send you invitations and service emails, and to give support. The legal basis is our legitimate interest in providing the service your organisation has ordered, and our agreement with your organisation.

    5. The mobile app

    • Signing in. Your email address and password are sent encrypted to our servers. The app keeps a sign-in token in your device's secure storage (iOS Keychain or Android Keystore). It never stores your password.
    • Settings on your device. Your language, light or dark theme, selected market and warehouse, the app you used last and how prices are shown are stored only on your device.
    • Camera. The app uses the camera to scan barcodes and QR codes and to take product photos. Scanning happens on your device: camera images are neither stored nor sent, unless you take a product photo and save it to a product.
    • Photos. The app opens your photo library only when you choose to add a photo to a product. Only the photos you pick are uploaded.
    • What the app doesn't do. It doesn't use your location, contacts or microphone. It has no advertising, no analytics or tracking tools, and doesn't track you across other apps or websites. We don't sell personal data.
    • App updates. The app checks for updates through our update service, Expo (650 Industries, Inc.), which receives technical information such as the app version, the device platform and your IP address.
    • Your organisation's data. Personal data about your organisation's customers that you see or enter in the app (for example names, addresses and email addresses on orders) is processed on your organisation's behalf, as described in section 2.

    6. Who we share personal data with

    We never sell personal data. We use these service providers, who process data only on our instructions:

    • Google Cloud (Google Cloud EMEA Ltd): hosting, databases and file storage, in data centres in Finland (europe-north1).
    • MongoDB Atlas (MongoDB, Inc.): databases.
    • Expo (650 Industries, Inc.): delivering updates to the mobile app.
    • Google Firebase Cloud Messaging (Google): browser notifications in the web applications.
    • Brevo (Sendinblue SAS): sending invitations and service emails.
    • Google Analytics (Google) and LinkedIn (LinkedIn Ireland): on our website only, and only with your consent.

    Integrations your organisation turns on, such as Fortnox, nShift, PostNord or Nexi, receive the data your organisation sends them. We also share data with authorities when the law requires it.

    7. Transfers outside the EU/EEA

    We store data in the EU. Some of our providers are based in the United States (Google, Expo, MongoDB). When data is transferred outside the EU/EEA, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

    8. How long we keep personal data

    • Website inquiries: up to 24 months after our last contact.
    • Website statistics: as set in Google Analytics, at most 14 months.
    • User accounts: for as long as your account is active. We delete your account within 30 days after you or your organisation asks us to, or after your organisation's agreement with us ends.
    • Sign-in and security logs: up to 12 months.
    • Business data in Granditude Commerce: as agreed with our customer. It is deleted after the agreement ends, unless the law requires us to keep it longer.

    9. Security

    All traffic between the apps, the website and our servers is encrypted (HTTPS/TLS). Access to data is limited by roles, passwords are stored as secure hashes, sign-in tokens on mobile devices are kept in the device's secure storage, and our data is stored in data centres in the EU.

    10. Your rights

    Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw a consent you have given. Email support@granditude.com and we will answer within one month.

    You also have the right to complain to the Swedish Authority for Privacy Protection (IMY), www.imy.se.

    11. Deleting your account

    You can ask us to delete your Granditude Commerce account and the personal data linked to it. Read how on Delete your account.

    12. Children

    Granditude Commerce is a service for businesses and isn't meant for children under 16. We don't knowingly collect personal data about children.

    13. Changes to this policy

    When we change this policy, we update the date at the top. If a change matters for how we use your data, we tell our customers and users before it takes effect.