Privacy Policy
Effective 16 September 2026. This policy replaces our previous privacy policy, which described a hosted service we no longer operate.
About this policy
At GRID we care about your privacy and the protection of your personal data. We process relatively little of it, but we do process some, and this policy explains what, why, and what rights you have.
This policy covers grid.is, docs.grid.is, and our dealings with prospective and current customers, suppliers, and job applicants. It applies to GRID ehf. and its subsidiary GRID Software Inc. GRID ehf. is the data controller for everything described here, except where this policy says that we act as a processor on your behalf.
What our software does not collect
GRID’s products are software libraries. The spreadsheet engine, viewer, editor, and agent tools install from npm and run inside your own application and infrastructure.
We do not receive your spreadsheets, your cell data, your formulas, or any information about the people who use your product. There is no GRID server in the path between your application and your data.
The one exception is described in the next section, and it is limited to the free evaluation licence.
The evaluation licence check
Packages running under the free evaluation licence send a single small request to us when the software initialises, containing the name and version of the GRID package in use and the runtime environment it is running in. Like any request over the internet, it also reveals the IP address it was sent from and the time it was sent. It contains no spreadsheet content, no data you have entered into the software, and no usage data beyond the fact that the software started. If the request fails, for example in an offline or restricted environment, the software works regardless.
We do this to understand the volume and geography of evaluation use and to identify use that has outgrown the evaluation terms, which permit development, testing, and personal use but not commercial products. Our legal basis is our legitimate interest in enforcing our own licence terms. We use this data for no other purpose.
If you are a developer evaluating GRID on your own machine, the IP address is yours. If our software runs in your end users’ browsers under an evaluation licence, it is theirs. If you are evaluating GRID anywhere other than a private development environment, please tell your users that this data is sent to us and point them to this policy.
Packages under a commercial licence send no such request. Once you are licensed, our software makes no contact with us. If that ever changes, we will update this policy and our licence terms before it does.
Information you give us through our forms
Our contact form and our commercial licensing form ask for your full name, work email address, company, optionally your job title, and a message. We use this to reply to you and, where relevant, to discuss licensing. Our legal basis is our legitimate interest in responding to enquiries and pursuing a possible business relationship. You do not have to give us any of this, but we cannot reply without a way to reach you.
We do not send marketing email. Filling in a form does not add you to a mailing list.
Files you send us for support
If you send us a spreadsheet so we can reproduce a problem and it contains personal data, you remain the data controller and we act as a processor on your instruction. Access is limited to the people working on your issue, and we delete the file within 30 days of the issue being closed. We use the file for no other purpose. Where you can, please send a redacted or synthetic workbook instead of live data.
Cookies
We use cookies and similar technologies, such as pixels and local storage, on grid.is. Our documentation site, docs.grid.is, sets no cookies and runs no analytics.
When you first visit grid.is, our consent tool asks which categories you accept, and you can change or withdraw your choice at any time through the Cookie Settings link in our footer.
Necessary. Required for the site to work and to remember your cookie choice. These cannot be disabled, and we set them on the basis of our legitimate interest in operating a secure, working website.
Preferences. Remember display choices such as language or theme.
Analytics. Help us understand how the site is used.
Marketing. Allow advertising platforms to recognise you across websites and to measure our campaigns. These platforms receive your IP address and information about your activity on our site, and may combine it with data they already hold about you.
Analytics, preference, and marketing cookies are set only if you consent, and consent is our legal basis for them. The individual cookies in each category, the companies that provide them, and their lifetimes are listed in the cookie declaration in our Cookie Settings panel.
Business contacts, suppliers, and partners
If you work for one of our suppliers, partners, or another company we deal with, we may process your name, work email address, job title, and phone number in order to manage that relationship. Our legal basis is our legitimate interest in running our business, or the performance of a contract.
Job applicants
Applications are handled through an external recruitment platform. We process what you send us in order to assess your application, on the basis of our legitimate interest in recruiting. We keep applications for 6 months unless you ask us to delete them sooner.
Service providers
We use service providers who process personal data only on our behalf, under contract, and on our instruction. They are not permitted to use it for their own purposes. They are:
an email and document provider
a file storage provider
a customer support platform
a recruitment platform
a cookie consent provider
a website analytics platform
a content delivery and website security provider
a website hosting provider
an electronic signature provider
an accounting and invoicing provider
The advertising and analytics platforms listed in our cookie declaration act as controllers in their own right for the data they collect through cookies, and their own privacy policies govern it.
Otherwise we disclose personal data only to our professional advisers, such as lawyers, accountants, and auditors, who are bound by confidentiality, or where the law or a court order requires it, or where we need to in order to establish or defend a legal claim. If GRID is acquired or merged with another company, personal data may transfer to the new owner as part of that transaction, and this policy will continue to apply to it until it is updated.
Transfers outside the EEA
Some of our service providers process personal data outside the EEA, including in the United States. Where that happens, the transfer is covered by appropriate safeguards: an adequacy decision of the European Commission, the European Commission’s standard contractual clauses, the EU–US Data Privacy Framework, or a combination of these.
How long we keep things
Enquiries and licensing conversations: 24 months from our last contact with you, or for the duration of the relationship plus 24 months if you become a customer
Supplier and partner contact details: for the duration of the relationship plus 24 months
Support files: 30 days after the issue is closed
Job applications: 6 months
Accounting and invoicing records: seven years, as required by Icelandic bookkeeping law
Cookies: as set out in the cookie declaration
Records from services we no longer operate: until 31 August 2027 for accounts that never had a paid subscription; seven years for paid-subscription records
Security
We handle personal data in a way designed to keep it from being lost, misused, disclosed, or altered, and we limit access to the people who need it for their work. If a personal data breach is likely to put you at high risk, we will tell you, as the law requires.
Services we no longer operate
We previously operated a hosted spreadsheet product at grid.is and a no-code calculator tool at calculatorstudio.co, both retired on 31 August 2026. We still hold some account and subscriber records from those services. We are not using them. Records of accounts that never had a paid subscription will be deleted by 31 August 2027. Records relating to paid subscriptions are kept for seven years, as Icelandic bookkeeping law requires for accounting records. If you used either service and want your records deleted sooner, email us.
Your rights
You have the right to ask us for a copy of the personal data we hold about you, to have it corrected or deleted, to receive it in a portable form, to object to processing based on our legitimate interests, and to ask us to restrict processing. Where we rely on your consent, you can withdraw it at any time, which does not affect processing that has already taken place.
Email [email protected] and we will respond within one month, or within three months for complex or numerous requests, in which case we will tell you why. We may ask you to confirm your identity first. You can also lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is).
Changes to this policy
We may update this policy. Changes take effect when we post them here, and the effective date at the top shows when that last happened. If a change significantly affects how we handle your personal data, we will draw attention to it here.
Contact
GRID ehf.
Reg. no. 630718-0740
Síðumúli 27
108 Reykjavík
Iceland